Roadmap — from sysadmin to PAM architect¶
A professional learning path, not just a certification list. It ties this repo's material into one journey: the competencies a Privileged Access Management (PAM) architect needs, the order to build them in, what "done" looks like at each level, and which certification marks each milestone. Certifications are proof points; the skills are the goal.
This is suggested guidance, not a prescriptive or official path — order it to your goals and employer. Certification specifics change; verify on each provider's site. No salary/demand figures are asserted here. Vendor PAM certifications (WALLIX, CyberArk, Palo Alto Networks…) are out of scope for this repo.
Learning objectives¶
- See the four professional levels on the way to PAM architect and what each one must be able to do.
- Know which repo section builds each competency, how to practise it, and which certification proves it.
- Have a concrete certification order (CEH first) with the reasoning behind it.
- Know how to prepare each milestone the same way: the method, the hub procedure, the gate.
The ladder¶
flowchart TB
L0["Level 0 · Sysadmin with PAM exposure<br/>runs AD, Linux, SSH/RDP<br/>and service accounts"]
L1["Level 1 · Security-aware engineer<br/>PAM concepts · protocols<br/>the attacker's view<br/>milestone: CEH"]
L2["Level 2 · PAM engineer<br/>designs & operates controls<br/>detects abuse<br/>milestones: CySA+ · PenTest+ / PNPT"]
L3["Level 3 · Senior PAM engineer<br/>hands-on AD attack skill<br/>automation · cloud · OT<br/>milestones: OSCP · SC-500 / AWS"]
L4["Level 4 · PAM architect<br/>target architecture · governance<br/>programme leadership<br/>milestone: CISSP"]
L0 --> L1 --> L2 --> L3 --> L4| Level | You can… | Build it with | Practise | Milestone |
|---|---|---|---|---|
| 0 · Sysadmin with PAM exposure | Administer AD, Linux and remote access; you have seen a PAM product in use | You are here — the prerequisites refresh what you already know, with the security angle | Inventory and classify the privileged accounts in your estate | — |
| 1 · Security-aware engineer | Explain PAM from first principles; walk through Kerberos, TLS, SAML; describe the full attack lifecycle and the credential attacks that matter | foundations/ · protocols/ · CEH hub (concept pages + 20-module course) | The CEH lab and capstone chain | CEH (now) |
| 2 · PAM engineer | Design and operate the control set — vault, rotation, session brokering & recording, JIT, tiering, break-glass — and detect its abuse | PAM playbook · attack → defense matrix · detection engineering · CySA+ hub · PenTest+ hub | The blue-team lab: run the attacks, then detect them | CySA+ · PenTest+ or PNPT |
| 3 · Senior PAM engineer | Demonstrate AD/identity attack skill hands-on; automate onboarding and reporting via APIs; extend PAM to cloud and OT | identity attack paths · OSCP hub · the PAM engineer's CLI · cloud security · OT security | Script a rotation report against an API; secure a cloud account with JIT roles; the OT lab | OSCP · AZ-500 / AWS Security |
| 4 · PAM architect | Produce a target architecture and phased programme; map regulations to controls; argue trade-offs to leadership; govern the identity estate | reference architecture · compliance & standards · PAM vs IAM / IGA / IDaaS / EPM · market landscape · CISSP | Write a one-page target architecture + rollout plan and a regulation-to-control gap analysis for a real or fictional company | CISSP |
Competency map¶
The ten competencies the repo is organised around. Work them roughly in order; each level above assumes the ones before it.
