The common foundation the rest of the degree stands on. Learners cover enterprise network foundations — TCP/IP, routing, switching, DNS, DHCP, NAT, firewalls, VLANs, VPNs, load balancing — and the cloud constructs that mirror them: VPC and VNet, subnets, security groups and network security groups. Operating system security follows across Windows and Linux: users, groups, permissions, services, patching, hardening baselines, host firewalls, endpoint telemetry and audit logs. Then identity, which is where cloud security actually lives — authentication, authorization, federation, SSO, RBAC, ABAC, privileged access, MFA, conditional access, service identities and key management. It closes on Zero Trust proper: verify explicitly, least privilege, assume breach, micro-segmentation, device trust, continuous monitoring and policy-driven enforcement — then packet capture, log review and a validated secure baseline.

Frameworks: NIST SP 800-207 (Zero Trust Architecture), CIS Benchmarks, Microsoft Zero Trust guidance

Tools / Platforms: Wireshark, Microsoft Entra ID, Azure and AWS networking and identity services, CIS Benchmarks, Windows and Linux hardening toolchain

Portfolio artefact: A secure infrastructure baseline integrating network, OS and identity controls — built, validated and presented.

Application security from design through testing to remediation. Learners cover application security foundations — web architecture, HTTP/HTTPS, cookies, sessions, authentication, authorization, API flows, client-server trust boundaries and secure design principles. Then the vulnerability classes that actually appear in cloud workloads: the OWASP Top 10, injection, cross-site scripting, broken access control, SSRF, insecure deserialization, misconfiguration and vulnerable components. Secure coding and configuration follows — input validation, output encoding, password storage, secrets handling, secure headers, CORS, error handling and dependency management. Then structured testing: threat modeling, manual testing, DAST, SAST, API testing, proxy-based testing and safe exploitation in controlled environments. It ends on the part that gets things fixed — severity rating, exploitability, business impact, developer-friendly remediation, retesting and executive communication.

Frameworks: OWASP Top 10, OWASP Web Security Testing Guide, OWASP ASVS, CERT secure coding guidelines

Tools / Platforms: OWASP Juice Shop, intercepting proxy (Burp Suite / ZAP), SAST and DAST tooling, API testing clients

Portfolio artefact: An application security report with evidence, severity ratings and remediation guidance.

Certification-aligned, and deliberately consolidated — this module absorbs the virtualization and cloud computing foundations that were previously a separate course, removing the duplication. Learners cover cloud computing concepts including business drivers, scalability, elasticity, high availability, fault tolerance, capex versus opex, deployment models and shared responsibility; then virtualization and service models across hypervisors, VM lifecycle, snapshots, images, containers, IaaS, PaaS, SaaS, serverless and managed services. Core Azure architecture follows: regions, availability zones, subscriptions, management groups, resource groups, compute, storage, networking, databases and identity. Then security, privacy, compliance and trust — Defender for Cloud, governance, policies, blueprints, resource locks. It closes on the commercial literacy an architect is expected to have: pricing, TCO, SLAs, service lifecycle and support plans.

Aligned Certification: Microsoft AZ-900 — Azure Fundamentals

Frameworks: Azure Well-Architected Framework, Microsoft Cloud Adoption Framework

Tools / Platforms: Microsoft Azure, Azure Pricing Calculator, TCO Calculator, Azure Architecture Center

Portfolio artefact: A deployed Azure environment with resource groups, storage, networking, tags, locks and policy controls — plus AZ-900 mock assessment.

Azure administrator capability, built through scenario-based labs. Learners cover identity and governance administration — Microsoft Entra ID, users, groups, RBAC, subscriptions, management groups, Azure Policy, tags, locks and resource organisation; then storage administration across storage accounts, blob containers, file shares, access tiers, redundancy, lifecycle rules, SAS, access keys and secure transfer. Compute administration follows: virtual machines, VM scale sets, availability sets, containers, App Service, automation and image management. Then virtual networking — VNets, subnets, NSGs, route tables, DNS, peering, VPN gateways, load balancers, application gateways and troubleshooting. It closes on monitoring, backup and operational management: Azure Monitor, Log Analytics, alerts, recovery services, update management and AZ-104 exam readiness.

