ISTQB Certified Tester Security Test Engineer

 This three-day course is designed for professionals involved in testing IT-based systems for security. It focuses on the execution of security testing activities, helping you understand the appropriate tools to use and how to report findings within different development contexts. You’ll also learn how to feed results into wider risk management processes, including an information security management system. This makes it particularly relevant if you want to build capability in security test execution and contribute more effectively to secure software delivery. 

This course covers approaches for assessing software risk, analysing vulnerabilities, applying relevant standards and reporting findings. You’ll examine how this work fits into development and operational environments to support more effective risk management and software quality. Also, learn how to apply appropriate security test techniques, understand their strengths and limitations, and contribute to the execution of security tests. 

 Security testing foundations

Learn the terminology and objectives that underpin effective security testing. The course explores core paradigms, levels of assurance, audit considerations and the concept of zero trust, helping you understand how targeted testing supports software quality and organisational risk reduction. 

 Security test techniques

Develop knowledge of specialist techniques used to assess how well software withstands threats and misuse. You’ll examine how to design targeted checks, apply appropriate test types in context and evaluate different approaches, helping you identify vulnerabilities and weaknesses within software systems.

Security processes and reporting

Understand how the security testing process moves from planning through to execution and reporting. The course examines how vulnerabilities are analysed and findings are communicated, as well as how these insights can support continuous improvement across development and operational environments. 

Standards and organisational context

See how standards, regulations and organisational structures shape assessment activity. You’ll examine how this work fits with software development lifecycle models, operational environments and information security management systems, helping you apply the right approach within the context you are working in. 

The CT-STE syllabus covers the following topics, as defined by the official ISTQB curriculum. 

• Security paradigms
• Asset security levels
• Security audits
• Zero trust concepts
• Open-source software

• Security test techniques
• Security test types
• Applying security testing
• Security test design

• Security test process
• Security test process activities
• Designing security tests
• Test execution considerations

• Standards and best practices
• Security testing standards
• Applying best practices
• Leveraging standards

• Organisational context
• Organisational structures
• Security policies and regulations
• Attack scenario analysis

• Software development lifecycle
• Development lifecycle models
• Security testing in operations
• Maintenance activities

• Information security management
• Information security management systems
• Acceptance criteria
• Improving security testing processes

• Reporting and vulnerabilities
• Security test reporting
• Vulnerability analysis
• Vulnerability management

• Security test tools
• Security testing tool categories
• Applying security testing tools

Learners must hold ISTQB Foundation Level certification before taking this exam. 

Exam information:

75-minute, 40-question exam with a 65% pass mark.