Esc
↑↓ navigate   Enter open   Esc close
🔒 Security Engineer

14-Day English Crash Course for Security Engineers
Intensive Sprint

A focused 2-week programme covering the 14 highest-priority vocabulary and communication areas for security engineers in English-speaking teams. From threat modeling and CVE/CVSS advisory language to incident response communication, penetration test report writing, SOC operations, and responsible disclosure — each day is practical and directly linked to exercises. Build the English you need to communicate security risk precisely to engineers, executives, and regulators.

Intensive 14 days · 42 exercises covered · 20–30 min/day · Full 30-day path →
Start Day 1 →

14-day overview

1 2 3 4 5 6 7 8 9 10 11 12 13 14

Week 1: Cybersecurity Foundations, Threat Modeling & Incident Response

1

Core Cybersecurity Vocabulary

Vocabulary Exercise
2

Threat Modeling Vocabulary (STRIDE)

Vocabulary Exercise
3

CVE & CVSS Advisory Language

Vocabulary Exercise
4

Zero Trust Architecture Vocabulary

Vocabulary Exercise
5

Incident Declaration & Severity Language

Vocabulary Exercise
6

Incident Timeline & Postmortem Writing

Vocabulary Exercise
7

Penetration Test Report Writing

Vocabulary Exercise

Week 2: Pentest Reporting, SOC Operations, Disclosure & Career

8

Describing Attack Chains & Remediation

Vocabulary Exercise
9

SOC Alert Triage & MITRE ATT&CK Language

Vocabulary Exercise
10

Responsible Disclosure & Advisory Writing

Vocabulary Exercise
11

Compliance & Security Standards Language

Vocabulary Exercise
12

Briefing Non-Technical Stakeholders

Vocabulary Exercise
13

Security Engineer Technical Interview English

Vocabulary Exercise
14

Salary Negotiation & Offer Phrases

Vocabulary Exercise

Key phrases to learn this fortnight

attack surface
"Removing the debug endpoint from production reduces the attack surface significantly."
CVSS Base Score
"The CVSS Base Score of 9.8 reflects network exploitability and no authentication required."
lateral movement
"After the initial foothold, the attacker used lateral movement via Pass-the-Hash."
responsible disclosure
"I followed responsible disclosure and notified the vendor 90 days before publishing the advisory."
trust boundary
"There's a trust boundary between the public API and the internal service mesh — we should threat model the crossing."
proof of concept (PoC)
"The PoC code demonstrates that the SSRF can reach the internal metadata endpoint."
blameless postmortem
"We will run a blameless postmortem on Thursday — the goal is process gaps, not blame."
indicator of compromise (IOC)
"The threat intel feed provided three IOCs: two malicious IPs and a file hash."
zero-day
"This is a zero-day — there is no patch available yet. We are engaging the vendor under embargo."
defence in depth
"Even if the WAF is bypassed, defence in depth means the parameterised queries prevent injection."
Security Engineer — 30 Days
Complete programme adding cryptography, IAM, DevSecOps, and executive briefing vocabulary
DevOps & SRE — 14 Days
2-week sprint useful for security engineers who work closely with infrastructure and platform teams
Backend Developer — 14 Days
2-week sprint useful for security engineers who review application code and API design

Frequently asked questions

Who is this 14-day Security Engineer English crash course for?

This crash course is for security engineers, penetration testers, and SOC analysts who need focused, fast improvement in technical English — before a new role, a technical interview, or when joining an international security team. It covers the 14 highest-priority vocabulary and communication areas: from threat modeling and CVE advisory writing to incident response, pentest reporting, and interview preparation.

What level of English do I need to start?

The course is designed for B1–B2 English learners (intermediate). You should be able to hold basic conversations in English. The course improves your professional and technical security English, not general English from scratch.

How long does each day take?

Each day is designed for 20–30 minutes: roughly 10 minutes on vocabulary and 15 minutes on the exercise. The intensive format keeps sessions focused — every day is tied directly to vocabulary and scenarios from real security engineering work.

Does this course cover CVE and CVSS scoring language?

Yes. Day 3 focuses specifically on CVE and CVSS advisory language — reading and writing structured vulnerability descriptions, and justifying CVSS scores with the precise vocabulary used in security advisories.

Is threat modeling vocabulary included?

Yes. Day 2 covers STRIDE threat modeling vocabulary — spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege — and the language used to describe trust boundaries in threat modeling sessions.

Does the course cover incident response communication?

Yes. Days 5 and 6 cover incident declaration and severity classification (SEV-1 through SEV-4), and writing precise incident timelines and blameless postmortems.

Is penetration test report writing covered?

Yes. Days 7 and 8 cover the full structure of a professional pentest report — executive summaries, findings, describing attack chains, and writing actionable remediation guidance.

How is this different from the 30-day Security Engineer path?

The 14-day crash course covers the 14 highest-priority areas in a condensed format. The 30-day path goes deeper — adding cryptography and PKI vocabulary, identity and access management language, DevSecOps pipeline communication, and a full week of security leadership and executive briefing communication.

Is there interview preparation in this course?

Yes. Days 13 and 14 cover security engineer technical interview speaking and salary negotiation phrases. See /exercises/interview/security-questions/ for the full exercise set.

What should I do after completing this 14-day crash course?

After the crash course, move to the 30-day Security Engineer path for deeper coverage of cryptography, IAM, DevSecOps, and executive briefing communication. You can also read the full Security Engineer guide or browse all exercises.

Ready to start?

Begin with Day 1 and spend 20 minutes today.

Start Day 1 → Full 30-day path All learning paths