Postgraduate Diploma in Threat Modeling, Pen-Testing and Vulnerability Management
Online 800 h Postgraduate Diploma in Threat Modeling, Pen-Testing and Vulnerability Management. 8 modules covering ISO/IEC 27001, NIST SP 800-115 (technical security testing) and OWASP ZAP. Assigned tutor and open enrolment.
Postgraduate Diploma in Threat Modeling, Pen-Testing and Vulnerability Management — studying from the United States
The United States is a major center for autonomous driving and advanced driver assistance systems, with significant activity in California, Michigan, Pennsylvania and Texas. Automakers, technology firms and specialized startups develop sensor fusion, perception, planning and vehicle software platforms. The shift toward software-defined vehicles is reshaping traditional engineering roles and increasing demand for embedded software, cybersecurity and systems engineering talent. Federal and state rules on testing and safety create a demanding environment where validation and standards expertise is highly valued.
Fees for the United States: US$1,440 (US Dollars), with instalments and employer sponsorship available.
Relevant bodies in the United States
Typical roles
Questions from the United States
What US bodies and rules govern autonomous and ADAS vehicle engineering?
In the US, NHTSA sets federal vehicle safety standards and has issued guidance on automated driving systems, while states regulate testing and operation on public roads. SAE International's levels of driving automation are the common industry reference. Professional engineering licensure is handled by state boards. SEIUM's qualifications are private and not accredited by any national body, so their recognition is for employers or relevant bodies to decide.
Do US employers in autonomous driving and software-defined vehicles recognize private engineering qualifications?
US companies working on ADAS and software-defined vehicles, including automakers, Tier 1 suppliers and technology firms, mainly look for software, controls and safety-engineering experience. A private qualification can document specialist study, but it is not a standard hiring requirement and its value is assessed by each employer. Projects, code samples and relevant prior roles usually carry more weight.
Can I study autonomous and software-defined vehicle topics from the US alongside my job?
Yes. The programmes are online and taught in English, so you can study from home without a student visa. Expect a significant time commitment: about 1,900 hours for a master's, 800 hours for a postgraduate diploma, or 300 hours for a specialist course. Each student receives an assigned technical tutor. Fees may be paid in instalments, and some employers fund training, which you should discuss with your employer.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Develop threat models using STRIDE and attack trees.
Plan authorised security tests following recognised methodologies.
Assess the security of web applications against the OWASP Top 10.
Review the hardening of systems and networks.
Prioritise vulnerabilities using CVSS and business context.
Design a vulnerability and patch management programme.
Write technical and executive reports on results.
Who it's for
- Cybersecurity analyst looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Security auditor looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Vulnerability management manager looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Application security engineer looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Cybersecurity consultant looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Technology risk analyst looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Engineering or science graduates seeking to enter cybersecurity consulting.
