Skip to lesson
Exit
The Role & Your Charter1 / 2

1 min lesson

Where to spend prep time

Name the key items in "Where to spend prep time", then explain why each one matters.

Step 1 of 2

Where to spend prep timemap your gap to the track

  • Weak on AppSec depth: drill OWASP-class vulns, authn/authz and supply-chain security until you can find-and-fix on sight.
  • Weak on cloud/infra: drill IAM/least-privilege, JIT access design and container/K8s hardening until you can design an access flow cold.
  • Weak on building: write one small security tool end-to-end (a scanner or a safe wrapper) so you have a real artifact and adoption story.
  • Weak on agent security: study prompt injection, sandboxing and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. abuse. It's the differentiator and the surface you're least likely to have lived at work.
Watch out

Truth-seeking is an explicit Cursor value, so bluffing a gap is doubly costly: you risk being caught and you undercut the values answer even if you aren't. "I've lived AppSec; my cloud depth is real but narrower on K8s hardening and here's how I'd reason about it" beats a confident wrong answer every time.

Say it like this

My depth is strongest in application security. I've shipped find-and-fix work on authz and injection classes and built the tooling that retired them. My cloud/infra side is real but I'd be honest that my Kubernetes hardening is more recent, so I'd reason from least-privilege and isolation first principles there rather than overclaim. The agent-security surface is where I'm genuinely excited to go deep, because almost no one has lived it yet.