Test mode · all checkouts use sandbox cards (4242 4242 4242 4242)
PrimeSec Academy
The build list

Thirty-six projects. One defended capstone.

Every project ships to a real environment, gets a written review by a senior engineer, and goes on your portfolio. Here is the full list and what each one proves to a hiring manager.

36
Projects
12
Categories
01
Capstone
  • 01

    Cloud account baseline across AWS, Azure, and GCP

    Stand up a hardened multi-cloud baseline from zero.

    Foundations
  • 02

    Network segmentation lab with VPCs and peering

    Design and defend cloud network boundaries.

    Network
  • 03

    TLS everywhere with private CA

    Roll out and rotate certs without breaking workloads.

    Crypto
  • 04

    Least-privilege IAM rewrite for a sample app

    Replace wildcard policies with safe scoped roles.

    IAM
  • 05

    Federated identity with SSO and SCIM

    Plug an IdP into a cloud tenant the right way.

    IAM
  • 06

    Conditional access policy pack for Entra ID

    Ship risk-based access controls in production.

    Azure
  • 07

    AWS landing zone with Control Tower guardrails

    Stand up a compliant multi-account org.

    AWS
  • 08

    GuardDuty and Security Hub detection pipeline

    Wire AWS findings into a real workflow.

    AWS
  • 09

    S3 hardening and public access audit

    Prevent the most common cloud data leak.

    AWS
  • 10

    KMS key lifecycle and envelope encryption

    Design and rotate keys without breaking apps.

    Crypto
  • 11

    Azure Defender for Cloud rollout

    Deploy Defender across a multi-subscription tenant.

    Azure
  • 12

    Sentinel SIEM with cloud control plane detections

    Write and tune real cloud detections.

    SecOps
  • 13

    GCP Security Command Center and Org Policy

    Lock down a GCP org with guardrails.

    GCP
  • 14

    VPC Service Controls perimeter for sensitive data

    Stop data exfiltration at the network edge.

    GCP
  • 15

    Chronicle SIEM detection pack

    Ship Chronicle detections that catch real attacks.

    SecOps
  • 16

    Cloud log pipeline to a central data lake

    Move logs cheaply and queryably at scale.

    SecOps
  • 17

    MITRE ATT&CK cloud detection coverage map

    Measure and close detection gaps.

    SecOps
  • 18

    Public S3 leak incident response runbook

    Lead a real cloud incident end to end.

    IR
  • 19

    Forensic snapshot and triage for a compromised VM

    Pull evidence from cloud without losing chain of custody.

    IR
  • 20

    Post-incident review and corrective action plan

    Turn an incident into durable improvements.

    IR
  • 21

    Org policy pack with tagging and guardrails

    Govern a cloud org at scale.

    Governance
  • 22

    SOC 2 control mapping for a cloud workload

    Pass an audit without slowing the team down.

    Compliance
  • 23

    HIPAA architecture for a healthcare API

    Ship regulated workloads in cloud.

    Compliance
  • 24

    PCI DSS scoped network for a payments service

    Shrink PCI scope to almost nothing.

    Compliance
  • 25

    LLM threat model for a customer chatbot

    Apply OWASP LLM Top 10 to a real product.

    AI
  • 26

    Prompt injection defense pack with guardrails

    Stop prompt injection and data exfil.

    AI
  • 27

    Bedrock access boundary and audit

    Secure access to AWS foundation models.

    AI
  • 28

    Azure AI Foundry deployment with private endpoints

    Lock down an Azure AI workload.

    AI
  • 29

    Vertex AI access controls and audit logging

    Secure a GCP AI workload end to end.

    AI
  • 30

    Model governance and red team playbook

    Run AI red team and governance reviews.

    AI
  • 31

    Policy as code with OPA and Conftest

    Enforce security in the build pipeline.

    Platform
  • 32

    Container image signing and admission control

    Stop unsigned images from running in production.

    Platform
  • 33

    Secrets sprawl audit and remediation

    Find and rotate leaked secrets across an org.

    Platform
  • 34

    Zero-trust reference architecture for a SaaS

    Design a zero-trust environment top to bottom.

    Architecture
  • 35

    Multi-cloud reference architecture with shared identity

    Design durable multi-cloud security.

    Architecture
  • 36

    Disaster recovery and ransomware containment plan

    Recover a cloud business after a destructive attack.

    Resilience
Capstone · Weeks 17 – 18

Defend a real workload in front of senior engineers.

In the final phase you design, deploy, and defend a production-grade secure cloud and AI workload. Pass it and you graduate with a project you can walk through in every interview for the rest of your career.

Enroll now