// CyberJKD · Master Roadmap · v2.7
CyberJKD
FOUNDATIONS → DEFENSE → CLOUD → OFFENSE → ENGINEERING
PHASE 01
Systems Foundation
// Identity: Infrastructure Thinker
6 / 7 DONE
⏳ IN PROGRESS
MONTHS 0–6
// Core Focus Areas
Operating Systems (deep)
Networking fundamentals
Linux comfort & CLI
Python scripting basics
Bash automation
File systems & permissions
// Foundation Pillars
MASTER THE CORE SERVICE CATEGORIES
COMPUTE
VMs · processing · workload execution
NETWORK
VLANs · firewalls · traffic flow
STORAGE
File systems · permissions · data
// Mission Objectives
01
Harden a Linux VM
disable services · lock SSH · firewall config · full report
02
03
Wireshark packet analysis
live capture · protocol identification · anomaly flagging
✓ Apr 28 2026
⌥ GitHub
04
Python log parser script
parse auth logs · detect failed logins · clean summary output
✓ May 2 2026
⌥ GitHub
05
Brute force simulation + log analysis
controlled lab only · study what attack looks like in logs
✓ May 3 2026
⌥ GitHub
06
B819 Router Firmware Research
reverse engineered 4G/5G router · found JS simStatus bug · wrote Patch v1.0 · UART root shell pending
// Target Certifications
Jul 2026
AZ-900 — Azure Fundamentals
Entry point into the confirmed path: AZ-900 → AZ-104 → AZ-500 → SC-200. Azure first, deep, then expand.
PHASE 02
Defensive Maturity
// Identity: Detection-Aware Engineer
3 / 5 DONE
⏳ IN PROGRESS
MONTHS 6–12
// Core Focus Areas
Windows event logs
Linux system logs
SIEM (Splunk / Security Onion)
ServiceNow ITSM
Incident response workflow
MITRE ATT&CK framework
Threat modeling
Vulnerability management
// Tools to Master
Splunk
Tenable Nessus
ServiceNow
Wireshark
Security Onion
// Mission Objectives
01
02
03
04
Create a custom detection rule
write Splunk/Sigma rule catching a real-world attack pattern
— TODO
05
Write a full incident response report
timeline · IOCs · affected systems · containment · lessons learned
— TODO
// Target Certifications
After labs
Splunk Core Certified User
Cert follows the SIEM hands-on. Build first.
Phase 02
AZ-900 — Azure Fundamentals
Entry point into the Azure pathway. Study alongside Phase 02 labs.
After AZ-900
AZ-104 — Azure Administrator Associate
The cert hiring managers actually look for. Proves real Azure operational capability.
After AZ-500
SC-200 — Microsoft Security Operations Analyst
Sentinel + Defender + incident response. Maps directly to the SIEM/ITSM work in this phase.
Always
Principle: Think Operationally
Not a cert — a mindset. Every technique studied, ask how it would be detected.