What you'll work with
- ISO/IEC 27001
- NIST SP 800-115 (technical security testing)
- OWASP Testing Guide
- ISO/IEC 29147 (vulnerability disclosure)
- ISO/IEC 30111 (vulnerability handling)
- CVSS v3.1 (FIRST)
- National Security Scheme (Esquema Nacional de Seguridad, RD 311/2022)
8 modules · 800 h
1.1Assets, threats and exposure surface1.2Confidentiality, integrity and availability1.3Vulnerability lifecycle1.4Reference frameworks: NIST CSF and ISO/IEC 270011.5Professional ethics and written authorisation1.6Rules of engagement and audit scope1.7Legal liability and data protection1.8Blue team and red team roles1.9Security metrics for management1.10Workshop: asset inventory of an SME
2.1Objectives of threat modelling2.2Data flow diagrams and trust boundaries2.3STRIDE methodology2.4Attack trees and prioritisation2.5PASTA and risk-oriented modelling2.6Modelling cloud architectures2.7Modelling industrial systems2.8Integration into the secure development lifecycle2.9Modelling and documentation tools2.10Practice: threat model of a web application
3.1Types of testing: black box, grey box and white box3.2OWASP Testing Guide methodology3.3PTES and OSSTMM as frameworks3.4Test planning and scope3.5Controlled laboratory environments3.6Evidence collection and traceability3.7Risk management during testing3.8Client coordination and escalation3.9Quality control of work3.10Case study: authorised test plan
4.1OWASP Top 10 and its interpretation4.2Authentication and session management4.3Access control and authorisation4.4Input validation and output encoding4.5REST API security4.6Secure server configuration4.7Static and dynamic code analysis4.8Third-party dependency review4.9Mitigation measures and verification4.10Laboratory: audit of a practice application
5.1Segmentation and secure network architecture5.2Operating system hardening5.3Identity management and secure Active Directory5.4Secure cloud configuration5.5Event logging and monitoring5.6Detection of weak configurations5.7Backups and resilience5.8Network incident response5.9Verification of defensive controls5.10Laboratory: hardening review of a server
6.1Vulnerability management programme6.2Vulnerability scanners and their tuning6.3CVE, CWE and public databases6.4CVSS scoring and risk context6.5Prioritisation based on known exploitability6.6Patch management and change windows6.7Exceptions and accepted risk6.8Metrics: remediation time and coverage6.9Responsible vulnerability disclosure6.10Practice: prioritised remediation plan
7.1Structure of an audit report7.2Executive summary for management7.3Technical description of findings7.4Evidence and reproducibility7.5Remediation recommendations7.6Verification of fixes7.7Presenting results to the client7.8Report confidentiality7.9Common reporting errors7.10Workshop: writing a complete report
8.1Scope definition and authorisation8.2System threat modelling8.3Test plan and laboratory environment8.4Controlled test execution8.5Analysis and prioritisation of findings8.6Vulnerability management plan8.7Proposal of defensive measures8.8Executive and technical report8.9Dissertation and presentation8.10Final review with the tutor
How you'll learn
Training 100 % online on the SEIUM campus, with downloadable material, recorded classes and assigned technical tutor. No fixed timetables: the student progresses at their own pace within the intake, making it possible to combine with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is OWASP ZAP, Nessus, OpenVAS, Microsoft Threat Modeling Tool, Wireshark, in free, academic or evaluation versions. Tests are studied using real procedures in isolated virtual laboratories, authorised audits of practice applications and vulnerability management exercises. Assessment is continuous per module, plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Develop threat models using STRIDE and attack trees.
Plan authorised security tests following recognised methodologies.
Assess the security of web applications against the OWASP Top 10.
Review the hardening of systems and networks.
Prioritise vulnerabilities using CVSS and business context.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The programme works with OWASP ZAP, Nessus, OpenVAS, Microsoft Threat Modeling Tool, Wireshark. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the integrative project. This is in-house training, not an official Ministry qualification.
Yes. Modules passed in a course or diploma in the same area are credited towards the advanced programme. Check the credit transfer policy when you enrol.
Related programmes
Postgraduate Diploma in Digital Traffic Twins and Test Tracks
Online 800-hour Postgraduate Diploma in Digital Traffic Twins and Test Tracks. 8 modules with ASAM OpenDRIVE, ASAM OpenCRG and SUMO. Assigned tutor and open enrolment.
Postgraduate Diploma in All-Weather Perception and Domain Adaptation
Online 800-hour Postgraduate Diploma in All-Weather Perception and Domain Adaptation. 8 modules with ISO 21448:2022 (SOTIF), ISO 26262:2018 and PyTorch. Assigned tutor and open enrolment.
Postgraduate Diploma in Sim↔Real-World Correlation Metrics
Online postgraduate diploma of 800 hours in sim-to-real correlation metrics. 8 modules covering model verification and validation, signal and trajectory metrics, vehicle dynamics, sensor and scenario-level…
More in Autonomous, ADAS & Software-Defined Vehicle
All Autonomous, ADAS & Software-Defined Vehicle programmes → · How to apply · Fees & financing · Scholarships