Aligned Certification: Microsoft AZ-104 — Azure Administrator Associate

Tools / Platforms: Azure Portal, Azure CLI, Azure Monitor, Log Analytics, Visual Studio Code

Portfolio artefact: A provisioned and administered Azure estate — RBAC, policy, secure storage, VNet peering, NSGs, load balancing, monitoring, backup and restore.

Security operations on the Microsoft stack, taught as SOC work rather than product tourism. Learners cover security operations foundations — SOC models, analyst roles, telemetry sources, alert lifecycle, incident triage, escalation, evidence handling and operational metrics. Then Microsoft Defender XDR operations across endpoint, identity, cloud apps and email, covering incidents, advanced hunting, exposure management and response actions. Microsoft Sentinel configuration follows: workspaces, data connectors, analytics rules, watchlists, workbooks, incidents, entity mapping and content hub solutions. Then KQL, hunting and threat intelligence — query structure, filtering, joins, aggregations, hunting hypotheses, threat indicators and investigation notebooks. It closes on incident response and automation: playbooks, Logic Apps, case management, containment, reporting and lessons learned.

Aligned Certification: Microsoft SC-200 — Security Operations Analyst

Frameworks: MITRE ATT&CK

Tools / Platforms: Microsoft Sentinel, Microsoft Defender XDR, KQL, Logic Apps

Portfolio artefact: A Sentinel workbook, analytics rules, KQL hunting queries, an automated response playbook and a full incident report.

The differentiator, and a straight swap of a declining technology for the one every cloud team is now scrambling to secure. Learners cover AI security foundations — the AI/ML lifecycle, LLM applications, agentic workflows, model endpoints, data pipelines, threat surfaces and where security responsibility actually sits across teams. Then LLM and agentic AI risks: prompt injection, data exfiltration, insecure tool use, excessive agency, model denial of service and output manipulation. Cloud-native security posture follows — CNAPP, CSPM, CWPP, CIEM, workload identity, runtime protection, image scanning, IaC risk and cloud entitlement management. Then securing AI workloads: identity controls, secrets, network isolation, logging, data classification, guardrails, evaluation, monitoring and secure deployment patterns. It closes on AI-enabled security operations — AI-assisted triage, detection engineering, Security Copilot-style workflows, and, honestly, their limitations, human oversight and auditability.

Frameworks: OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI Risk Management Framework, CSA AI and cloud security guidance

Tools / Platforms: CSPM / CNAPP tooling, Microsoft Security Copilot, Microsoft Defender for Cloud, threat modeling toolchain

Portfolio artefact: A threat model for an LLM-enabled cloud application, a simulated CSPM/CNAPP posture review, and an AI security governance checklist with an improvement plan.

Operational capability on AWS, with cost and reliability treated as first-class concerns. Learners cover AWS operational foundations — account structure, regions, availability zones, IAM, shared responsibility and the management interfaces; then monitoring and observability across CloudWatch metrics, logs, alarms and dashboards, plus CloudTrail, EventBridge and AWS Config. Compute, storage and database operations follow: EC2, Auto Scaling, ELB, EBS, EFS, S3, RDS, snapshots, patching and operational health. Then networking, security and access operations — VPC, subnets, route tables, security groups, NACLs, IAM policies, KMS, secrets and troubleshooting. It closes on reliability, automation and cost operations: backup, high availability, disaster recovery, Systems Manager, CloudFormation and cost monitoring.

