Software Security Testing Standards Course
Online 300 h course in software security testing standards. 6 modules covering ISO/IEC/IEEE 29119 (software testing), OWASP ASVS (application security verification) and Burp Suite. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Integrate security into every phase of the development lifecycle.
Interpret standards and reference frameworks in security testing.
Apply static, dynamic and dependency analysis techniques.
Adapt testing to the requirements of regulated sectors.
Automate security tests within a continuous integration chain.
Manage vulnerabilities using prioritisation and tracking criteria.
Design a security test plan for a software product.
Who it's for
- Security testing engineer looking to specialise in Software Security Testing Standards.
- Application security analyst looking to specialise in Software Security Testing Standards.
- DevSecOps engineer looking to specialise in Software Security Testing Standards.
- Software security auditor looking to specialise in Software Security Testing Standards.
- Software quality manager looking to specialise in Software Security Testing Standards.
- Cybersecurity compliance consultant looking to specialise in Software Security Testing Standards.
- Engineering or science graduates seeking to enter software development.
What you'll work with
- ISO/IEC/IEEE 29119 (software testing)
- OWASP ASVS (application security verification)
- NIST SP 800-115 (technical security testing)
- ISO/IEC 27001 (information security management)
- ISO/IEC 15408 (Common Criteria)
- IEC 62443-4-1 (secure development lifecycle)
- PCI DSS 4.0
6 modules · 300 h
1.1Secure development lifecycle (SSDLC)1.2Threat modelling with STRIDE1.3Software security requirements1.4OWASP Top 10 and CWE Top 251.5Vulnerability taxonomy1.6CVSS scoring1.7Vulnerability management and CVE1.8Shift left1.9Software security metrics1.10Workshop: threat model of a web application
2.1ISO/IEC 27001 and control 8.292.2ISO/IEC 27034 application security2.3OWASP ASVS levels 1 to 32.4NIST SP 800-218 SSDF2.5NIST SP 800-115 technical testing2.6IEC 62443-4-1 and 4-22.7Common Criteria ISO/IEC 154082.8ISO/IEC 18045 evaluation methodology2.9EUCC European certification scheme2.10Practice: ASVS checklist for an API
3.1Static analysis (SAST)3.2Dynamic analysis (DAST)3.3Interactive testing (IAST)3.4Software composition analysis (SCA) and SBOM3.5Fuzzing with AFL and libFuzzer3.6Manual secure code review3.7Penetration testing3.8OSSTMM and PTES methodologies3.9OWASP WSTG testing guide3.10Laboratory: SAST and DAST analysis of an application
4.1Avionics software and DO-326A4.2Automotive and ISO/SAE 214344.3Medical devices and IEC 81001-5-14.4Payments and PCI DSS4.5Public sector and ENS4.6EU Cyber Resilience Act4.7ENISA certification schemes4.8CCN's LINCE certification4.9Defence and accreditation requirements4.10Case study: test evidence for the CRA
5.1CI/CD integration5.2DevSecOps and security as code5.3False positive management5.4Prioritisation of findings5.5Security testing reports5.6Bug bounty programmes5.7Coordinated vulnerability disclosure5.8Security regression testing5.9OWASP SAMM maturity indicators5.10Practice: DevSecOps pipeline with open-source tools
6.1Software product description6.2Applicable regulatory framework6.3Threat model6.4Test strategy6.5Tool selection6.6Execution and findings6.7Remediation plan6.8Compliance report6.9Dissertation and presentation6.10Final review with the tutor
How you'll learn
100 % online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetable: students progress at their own pace within the enrolment period, which makes it possible to combine with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Burp Suite, OWASP ZAP, SonarQube, Semgrep, Jenkins, in free, academic or evaluation versions. Tests are studied using real laboratory procedures on deliberately vulnerable applications, integration of static analysis into CI/CD, and preparation of security testing reports. Assessment is continuous per module plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Integrate security into every phase of the development lifecycle.
Interpret standards and reference frameworks in security testing.
Apply static, dynamic and dependency analysis techniques.
Adapt testing to the requirements of regulated sectors.
Automate security tests within a continuous integration chain.
Where this takes you
Requirements
- No prior degree required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient level of Spanish to follow technical standards texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme is 300 h in total, spread over 3 to 5 months. That is an average of 10 to 15 hours per week, compatible with full-time work.
You work with Burp Suite, OWASP ZAP, SonarQube, Semgrep, Jenkins. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the integrative project. It is in-house training, not an official Ministry degree.
Yes. Modules passed in a course or postgraduate diploma in the same area are credited towards the advanced programme. Check the credit transfer policy when you enrol.
Related programmes
Course in Ethics in Academic Surveillance with ISR Systems
Online 300-hour course in ethics in academic surveillance with ISR systems. 6 modules covering the European Code of Conduct for Research Integrity (ALLEA, 2023), Regulation (EU)…
Course in Academic Regulation in OT Cybersecurity
Online 300-hour course in academic regulation in OT cybersecurity. 6 modules covering IEC 62443 (security of industrial automation and control systems), Directive (EU) 2022/2555 (NIS2) and…
Innovation in Active Protection and Regulatory Framework Course
Online 300-hour course in innovation in active protection and regulatory framework. 6 modules covering Additional Protocol I, Article 36 (legal review of new weapons), MIL-STD-882E (system…
More in Defense, Military Engineering & Land Systems
All Defense, Military Engineering & Land Systems programmes → · How to apply · Fees & financing · Scholarships