PHASE 03
Cloud Entry - Azure Deep
// Identity: Cloud-Aware Security Engineer
2 / 18 DONE
⏳ IN PROGRESS
MONTHS 9–15
// Azure Core Focus Areas
Azure IAM + RBAC (deep)
Virtual Networks + NSGs
Microsoft Entra ID
Privileged Identity Management
Conditional Access policies
Managed Identities
Defender for Cloud
Microsoft Sentinel + KQL
Log Analytics workspace
Azure Key Vault
Azure Policy + Compliance
Azure Purview
Private Endpoints
Zero Trust architecture
Azure Cost Management + FinOps
Shared responsibility model
// Tools to Master
Microsoft Sentinel
Defender for Cloud
Log Analytics + KQL
Microsoft Entra ID
Azure Key Vault
Azure Purview
Logic Apps
Azure Cost Management
Azure Static Web Apps
Terraform
GitHub Actions
Packer
Azure Compute Gallery
OpenSCAP
// Mission Objectives
01
Deploy Azure VM + harden it
NSGs · private endpoints · disable unused ports · lock IAM · document every decision
— TODO
02
03
04
Automated Backup System
Blob Storage + versioning + lifecycle policies + daily Logic Apps confirmation
— TODO
05
Website Uptime Monitor
timer-triggered Functions + 3 checks + email/SMS alerts + Workbooks
— TODO
06
Azure Cost + Governance Dashboard
Cost Management budgets · tagging policy · Azure Policy · cost anomaly runbook
— TODO
07
Customer Inquiry Manager
App Service + Azure OpenAI categorization + SQL + Logic Apps routing
— TODO
08
AI Inventory Tracker
App Service + SQL + real-time stock + Azure OpenAI predictive restock
— TODO
09
Azure Security Posture Dashboard
Defender for Cloud + Azure Policy baselines + Log Analytics workbook
— TODO
10
Zero Trust Identity Pipeline
PIM just-in-time access + conditional access + managed identity auth · before/after Entra ID logs
— TODO
11
Automated Incident Detection + Response
Sentinel workspace + KQL rules (priv escalation · impossible travel) + Logic Apps auto-playbook
— TODO
12
Document the Azure Shared Responsibility Model
map Microsoft vs your responsibility across IaaS · PaaS · SaaS · threat model a fictional enterprise
— TODO
13
Migrate Roadmap to Azure Static Web Apps + CI/CD Pipeline
GitHub Actions auto-deploy on push → Azure Static Web Apps → custom domain → HTTPS automatic. The roadmap becomes a live proof of the exact skills it describes.
— PLANNED
14
Hub-Spoke Network Architecture + Azure Firewall
hub VNet + spoke VNets · Azure Firewall as centralized control · UDRs to route all spoke traffic through hub · Azure Bastion for secure VM access · Terraform IaC deployment · network segmentation + zero trust perimeter
— TODO
15
RHEL 9 Golden Image Pipeline
Packer · Azure Compute Gallery · OpenSCAP hardening baseline
— TODO
16
Portfolio Triad I — Infrastructure & Automation (Terraform)
Azure environment fully deployed via Terraform · VNet with public/private subnets · NSGs with least-privilege rules · VM in private subnet · storage account for logging/backups · everything parameterized · remote state in Azure Blob. Business framing: a small company needs a secure, repeatable cloud environment deployable consistently across dev/staging/prod without manual configuration errors.
— PLANNED
17
Portfolio Triad II — Automation & Monitoring (Azure Monitor + KQL)
Azure Monitor connected to the Project 16 VM · Log Analytics workspace · KQL queries surfacing CPU spikes, failed logins, disk usage trends · alert rules on threshold breach · Logic App notification. Business framing: a company can't afford to manually watch their systems around the clock — this automates the watching so engineers only get involved when something needs attention.
— PLANNED
18
Portfolio Triad III — CI/CD Pipeline (Terraform + GitHub Actions)
Terraform repo from Project 16 connected to GitHub Actions · pipeline runs on every push · terraform validate + plan on commit · manual approval gate before apply · terraform apply executes + logs results · branch protection rules block unreviewed merges. Business framing: every infrastructure change goes through a controlled, auditable process that prevents unauthorized or untested changes reaching production.
— PLANNED
// Value Pillars — Every Project Maps to One
GOLDEN RULE — LEAD WITH THE BUSINESS OUTCOME
Services are supporting details — outcomes are what hiring managers remember. Every project maps to at least one pillar below.
Cost Optimization
→ Project 06
Data Resilience
→ Project 04
Monitoring & Reliability
→ Project 05
AI & Automation
→ Projects 07, 08
Security
→ Projects 09, 10, 11
Infrastructure Automation
→ Projects 13, 14, 15
// Target Certifications
Phase 03
AZ-104 — Azure Administrator
Primary Phase 03 cert. After hands-on projects are complete.
Stretch
AZ-305 — Azure Solutions Architect
Architect-level thinking for Cloud Security Engineers.