Aligned Certification: AWS CloudOps Administrator Associate — the credential that replaced SysOps Administrator Associate (see the currency note in Section 4.3)

Frameworks: AWS Well-Architected Framework

Tools / Platforms: AWS CloudWatch, CloudTrail, Systems Manager, Config, EC2, S3, VPC, CloudFormation

Portfolio artefact: An operational runbook covering backup, monitoring and incident handling, on a deployed and auto-scaled AWS workload.

Designing AWS architectures that are secure, resilient, high-performing, cost-optimised and operable. Learners cover architecture foundations — AWS global infrastructure, the Well-Architected Framework, shared responsibility, account design, landing zones and architecture documentation; then secure architecture design across IAM, Organizations, Control Tower concepts, VPC design, security groups, NACLs, KMS, secrets and centralised logging. Compute, storage and database architecture follows: EC2, Lambda, ECS and EKS concepts, S3, EFS, EBS, RDS, DynamoDB — and the trade-offs between them, which is the actual skill. Then resilient and high-performing architecture: multi-AZ design, load balancing, auto scaling, caching, asynchronous integration, disaster recovery and performance testing. It closes on cost optimisation, migration and hybrid design.

Aligned Certification: AWS Certified Solutions Architect — Associate

Frameworks: AWS Well-Architected Framework, AWS Prescriptive Guidance

Tools / Platforms: AWS architecture toolchain, EC2, Lambda, S3, RDS, DynamoDB, VPC, KMS

Portfolio artefact: An AWS architecture decision record with explicit trade-offs, plus a deployed highly available workload and a DR pattern.

Containers and Kubernetes taught as a security problem, because that is how they arrive. Learners cover container fundamentals — images, registries, Dockerfiles, layers, runtime isolation, volumes, networking and secure image build practices; then Kubernetes architecture across control plane components, nodes, pods, deployments, services, ingress, config maps, secrets and cluster workflows. Access and workload security follows: namespaces, RBAC, service accounts, secrets, pod security, admission controllers and policy enforcement. Then network, runtime and supply-chain security — network policies, image scanning, SBOMs, signed images, runtime monitoring, vulnerability management and logging. It closes on platform engineering and managed Kubernetes: AKS, EKS and GKE concepts, GitOps, observability, cluster hardening, backup and upgrade planning.

Frameworks: CIS Kubernetes Benchmark, NSA/CISA Kubernetes Hardening Guidance, CNCF cloud-native security guidance

Tools / Platforms: Docker, Kubernetes, image scanners, admission controllers, network policies, Aqua / Sysdig-class runtime tooling

Portfolio artefact: A documented secure Kubernetes baseline for a managed cluster — RBAC, secrets, network policies, pod security, scanned images.

Secure software delivery and cloud infrastructure automation. Learners cover secure SDLC and DevSecOps foundations — threat modeling, security requirements, secure design, coding standards, peer review, security gates and continuous feedback; then CI/CD pipeline security across source control, branching, build integrity, secrets detection, artifact management, approval workflows and release governance. Application and dependency security automation follows: SAST, DAST, SCA, license risk, container scanning, vulnerability management and remediation tracking. Then Infrastructure-as-Code security — Terraform, ARM and CloudFormation concepts, policy-as-code, misconfiguration detection, environment promotion and secure cloud templates. It closes on operational DevSecOps: observability, runtime feedback, incident learning, metrics, dashboards and compliance evidence.

Frameworks: NIST Secure Software Development Framework (SP 800-218), OWASP SAMM, OWASP DevSecOps guidance, SLSA

Tools / Platforms: GitHub Actions / Azure DevOps / GitLab CI, Terraform, SAST and SCA scanners, secrets detection, IaC scanning, policy-as-code

Portfolio artefact: A working secure deployment pipeline with scanning stages, IaC misconfiguration detection, secrets remediation and an evidence report.

