Apply now
Postgraduate DiplomaElectronics, Embedded Systems & Telecom Applications open

Diploma in Secure OTA, SBOM and Vulnerability Management

Online postgraduate diploma of 800 hours in secure OTA, SBOM and vulnerability management. 8 modules covering the regulatory framework, secure OTA architectures, campaign operation, SBOM, vulnerability management, disclosure and supply-chain security with the Cyber Resilience Act, UNECE R155 and UNECE R156, with an assigned technical tutor.

Duration800 hours · 6–8 months
ModeOnline
LanguageEnglish
Start datesSet by the faculty
AwardSEIUM Institute diploma
Enrol now View syllabus Ask an advisor

Diploma in Secure OTA, SBOM and Vulnerability Management — studying from Australia

Electronics and embedded systems underpin a wide range of Australian industries, including defence, mining automation, medical devices and consumer technology. The telecommunications sector is significant, with ongoing investment in fibre, mobile networks and satellite communications for remote regions. Research organisations such as CSIRO and university groups contribute to advances in sensing, communications and signal processing. Engineers typically work on hardware design, firmware development, testing and certification. Employers include telecommunications carriers, defence contractors, instrumentation companies and product manufacturers.

Fees for Australia: A$2,050 (AUD), with instalments and employer sponsorship available.

Relevant bodies in Australia

  • Australian Communications and Media Authority (ACMA)
  • Engineers Australia
  • Standards Australia
  • Telecommunications Industry Ombudsman

Typical roles

  • Embedded Systems Engineer
  • Electronics Design Engineer
  • Firmware Engineer
  • Telecommunications Engineer

Questions from Australia

Is this qualification recognised for electronics engineering in Australia?

SEIUM's qualifications are private and not official state degrees, and they are not accredited by Engineers Australia or the Australian Communications and Media Authority. Recognition for electronics and telecom roles generally depends on accredited degrees, licences and experience. Employers or the relevant body make the final decision.

Which Australian employers hire embedded and telecom engineers?

Australia has telecommunications carriers, defence electronics firms, medical device makers, mining technology companies and IoT developers. Employers mostly assess your hands-on skills, project record and certifications. Ask prospective employers whether they would consider a private online qualification.

Can I study this part-time while working, and how is it supported?

The courses are 100% online and taught in English, so you can study from anywhere in Australia without needing a student visa. Specialist courses take 300 hours, diplomas 800 and master's 1,900. Each student has an assigned technical tutor, fees are payable in instalments, and employer sponsorship may be possible.

Virtual lab · try it before you enrol

Take the controls.

Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.

SIM · LIVE ●
Learning outcomes

What you will be able to do

01

Interpret the obligations of the CRA and UNECE R155 and R156 regarding updates.

02

Design secure OTA architectures based on TUF and Uptane.

03

Operate large-scale update campaigns.

04

Generate and maintain SBOMs in SPDX and CycloneDX formats.

05

Prioritise vulnerabilities with CVSS, EPSS and VEX.

06

Manage coordinated disclosure and incident response.

07

Protect the software supply chain.

Profile

Who it's for

  • Product security engineers facing CRA and UNECE obligations.
  • PSIRT leads organising vulnerability handling and disclosure.
  • OTA update engineers designing and operating campaigns.
  • Vulnerability analysts working with SBOM, CVSS and VEX.
  • DevSecOps engineers securing build pipelines.
  • CRA compliance managers preparing manufacturer documentation.
  • Engineering or science graduates looking to enter the automotive sector.
Standards & tools

What you'll work with

  • Regulation (EU) 2024/2847 (Cyber Resilience Act) (cybersecurity requirements for products with digital elements)
  • UN Regulation No. 155 (UNECE R155) (vehicle cybersecurity management system)
  • UN Regulation No. 156 (UNECE R156) (vehicle software update management system)
  • ISO 24089:2023 (road vehicles software update engineering)
  • ISO/IEC 5962:2021 (SPDX) (software package data exchange)
  • ECMA-424 (CycloneDX) (bill of materials specification)
  • ISO/IEC 29147:2018 (vulnerability disclosure)
  • ISO/IEC 30111:2019 (vulnerability handling processes)
  • Syft
  • Grype
  • Dependency-Track
  • Eclipse hawkBit
  • Mender
Syllabus

