The setting

Meridian Ledger runs a payments API that thousands of small merchants use to take card payments. You are the DevSecOps engineer keeping the delivery pipeline, secrets, and cloud accounts safe as the team ships weekly.

Every mission on this path happens at the same company, so context carries over the way it does in a real job: the data you cleaned in mission two is the data the finance lead questions in mission four.

The missions

1. threat modelstarter

Threat model Meridian Ledger's new refunds API

Meridian Ledger is about to ship a refunds API so merchants can refund charges through code instead of the dashboard. Money moves, so security review is required before it merges.

You deliver: A threat model of the refunds API listing threats by category, severity, and a specific mitigation for each high item.

Scored on: Catches the authorization gap, Catches PII logging and open internal endpoint, Catches the over-refund risk, Specific mitigations.

Working from: refunds_api_design.md.

2. secret handlingstarter

Clean up the leaked secrets in the merchant-sync pipeline

A new engineer noticed AWS keys sitting in the merchant-sync build config. Meridian handles card data, so credentials in a repo are a real breach risk, not a style nit.

You deliver: A secret handling remediation plan naming every leaked secret, its risk, the fix, and what must be rotated.

Scored on: Finds all hardcoded secrets, Finds the log leaks, Calls for rotation, Ordered, workable fix.

Working from: build.ci.yml.

3. dependency riskcore

Assess the dependency audit before the release freeze

Meridian freezes releases Friday. The weekly dependency audit for the payments-api service came back with a mix of findings, and the release manager wants a call on what blocks the freeze.

You deliver: A dependency risk assessment that ranks the findings, marks release blockers, and gives an action for each top item.

Scored on: Prioritizes the critical, Catches the license conflict, Handles the unmaintained package, Blockers named clearly.

Working from: dependency_audit.md.

4. policy checkcore

Check the payments-api deploy pipeline against Meridian's security policy

Meridian's security policy for production deploys was signed off last quarter, but the payments-api pipeline was written before that. Compliance wants to know where the pipeline breaks the rules.

You deliver: A policy compliance review mapping each rule to pass or fail with evidence, and a prioritized list of fixes.

Scored on: Every rule checked, Evidence from the config, Correct verdicts, Prioritized fixes.

Working from: security_policy.md, deploy_pipeline.yml.

5. audit notestretch

Write the SOC 2 note on Meridian's Q3 change and access controls

Meridian's SOC 2 auditors arrive in two weeks. Your job is the internal readiness note on two control areas: production change management and service account access. If something is out of control, the auditors will find it, so you should first.

You deliver: An audit readiness note covering change control and service account access, with every exception and a recommended fix.

Scored on: Finds the change exception, Finds the over-privileged accounts, Severity judged, Actionable before the audit.

Working from: change_log.csv, service_accounts.csv.

How the scoring works

Each deliverable is graded against the rubric written for that mission. Separately, every mission on every path is graded on how you used AI, against the same four criteria:

  • Understood the task. The learner framed the goal for the assistant clearly instead of pasting the brief and hoping.
  • Grounded in the material. The learner directed the assistant into the provided files and based the work on them, not on invented facts.
  • Verified the output. The learner checked claims, numbers, or coverage against the source material before submitting.
  • Iterated with judgment. The learner refined weak parts of the draft with specific follow-ups rather than accepting the first answer.

Both scores, with the work behind them, go on your proof profile. That is what makes a claim like "I can use AI for devsecops" something an employer can check.