The module that gets a cloud architect into the audit committee. Learners cover cloud governance foundations — policy hierarchy, roles and responsibilities, shared responsibility, cloud operating model, control ownership and governance metrics; then risk management in cloud: asset identification, threat scenarios, likelihood, impact, inherent and residual risk, treatment plans and risk registers. Compliance frameworks and control mapping follows — ISO 27001, NIST CSF, CIS Controls, CSA Cloud Controls Matrix, SOC reporting, regulatory obligations and evidence requirements. Then privacy and data governance: data classification, retention, cross-border data transfer, consent, data processing roles, privacy-by-design and cloud data protection controls. It closes on audit readiness — control testing, evidence collection, dashboards, exception management, remediation tracking and executive reporting.

Frameworks: CSA Cloud Controls Matrix, ISO/IEC 27001 and 27017, NIST CSF, NIST SP 800-53, CIS Controls, India DPDP Act

Tools / Platforms: Control-mapping workbooks, cloud risk register templates, GRC dashboard tooling, policy and evidence review

Portfolio artefact: An executive GRC report for a cloud environment — control mapping to CIS or CSA CCM, a migration risk register and a privacy and data classification checklist.

The module that maps to the work most enterprises are actually doing right now. Learners cover hybrid cloud fundamentals — operating models, workload placement, public-private integration, connectivity options, governance boundaries and the business drivers behind migration; then workload discovery and migration assessment: dependencies, readiness, performance baselines, risk, application rationalisation and 6R/7R migration strategies. Hybrid networking and identity follows — VPN, direct connectivity, DNS, routing, firewalling, identity federation, directory synchronisation and access governance. Then migration planning and execution: migration waves, landing zones, data migration, testing, cutover, rollback, automation and stakeholder communication. It closes on resilience and continuity — backup, high availability, disaster recovery, RTO and RPO, failover testing, monitoring and post-migration optimisation.

Frameworks: Microsoft Cloud Adoption Framework, AWS Migration Acceleration Program and Prescriptive Guidance, NIST contingency planning guidance

Tools / Platforms: Azure Arc, AWS and Azure migration tooling, hybrid connectivity, assessment matrices, DR design toolchain

Portfolio artefact: A hybrid migration and resilience blueprint — application assessment matrix, wave plan, cutover checklist and DR architecture for a critical workload.

Twelve credits, 360 hours, one real cloud architecture, cloud security, DevSecOps or cloud operations problem. Learners work through problem identification and scoping — industry problem selection, stakeholder analysis, objectives, success criteria, deliverables, project plan and risk register; then review and design: literature review, architecture review, tool comparison, standards alignment, solution design and methodology. Implementation or assessment follows — cloud deployment, automation, security testing, monitoring setup, GRC assessment, migration prototype or operational runbook development. Then validation and improvement: test cases, architecture validation, performance and security checks, cost analysis, risk analysis and mentor review iterations. It closes on reporting and viva — final report, evidence, diagrams, executive summary, demonstration and defence before academic and industry mentors.

Tools / Platforms: The full stack, selected by project — AWS, Azure, Kubernetes, Terraform, CI/CD, SIEM and GRC tooling as required

Portfolio artefact: A working prototype, assessment or automation workflow, validated with logs, metrics, tests or control checks — plus report and viva.

Converts applied cloud and security work into a research publication, applied implementation paper, patentable artefact or structured technical report. Learners cover research problem formulation — topic selection, motivation, scope, contribution, publication venue selection and research ethics; then literature review and gap analysis: search strategy, paper reading, synthesis matrix, related work, citation management and plagiarism avoidance. Methodology and experiment design follows — experiment architecture, tools, datasets, metrics, case-study design, validation criteria and limitations. Then results, analysis and discussion: comparison, visualisation, interpretation, threats to validity and practical implications. It closes on manuscript preparation and defence, including review response and final viva.

Tools / Platforms: IEEE / ACM / Springer templates, Zotero / Mendeley / EndNote, research databases — IEEE Xplore, ACM Digital Library, SpringerLink

Portfolio artefact: A submitted manuscript, defended in a mock conference or viva format.