RCSERKR Certified Security Expert

Design-authority module: candidates produce and defend reference architectures for multi-site enterprises and AI datacenters using NIST SP 800-207 zero-trust tenets. Covers macro/micro-segmentation strategy, policy enforcement point placement across Juniper SRX, Cisco Secure Firewall and PAN-OS estates, SASE/ZTNA integration (identity-aware proxying, device posture), east-west controls for GPU fabrics, and failure-domain engineering — how the security layer degrades and recovers under link, node and control-plane failure.

Expert firewall internals across the two dominant Indian enterprise stacks. Juniper: SRX chassis clusters (redundancy groups, RETH interfaces, control/fabric links), logical systems, unified policies, IDP tuning, asymmetric-flow troubleshooting with flow traceoptions. Cisco: FTD HA and clustering under FMC, prefilter vs access-control policy, Snort 3 custom rules, SSL decryption policy design. The module ends where modern operations lives: rendering firewall policy from Git with Ansible/Terraform, pre-change validation, and drift detection across both vendors.

Cryptography as infrastructure, not theory. IKEv2 internals (EAP, fragmentation, NAT-T edge cases), Juniper ADVPN dynamic spoke-to-spoke overlays, Cisco FlexVPN, and route-based multi-vendor interop. Enterprise PKI at scale with EJBCA/Smallstep — certificate profiles, OCSP/CRL availability engineering, automated enrollment via SCEP/EST/ACME. Post-quantum readiness with RFC 8784 post-quantum pre-shared keys and hybrid key-exchange roadmaps, plus MACsec (802.1AE) with MKA for datacenter interconnects where IPsec throughput is prohibitive.

Identity becomes the perimeter. Expert 802.1X with EAP-TLS at scale, Cisco ISE and Aruba ClearPass policy engineering, RADIUS Change-of-Authorization for dynamic quarantine, posture assessment, and profiling for unmanaged/IoT/OT devices. Enforcement translated into the fabric: TrustSec SGTs and SGACLs, VXLAN Group Policy Option in leaf-spine datacenters, and downloadable ACLs — including the operational reality of scaling group-based policy across thousands of endpoints without TCAM exhaustion.

Build the SOC, don't just sit in it. Sensor engineering with Zeek and Suricata (tuning, file extraction, JA4 fingerprinting), telemetry transport over Kafka with schema discipline, and analytics on Elastic or Splunk with correctly engineered index lifecycle and EPS budgets. Detection engineering as a software practice: Sigma rules in Git, CI pipelines that replay attack PCAPs/EVTX to validate every detection before deploy, MITRE ATT&CK Navigator coverage scoring, and SOAR playbooks (Shuffle/Cortex XSOAR) that automate triage and containment with human-in-the-loop gates.

Hypothesis-driven hunting as a repeatable engineering loop: frame a hypothesis from threat intel, express it as queries over Zeek/EDR/DNS telemetry, hunt, and convert findings into permanent detections. Techniques include C2 beacon detection via timing/jitter analysis and JA3/JA4 TLS fingerprinting, DNS tunneling detection with entropy and query-volume analytics, LOLBin abuse hunting in Windows telemetry, and YARA-based sweeps. Purple teaming with MITRE Caldera and Atomic Red Team closes the loop — emulate a named adversary, measure what the M05 pipeline caught, and fix the gaps.

Court-defensible forensics at enterprise scale. Memory forensics with Volatility 3 (process injection, credential material, rootkit artefacts), disk forensics with The Sleuth Kit/Autopsy (NTFS internals, $MFT/$UsnJrnl, shadow copies), fleet-wide triage and collection with Velociraptor (VQL artefacts), super-timeline construction with Plaso/Timesketch, static/dynamic malware triage in an isolated sandbox, and network forensics — full-PCAP reconstruction, carving exfiltrated files, decrypting TLS with captured key material. Chain-of-custody, evidence hashing and report standards run through everything.

India's regulatory stack, engineered rather than memorized. DPDP Act 2023 and DPDP Rules 2025 obligations for Data Fiduciaries and Significant Data Fiduciaries — consent architecture, data-principal rights workflows, breach notification, cross-border transfer conditions, and penalties up to Rs 250 crore. CERT-In directions: the 6-hour incident-reporting window, 180-day log retention, synchronized NTP. Sectoral overlays (RBI cyber framework, SEBI CSCRF) and ISO 27001:2022 as the audit backbone. Candidates build the compliance machinery — evidence automation, breach runbooks, audit programs — and then get audited.

The full rehearsal for the RCSE practical exam. Candidates take command of a live, multi-vendor estate into which RKR detonates a realistic double-extortion campaign — initial access, lateral movement through a misconfigured segment, ransomware staging, and DNS exfiltration. They must lead detection, scoping, containment across SRX/FTD/ISE, forensic investigation, eradication and recovery, then close with regulator notifications and an executive briefing. Incident-command discipline (roles, comms cadence, decision logs) is graded alongside technical execution, followed by a marked mock exam and viva.