Training Manual by Profile
🌟 Objective
To organise the training content suggested by the SbD-ToE manual by technical functional profile.
This document serves as the basis for:
- Building practical tracks by role
- Structured technical onboarding
- Plans for knowledge retention and rotation
📌 Aligned with Chapter 01 - Risk Management, proportional application by risk level must modulate the depth of the content.
🧬 Suggested content by role
👤 Dev (Developers)
| Topic | Recommended format |
|---|
| Secure coding | Labs with real flaws (e.g. Juice Shop) |
| Secure Pull Requests | Templates + fortnightly Code Clinics |
| Threat Modelling per feature | Peer-led sessions |
| Dependency management | Labs with lockfiles, SCA, SBOM |
| Pipelines with scanners | Integration workshop |
| Token control | Abuse simulation + scope review |
| Secure use of Docker images | Practical hardening |
👤 QA (Testers / Quality Assurance)
| Topic | Recommended format |
|---|
| Acceptance criteria that include security | Cross-review + real examples |
| Security testing (SAST, DAST, fuzzing) | Guided labs + simulation |
| Participation in Threat Modelling | Sessions per epic |
| Validation of requirements | Checklist + functional labs |
| Analysis of alerts and false positives | War Room + detection tuning |
| Review of bugs with a security cause | Internal case study |
👤 PO (Product Owners)
| Topic | Recommended format |
|---|
| Risk classification | Workshop + guided exercise |
| Prioritisation of security requirements | Practical session + historical examples |
| Management of justified exceptions | Rotating review + impact analysis |
| Legal implications (NIS2, DORA) | Executive training |
| Storytelling of real failures | Internal repository + sharing in the retro |
| Topic | Recommended format |
|---|
| Security in CI/CD pipelines | Workshop on stages with scanners |
| Secrets management | Lab with Vault and scopes |
| Image hardening | PR review + analysis with Trivy |
| IaC scanners and validation | Hands-on with Checkov/TFSec |
| Deploy with rollback and feature flags | Rollout simulation |
| Alerts and tuning | War Room + operational dashboards |
👤 AppSec (Application Security)
| Topic | Recommended format |
|---|
| Facilitation of Threat Modelling | Training + real sessions |
| Creation of training tracks | Alignment with Ch. 13 and Ch. 1 |
| Analysis of dependencies and vulnerabilities | Practical cases with SBOM + SCA |
| PR review + pairing | Regular sessions with the teams |
| Running CTFs, quizzes, war rooms | Plan of rotating activities |
| Metrics governance | Dashboard + follow-up |
👤 Management (Team Leads, Executives, Organisational Security)
| Topic | Recommended format |
|---|
| Training governance and traceability | Reports + track audits |
| Contractual requirements (third parties) | Legal sessions + standard clauses |
| Maturity metrics | Analysis of security/training KPIs |
| Promotion of Champions | Internal visibility plan |
| Participation in post-mortems | Corrective actions with cultural reinforcement |
✅ Good practices
- Define tracks by profile + risk (L1–L3) based on this mapping
- Include actions in the backlog, LMS or onboarding plans
- Measure retention and effectiveness with quizzes, labs, shadowing or real PRs
- Involve Champions in the curation and facilitation of continuous training
📎 Cross-references
| Document | Direct relation |
|---|
02-trilho-formativo.md | Formal matrix by profile and risk |
01-catalogo-formativo.md | Mapping by chapter and format |
03-programa-champions.md | Multipliers in dissemination |
90-indicadores-metricas.md | KPIs by profile and by content |
🎯 Training by profile is the practical basis of the proportional application of the SbD-ToE.
Its effectiveness depends on contextual relevance, practical repetition and peer validation.