8 modules

  1. 1.1Cyber Resilience Act and manufacturer obligations
  2. 1.2UNECE R155 and the CSMS
  3. 1.3UNECE R156 and the SUMS
  4. 1.4ISO 24089 for software updates
  5. 1.5Mandatory reporting of exploited vulnerabilities
  6. 1.6Support period and end of life
  7. 1.7FDA requirements for medical devices
  8. 1.8NIS2 Directive and suppliers
  9. 1.9Evidence for type approval
  10. 1.10Case study: gap analysis of a manufacturer against the CRA
  1. 2.1Push and pull update models
  2. 2.2Uptane framework for automotive
  3. 2.3The Update Framework (TUF)
  4. 2.4Roles, metadata and delegations
  5. 2.5Protection against freeze and mix-and-match attacks
  6. 2.6Secure channel and mutual authentication
  7. 2.7Delta updates and compression
  8. 2.8Coordinated update of multiple ECUs
  9. 2.9Recovery from update failures
  10. 2.10Lab: TUF repository with separate roles
  1. 3.1hawkBit and Mender servers
  2. 3.2Fleet segmentation and canary deployment
  3. 3.3Maintenance windows and consent
  4. 3.4Monitoring success rates
  5. 3.5Telemetry and device status
  6. 3.6Scaling to millions of devices
  7. 3.7Data and connectivity costs
  8. 3.8Incident management in campaigns
  9. 3.9OTA performance indicators
  10. 3.10Practical exercise: staged campaign with hawkBit
  1. 4.1Minimum elements according to the NTIA
  2. 4.2SPDX and CycloneDX formats
  3. 4.3SBOM generation at build time
  4. 4.4SBOM for firmware and binaries
  5. 4.5PURL and CPE identifiers
  6. 4.6Transitive dependencies and vendoring
  7. 4.7SBOM in Yocto and Zephyr
  8. 4.8Signing and distribution of the SBOM
  9. 4.9Inventory quality and completeness
  10. 4.10Workshop: CycloneDX SBOM with Syft
  1. 5.1Sources: NVD, OSV and vendor advisories
  2. 5.2CVSS 4.0 and EPSS scoring
  3. 5.3CISA KEV catalogue
  4. 5.4VEX to communicate exploitability
  5. 5.5Correlation between SBOM and vulnerabilities
  6. 5.6Risk-based prioritisation
  7. 5.7Management with Dependency-Track
  8. 5.8Patches, backports and mitigations
  9. 5.9Time-to-remediation metrics
  10. 5.10Lab: vulnerability analysis with Dependency-Track
  1. 6.1Disclosure according to ISO/IEC 29147
  2. 6.2Internal handling according to ISO/IEC 30111
  3. 6.3The PSIRT and its organisation
  4. 6.4Bug bounty programmes
  5. 6.5Notification to ENISA under the CRA
  6. 6.6Security advisories in CSAF format
  7. 6.7Coordination with national CERTs
  8. 6.8Communication with customers
  9. 6.9Lessons learned and improvement
  10. 6.10Case study: handling a critical vulnerability
  1. 7.1SLSA framework and its levels
  2. 7.2Artefact signing with Sigstore
  3. 7.3Reproducible and verifiable builds
  4. 7.4Protecting the CI/CD pipeline
  5. 7.5Third-party components and licences
  6. 7.6Supplier assessment
  7. 7.7Provenance attestations with in-toto
  8. 7.8Build secrets management
  9. 7.9Dependency auditing
  10. 7.10Practical exercise: artefact signing with cosign
  1. 8.1Analysis of regulatory requirements
  2. 8.2Product OTA architecture
  3. 8.3SBOM generation and management
  4. 8.4Vulnerability management process
  5. 8.5Response plan and reporting
  6. 8.6Simulated update campaign
  7. 8.7Indicators and dashboard
  8. 8.8Regulatory compliance documentation
  9. 8.9Report and presentation
  10. 8.10Final project: final review with the tutor
Methodology, software & labs

How you'll learn

100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: you progress at your own pace within the intake, so it can be combined with work.

Each module combines theory, guided reading of the original standard and applied exercises. The working software is Syft, Grype, Dependency-Track, Eclipse hawkBit and Mender, in free, academic or evaluation versions. Testing is studied on real procedures: SBOM generation in build pipelines, staged update campaigns and vulnerability triage with VEX. Assessment is continuous by module plus the final project.

