Postgraduate Diploma in Threat Modeling, Pen-Testing and Vulnerability Management
Online 800 h Postgraduate Diploma in Threat Modeling, Pen-Testing and Vulnerability Management. 8 modules covering ISO/IEC 27001, NIST SP 800-115 (technical security testing) and OWASP ZAP. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Develop threat models using STRIDE and attack trees.
Plan authorised security tests following recognised methodologies.
Assess the security of web applications against the OWASP Top 10.
Review the hardening of systems and networks.
Prioritise vulnerabilities using CVSS and business context.
Design a vulnerability and patch management programme.
Write technical and executive reports on results.
Who it's for
- Cybersecurity analyst looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Security auditor looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Vulnerability management manager looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Application security engineer looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Cybersecurity consultant looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Technology risk analyst looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Engineering or science graduates seeking to enter cybersecurity consulting.
What you'll work with
- ISO/IEC 27001
- NIST SP 800-115 (technical security testing)
- OWASP Testing Guide
- ISO/IEC 29147 (vulnerability disclosure)
- ISO/IEC 30111 (vulnerability handling)
- CVSS v3.1 (FIRST)
- National Security Scheme (Esquema Nacional de Seguridad, RD 311/2022)
8 modules · 800 h
1.1Assets, threats and exposure surface1.2Confidentiality, integrity and availability1.3Vulnerability lifecycle1.4Reference frameworks: NIST CSF and ISO/IEC 270011.5Professional ethics and written authorisation1.6Rules of engagement and audit scope1.7Legal liability and data protection1.8Blue team and red team roles1.9Security metrics for management1.10Workshop: asset inventory of an SME
2.1Objectives of threat modelling2.2Data flow diagrams and trust boundaries2.3STRIDE methodology2.4Attack trees and prioritisation2.5PASTA and risk-oriented modelling2.6Modelling cloud architectures2.7Modelling industrial systems2.8Integration into the secure development lifecycle2.9Modelling and documentation tools2.10Practice: threat model of a web application
3.1Types of testing: black box, grey box and white box3.2OWASP Testing Guide methodology3.3PTES and OSSTMM as frameworks3.4Test planning and scope3.5Controlled laboratory environments3.6Evidence collection and traceability3.7Risk management during testing3.8Client coordination and escalation3.9Quality control of work3.10Case study: authorised test plan
4.1OWASP Top 10 and its interpretation4.2Authentication and session management4.3Access control and authorisation4.4Input validation and output encoding4.5REST API security4.6Secure server configuration4.7Static and dynamic code analysis4.8Third-party dependency review4.9Mitigation measures and verification4.10Laboratory: audit of a practice application
5.1Segmentation and secure network architecture5.2Operating system hardening5.3Identity management and secure Active Directory5.4Secure cloud configuration5.5Event logging and monitoring5.6Detection of weak configurations5.7Backups and resilience5.8Network incident response5.9Verification of defensive controls5.10Laboratory: hardening review of a server
6.1Vulnerability management programme6.2Vulnerability scanners and their tuning6.3CVE, CWE and public databases6.4CVSS scoring and risk context6.5Prioritisation based on known exploitability6.6Patch management and change windows6.7Exceptions and accepted risk6.8Metrics: remediation time and coverage6.9Responsible vulnerability disclosure6.10Practice: prioritised remediation plan
7.1Structure of an audit report7.2Executive summary for management7.3Technical description of findings7.4Evidence and reproducibility7.5Remediation recommendations7.6Verification of fixes7.7Presenting results to the client7.8Report confidentiality7.9Common reporting errors7.10Workshop: writing a complete report
8.1Scope definition and authorisation8.2System threat modelling8.3Test plan and laboratory environment8.4Controlled test execution8.5Analysis and prioritisation of findings8.6Vulnerability management plan8.7Proposal of defensive measures8.8Executive and technical report8.9Dissertation and presentation8.10Final review with the tutor
How you'll learn
Training 100 % online on the SEIUM campus, with downloadable material, recorded classes and assigned technical tutor. No fixed timetables: the student progresses at their own pace within the intake, making it possible to combine with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is OWASP ZAP, Nessus, OpenVAS, Microsoft Threat Modeling Tool, Wireshark, in free, academic or evaluation versions. Tests are studied using real procedures in isolated virtual laboratories, authorised audits of practice applications and vulnerability management exercises. Assessment is continuous per module, plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Develop threat models using STRIDE and attack trees.
Plan authorised security tests following recognised methodologies.
Assess the security of web applications against the OWASP Top 10.
Review the hardening of systems and networks.
Prioritise vulnerabilities using CVSS and business context.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The programme works with OWASP ZAP, Nessus, OpenVAS, Microsoft Threat Modeling Tool, Wireshark. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the integrative project. This is in-house training, not an official Ministry qualification.
Yes. Modules passed in a course or diploma in the same area are credited towards the advanced programme. Check the credit transfer policy when you enrol.
Related programmes
Postgraduate Diploma in Safe Teleoperation and Control Centres
Online Postgraduate Diploma of 800 h in safe teleoperation and control centres. 8 modules covering ISO 11064, 3GPP TS 22.186 and ROS 2. Dedicated tutor and…
Diploma in Regulatory Strategy and International Homologation for AD
Online postgraduate diploma of 800 hours in regulatory strategy and international type approval for automated driving (AD). 8 modules covering the WP.29 framework, UN R157, R155…
Postgraduate Diploma in External Signalling (eHMI) and Passenger Acceptance
Online 800-hour Postgraduate Diploma in External Signalling (eHMI) and Passenger Acceptance. 8 modules covering ISO/TR 23049:2018, SAE J3134 and Unity. Assigned tutor and open enrolment.
More in Autonomous, ADAS & Software-Defined Vehicle
All Autonomous, ADAS & Software-Defined Vehicle programmes → · How to apply · Fees & financing · Scholarships