PHASE 04
Controlled Offensive + Multi-Cloud
// Identity: Precision Striker
0 / 5 DONE
— PENDING
MONTHS 12–18
// Core Focus Areas
eJPT certification path
HackTheBox labs
Active Directory attacks
Web exploitation basics
Privilege escalation
AWS fundamentals entry
GCP fundamentals entry
Professional report writing
// Mission Objectives
01
Complete eJPT + document lab methodology
write every machine like a real professional pentest report
— TODO
02
Build an Active Directory home lab
set up AD · attack it · then detect those attacks in event logs
— TODO
03
Complete 5 HTB machines + write reports
methodology · findings · exploitation · remediation for each
— TODO
04
AWS fundamentals lab — EC2, IAM, S3, VPC
first AWS hands-on · Azure knowledge transfers · document differences
— TODO
05
Write a privilege escalation cheatsheet
Linux + Windows paths · detection methods · how defenders catch each one
— TODO
// Target Certifications
Phase 04
AWS SAA — Solutions Architect Associate
After AWS hands-on. Azure foundation makes this faster.
Phase 04
GCPACE — Google Cloud Associate Engineer
GCP entry. Third platform after Azure + AWS.
Always
The One Rule
Every offensive technique studied through a defensive lens first. Always ask: how would this be detected?
PHASE 05
Cloud Security Engineering + AI
// Identity: Builder of Secure Systems
0 / 8 DONE
— PENDING
MONTHS 18–24
// Core Focus Areas
Advanced Azure security
Privileged Access Management
Container security
CI/CD pipeline security
Terraform IaC
DevSecOps fundamentals
Secure deployment pipelines
Multi-cloud security architecture
// Mission Objectives
01
Secure Azure deployment with Terraform
IaC · security controls baked in · deploy from scratch with one command
— TODO
02
Harden a container environment
Docker/K8s · image scanning · runtime policies · secrets management
— TODO
03
CI/CD pipeline with security gates
SAST · dependency checks · secrets detection · GitLab policy · manual approval
— TODO
04
Implement CyberArk PAM in lab
privileged account management · session recording · vault config · audit trails
— TODO
05
Write a cloud security architecture document
threat model + controls map for a multi-cloud enterprise · assets · threats · vulnerabilities · prioritized controls
— TODO
// AI Security Layer — The $300K Differentiator (included in 0/8)
AI-01
Secure an Azure OpenAI deployment
content filters · private endpoints · Entra ID auth · monitor API via Log Analytics
— TODO
AI-02
Map OWASP LLM Top 10 to Azure controls
each risk category → Azure service that addresses it → controls playbook
— TODO
AI-03
Build an AI security posture report
Azure Purview for training data classification · data governance controls · before vs after posture improvement
— TODO
// Target Certifications — The Full Stack
Primary
AZ-500 — Azure Security Engineer
The money cert for Azure Cloud Security Engineering.
Differentiator
AI-102 — Azure AI Engineer Associate
Rare skill. Rare compensation. Engineers who secure AI on Azure.
Advanced
AWS SAP — Solutions Architect Professional
Multi-cloud depth after Azure is mastered.
Advanced
GCPPCA — GCP Professional Cloud Architect
Three-cloud architecture capability.
DevSecOps
GitLab Associate + Terraform Associate
CI/CD security and IaC for Cloud Security Engineers.
PAM
CyberArk Sentry + CyberArk Defender
Privileged Access Management — enterprise standard.
Long range
OSCP
After offensive phase is complete. Built on deep real skill — never shortcuts.
🎯 Employment Milestone - Months 12–18
SOC Analyst
Cloud Security Intern
Azure Administrator
Junior Security Engineer
IT Security Analyst
You don't wait until Month 24. You start applying when Phase 02 feels solid.
Portfolio on GitHub. Lab reports documented. Projects shipped. AZ-900 + AZ-104 in hand. That is your resume.
Portfolio on GitHub. Lab reports documented. Projects shipped. AZ-900 + AZ-104 in hand. That is your resume.
⚡ The Blueprint - Cloud Security Engineer · Six Figures+
AZ-900
AZ-104
AZ-305
GCPACE
GCPPCA
AWS SAA
AI-102
AWS SAP
GitLab Assoc.
Terraform Assoc.
CyberArk Sentry
CyberArk Defender
This is the proven path. Every cert above has a phase and a project behind it on this roadmap.
Build the skill first. The cert follows the work — always.
Build the skill first. The cert follows the work — always.