Standards covered: Regulation (EU) 2024/2847 (Cyber Resilience Act), UN Regulation No. 155 (UNECE R155), UN Regulation No. 156 (UNECE R156), ISO 24089:2023, ISO/IEC 5962:2021 (SPDX), ECMA-424 (CycloneDX), ISO/IEC 29147:2018, ISO/IEC 30111:2019.

Assigned technical tutor:every module ends with a deliverable that your tutor marks individually.
Standards-based learning:guided reading of the Cyber Resilience Act, UNECE R155 and UNECE R156 applied to real cases, not as a theoretical annex.
Industry software:Syft, Grype, Dependency-Track, Eclipse hawkBit and Mender, in free, academic or evaluation versions.
Final project:a complete OTA and vulnerability management system for a product, with SBOM, vulnerability process, response plan and a simulated update campaign, reviewed by your tutor.
Flexible format:100% online, no fixed timetables, compatible with full-time work.
Capstone project

Build it end to end

Your final project follows the real engineering workflow, step by step, reviewed by your tutor.

Analyse regulation
Run a gap analysis against the CRA and UNECE R155/R156.
Design the OTA architecture
Build a TUF/Uptane-based update architecture with separate roles.
Generate SBOM and triage
Produce a CycloneDX SBOM with Syft and triage vulnerabilities in Dependency-Track.
Run an update campaign
Execute a staged campaign with hawkBit and track indicators on a dashboard.
Final project
A complete OTA and vulnerability management system, from regulatory analysis to compliance documentation, reviewed by your tutor.
Career opportunities

Where this takes you

Product security engineerPSIRT leadOTA update engineerVulnerability analystDevSecOps engineerCRA compliance manager
Admissions & scholarships

Requirements

  • Prior technical training or professional experience in the sector. No university degree is required.
  • Internet connection and a computer able to run the programme software.
  • English sufficient to read technical standards.

Ready to start?

Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.

Apply now Scholarships
FAQ

Frequently asked questions

The programme totals 800 hours over 6–8 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.

You work with Syft, Grype, Dependency-Track, Eclipse hawkBit and Mender, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.

A SEIUM Institute diploma, awarded on passing the continuous assessment and the final project. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.

Yes. Modules passed are recognised in a higher programme in the same area (postgraduate diploma or master's). Ask about the recognition policy when you enrol.

Prior technical training or professional experience in the sector (no university degree required), a computer able to run the software and English sufficient to read technical standards.

Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.

Keep exploring

Related programmes

See all in Electronics, Embedded Systems & Telecom
Postgraduate DiplomaA$2,050

Postgraduate Diploma in EM Simulation and Antenna Optimisation

Online 800-hour Postgraduate Diploma in EM Simulation and Antenna Optimisation. 8 modules covering IEEE 145-2013, IEEE 1597.1-2008 and Ansys HFSS. Assigned tutor and open enrolment.

800 hOnlineElectronics, Embedded Systems & Telecom
Postgraduate DiplomaA$2,050

Postgraduate Diploma in PdM Integration with CMMS/EAM

Online 800-hour Postgraduate Diploma in PdM integration with CMMS/EAM. 8 modules covering ISO 13374-1, ISO 14224 and IBM Maximo Application Suite. Assigned tutor and enrolment open.

800 hOnlineElectronics, Embedded Systems & Telecom
Postgraduate DiplomaA$2,850

Diploma in Winding, Insulation and Cooling

Online postgraduate diploma of 800 hours in winding, insulation and cooling of magnetic components. 8 modules covering winding technologies, winding arrangement and parasitics, insulating materials, insulation…

6–8 monthsOnlineElectronics, Embedded Systems & Telecom
Diploma in Secure OTA, SBOM and Vulnerability ManagementEnrol
Related programmes

More in Electronics, Embedded Systems & Telecom

Postgraduate Diploma in Device APIs and VersioningView programme →Postgraduate Diploma in SRE/SLIs/SLOs for DevicesView programme →Postgraduate Diploma in Low-Power Telemetry and ProtocolsView programme →Postgraduate Diploma in DX, Compatibility and SDK TestingView programme →Postgraduate Diploma in Provisioning, Device Mgmt and OTAView programme →Diploma in Audio/Comms: Codecs, VoC and Echo-cancellingView programme →

All Electronics, Embedded Systems & Telecom programmes → · How to apply · Fees & financing · Scholarships

Scroll to Top
SEIUM – Institute of Advanced Engineering
Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.