Security Auditor — career path
StationX Intermediate
The independent check: test controls against the standard and report what you find. Security+ and ITIL for the grounding, the controls and GRC for the substance, then ISO 27001 lead auditor and CISA.
The path
Step 1 — Security foundation
You audit controls; this is where you learn what they are.
follows a certification path
Learn
- PathFollow the CompTIA Security+ (SY0-701) path — the certification audit adverts list first
Step 2 — Service management
The process framework your audit evidence comes from.
follows a certification path
Learn
- PathFollow the ITIL 4 Foundation path — ITIL sits beside Security+ on auditor adverts
Step 3 — The controls, hands on
See the controls you will audit actually assessed — vulnerability scans, findings, evidence.
1 course · 31 labs
Learn
- CourseGRC Fundamentals - Learn Governance, Risk, and Compliance 🔒 StationX Unlimited
8 sections · 28 lectures
- Course Overview 2
- Introduction 1
- Introducing GRC 5
- Risk Management 7
- Compliance 5
- Advancing GRC in an Organization 6
- Conclusion 1
- Audio Version of Training 1
Practise
- LabsVulnerability Assessment Analyst — 31 labs 🔒 StationX Unlimited
- Analyze SQL Injection Attack
- Analyze and Update a Company BCP/BIA/DRP/CIRP
- Auditing Service Accounts and Setting Up Automated Log Collection
- Centralized Monitoring
- Comprehensive Threat Response
- Conduct Log Analysis and Cross Examination for False Positives
- Core Impact Web Application Penetration Testing
- Creating Recommendations Based on Vulnerability Assessments
- Data Backup to Prep for Recovery
- Firewall Setup and Configuration
- Gap Analysis of Firewall Rules
- Identify Whether High-Risk Systems Were Affected
- Identifying System Vulnerabilities with OpenVAS
- Implementing Least-Privilege on Windows
- Manual Vulnerability Assessment
- Manually Creating a Baseline with MD5Deep
- Monitoring and Verifying Management Systems
- Network Discovery
- Network Segmentation (FW/DMZ/WAN/LAN)
- Open Source Password Cracking
- Penetration Tester Challenge
- Performing an Initial Attack Analysis
- Phishing
- Preliminary Scanning
- SNORT Configuration and Operation Lab
- Threat Designation
- Using Snort and Wireshark to Analyze Traffic
- Vulnerability Proof of Concept and Remediation
- Vulnerability Scanning with GVM
- Windows System Hardening with Group Policy & Active Directory
- Windows System Hardening with PowerShell
Step 4 — Audit against the standard
Plan, run and report an ISMS audit.
follows a certification path
Learn
- PathFollow the ISO/IEC 27001:2022 — Lead Implementer and Auditor path — lead auditor — the audit method itself
Step 5 — The audit certification
The credential the profession is built on.
follows a certification path
Learn
- PathFollow the CISA — Certified Information Systems Auditor path — the information systems auditor certification
Where this leads
- CRISC — Certified in Risk and Information Systems Control — Advanced
- CISM — Certified Information Security Manager — Advanced
- Cyber Security Compliance Officer — career path — Intermediate
Advanced · after the job
The AI-Driven Security Auditor
Senior roles are going to the people who can direct AI to build security solutions. When you're working in the role and ready for that step, the AI Master's Program is where it's taught — an advanced, application-only programme.
See the AI Master's Program →Application-only. A separate programme for when you're ready.