| # | Competency | Learn | Practise | Proof |
|---|---|---|---|---|
| 1 | Privileged access fundamentals | foundations/ | Privileged-account inventory | — |
| 2 | Identity & directory internals (AD, Kerberos, LDAP, tiering, LAPS, gMSA) | Windows & AD · Kerberos · Active Directory · LDAP | Build the Ansible AD lab with a tier model | CEH → OSCP / PNPT |
| 3 | Secure protocols & crypto (TLS, SSH, SAML, OIDC, RADIUS, PKI) | protocols/ · crypto & PKI | Read a captured handshake; federate a test app to an IdP | Security+ · CISSP |
| 4 | The attacker's view of identity | CEH · identity attack paths · PAM threat landscape | Capstone chain · practical drills | CEH → PenTest+ → PNPT → OSCP |
| 5 | PAM control design | PAM playbook · reference architecture · attack ↔ defense | Target architecture for your estate | — |
| 6 | Detection & response | detection engineering · CySA+ | Blue-team lab | CySA+ |
| 7 | Operations & automation | Linux essentials · PAM engineer's CLI | API-driven onboarding script | — |
| 8 | Cloud & OT privileged identity | cloud security · CEH cloud module · ot-security/ | JIT roles in a cloud account · OT lab | AZ-500 / AWS Security |
| 9 | Governance, risk & compliance | compliance & standards · PAM vs IAM / IGA · market landscape | Regulation → control gap analysis | CISSP |
| 10 | Architect craft (threat modelling, decisions, communication) | engagement methodology & reporting · this page | One-page architecture + phased plan | CISSP |
The certification order (and why)¶
flowchart TD
F["Foundations<br/>foundations/ ·<br/>prerequisites/ · protocols/"] --> CEH["CEH (now)<br/>fundamentals through<br/>the attacker's eyes"]
CEH --> SOC["CySA+<br/>detect & respond"]
CEH --> OFF["PenTest+ → PNPT → OSCP<br/>hands-on offensive proof"]
CEH --> CLOUD["SC-500 / AWS Security<br/>cloud privileged identity"]
SP["Security+<br/>optional vendor-neutral baseline"] -.-> CEH
SOC --> ARCH["CISSP<br/>architect level"]
OFF --> ARCH
CLOUD --> ARCH| Order | Cert | Why here |
|---|---|---|
| 1 | CEH (v13) | The broadest fundamentals course in the repo, taught through the full attack lifecycle. A PAM architect who has never seen Kerberoasting or Pass-the-Hash from the attacker's side designs weaker controls. The hub's defender/PAM lens turns every module into a "which control stops this?" drill. |
| (optional) | Security+ (SY0-701) | The vendor-neutral baseline and HR filter. Take it before CEH if you want the vocabulary first; skip it if CEH already covers that ground for you. |
| 2 | CySA+ (CS0-003; CS0-004 from 2026-06-23) | PAM produces telemetry — session audit, checkout events, rotation failures. CySA+ teaches you to read it, correlate it in a SIEM, and respond. |
| 3 | PenTest+ → PNPT → OSCP | Methodology, then a practical engagement, then the hardest hands-on proof. Each raises your AD-attack skill, which maps one-to-one onto the PAM defenses you will design. Stop at the level your role needs. |
| 4 | Cloud security (SC-500 / AWS Security) | Privileged identity is increasingly cloud identity: Entra roles, AWS IAM, workload identities, secrets managers. |
| 5 | CISSP | The architect-level credential: security architecture, governance, risk, and the management breadth the role demands. |
🧰 Where to practise each stage: see platforms.md — the best free and paid platforms for every step, from Professor Messer and TryHackMe to Hack The Box, PortSwigger, blue-team ranges, and cloud labs — plus the self-hosted CEH lab.
How to prepare each milestone¶
Every certification on the path is prepared with the same procedure, so the skill of preparing compounds from cert to cert:
- Learn the method once: how to prepare a certification (commit → official objectives → self-assess → plan → study loop → readiness gate → exam week → after).
- Open the hub and follow its Prepare for it — the procedure section, which applies the method to that exam and carries the tracker: CEH · Security+ · CySA+ · PenTest+ · PNPT · OSCP.
- Book only when the hub's readiness gate is fully ticked; after the exam, come back here, tick the milestone and move to the next level's competencies.
How the offensive and defensive sides reinforce each other¶
A PAM engineer who understands the attack chain and credential attacks configures better controls; a pentester who understands how PAM brokers and records sessions writes more useful findings. The hubs are deliberately cross-linked — see the attack → defense matrix for the concrete mapping of attack techniques to the controls that stop them.
Habits of a very good professional¶
Certs and labs build knowledge; these habits turn it into judgement.
- Keep a lab and break it. Every control you would recommend, you have configured and attacked at least once (CEH lab).
- Write things down. Architecture decisions, threat models, runbooks — the engagement methodology & reporting page is a good template for structured writing.
- Read the primary source. RFCs, vendor documentation, the standard itself — the sources page collects them.
- Track your gaps. The CEH course's progress tracker and blueprint coverage matrix show the method: log every miss, re-test it first next session.
- Stay vendor-neutral in your thinking. Vaulting, brokering, JIT, rotation and tiering are universal; products are implementations. The market landscape page keeps the map current.
Sources¶
- Certification specifics: see each cert's hub under certs/ and the overview pages under adjacent-certs/, each of which cites its provider.
- Competencies are derived from the repo's own material (foundations, protocols, the CEH defender/PAM knowledge base) and the NIST Cybersecurity Framework functions (Identify · Protect · Detect · Respond · Recover): https://www.nist.gov/cyberframework