Category
セキュリティエンジニアになるには — 公式フレームワークで描くスキルマップ・資格・セキュアコーディングの実践ガイド
セキュリティエンジニアは『攻める側（ホワイトハッカー）』とは出発点が違い、主戦場は“安全なシステムを作って・運用して・守る”ことにあります。本クラスタは、個人の体験談ではなく公的な一次情報——NISTのNICE Framework（職種の7カテゴリ）とCSF 2.0（守りの6機能）、IPAのITSS+とデジタルスキル標準、経済産業省のサイバーセキュリティ経営ガイドライン——を地図に、目指す職種の定め方、未経験から積むスキルマップ、国家資格『登録セキスペ』を含む資格戦略、そして中核技能であるセキュアコーディング（NIST SSDF・OWASP ASVSに沿った信頼境界の検証・認可のサーバー強制・出力エンコード・秘密情報管理・CIへの自動強制）までを体系化します。一人×生成AIで経済産業大臣賞のB2B SaaSや本番二重課金0件の決済基盤を作ってきた知見を根拠に、『速く作る力と安全に作る力は同じコインの裏表』という立場で、学ぶ個人にも、人材を育てるか外部委託かを迷う企業にも役立つ判断材料を、公式ドキュメントに忠実な実コードで提供します。
6 articles in total
Foundational guide
Foundational guide (start here)
How to become a security engineer [2026 complete roadmap]: a skill map, certifications, and the fastest route from no experience, drawn with official frameworks
A complete roadmap to becoming a security engineer. With primary sources — the NIST NICE Framework, CSF 2.0, IPA ITSS+, and METI guidelines — as the map, it systematically explains, with real code: the big picture of the role, a skill map to build from no experience, a certification strategy including Japan's national 'Registered Security Specialist,' and differentiation in the AI era.
Related practical articles
- セキュリティインシデント対応CSIRTNISTセキュリティエンジニア
Incident-response practical guide [2026 edition]: CSIRT, Runbooks, and automated containment aligned with NIST SP 800-61 Rev.3 (CSF 2.0)
A practical guide to designing security incident response (IR) at production quality. Centered on the new framework of NIST SP 800-61 Rev.3 (the CSF 2.0 Community Profile) revamped in 2025, it explains the CSIRT structure, severity triage, idempotent containment Runbooks, blameless postmortems, and SOAR automation, with real code faithful to official information.
9 min read - セキュリティ暗号パスワードハッシュArgon2セキュリティエンジニア
A practical applied-cryptography guide [2026 edition]: using password hashing (Argon2id), encryption (AES-GCM), and key management correctly
A practical guide for app developers to 'use cryptography correctly.' Faithful to official sources, it explains, in type-safe code: the difference between hashing, encryption, and encoding; Argon2id password hashing with OWASP-recommended parameters; the latest NIST 800-63B-4 password policy; authenticated encryption with AES-256-GCM; and key management and rotation.
9 min read - セキュリティセキュアコーディングNIST SSDFOWASP ASVSDevSecOps
Practical secure-coding guide [2026 edition]: become an engineer who 'builds safely' with NIST SSDF and OWASP ASVS
A complete guide to practicing secure coding by 'mechanism,' not 'willpower.' With NIST's official framework SSDF (SP 800-218) and OWASP ASVS 5.0 as a map, it explains validation at the trust boundary, server-enforced authorization, output encoding, secret management, and dependency measures with real code, and finally shows how to auto-enforce these in CI.
13 min read - セキュリティログ設計検知エンジニアリングSigmaセキュリティエンジニア
A practical guide to security logging and detection engineering [2026 edition]: building a state where you 'can notice' with Sigma, MITRE ATT&CK, and SIEM
A practical guide to log design and detection engineering that solves 'you can't protect what you can't detect.' With real code: 'what to record and what not to,' per OWASP; type-safe structured logs and secret masking; vendor-neutral detection rules with Sigma; mapping to MITRE ATT&CK; and Detection as Code.
9 min read - セキュリティ脅威モデリングSTRIDEセキュア設計セキュリティエンジニア
A practical threat-modeling guide [2026 edition]: crushing vulnerabilities at the 'design stage' with STRIDE and data flow diagrams
A practical guide to threat modeling for building security into the design stage. It explains, with real code faithful to official information: the Threat Modeling Manifesto's four questions, STRIDE's six categories, how to draw a data flow diagram and trust boundaries, and how to manage threats 'as code' and continuously verify them in CI.
10 min read