SA-APEX · application

Apply.

This takes a while to fill in properly, and it is meant to. We read applications against the published admission evidence rather than scoring them automatically, so what you write here is what the decision is made on.

No payment taken
No account created yet
Reviewed by a person
Decline reasons given

How to write this

Specific beats polished. “I have never done this” is a better answer than a paragraph that implies you have. The exam will find out either way, and it costs a great deal more to discover it there.

Redact client names and anything you are contractually barred from sharing. Structured attestations and redacted samples are accepted, and an application is never penalised for honouring a confidentiality obligation.

Not sure yet? Run the eligibility check first — it runs in your browser and takes a couple of minutes. Or read what SA-APEX requires.

About you

Full nameEmailCountryEmployerOptional.

I work for a security testing firm. Including one that competes with Security Arsenal. This changes nothing about how your application is assessed — we ask because the program is deliberately open to you and we like to know it is working.

Route

StandardEvery phase, including the manual foundation gate.OSEE bridgeAn active OSEE waives the manual foundation phase. Nothing else is waived.

Scale

Years of authorized offensive work

Languages you have shipped something real in

Something someone else depended on. Pick every one that applies — three across scripting, systems and application development is the working baseline.

Offensive experience

Describe the offensive work you have actually done.Types of engagement, environments, what you were responsible for. Redact client names — sending us something you are not permitted to send is itself a reason to decline.

0 / 3000

Describe an engagement you owned end to end.Scoping through to retest. What you got wrong is more interesting to us than what went smoothly.

0 / 2000

Describe something you exploited that no scanner or CVE would have found.How you derived it, how you proved it, what the impact was. If you have never done this, say so plainly.

0 / 2000

Software engineering

How do you approach an unfamiliar codebase looking for security defects?Trust boundaries, data flow, state, authorization, concurrency, unsafe composition. Describe your actual method, not a textbook one.

0 / 2000

Infrastructure

What have you built and administered yourself?Cloud, virtualisation, routing (BGP/OSPF), VPN, firewall, directory services, endpoint management, and a mixed Windows/Linux/macOS and mobile fleet. Be specific about what you have configured in production versus in a lab.

0 / 2000

What is your experience with voice platforms?Signalling, media, trunking, provisioning, call routing. Voice is required and is not waived by any prior credential. "None, but here is how I would learn it" is an acceptable answer.

0 / 2000

AI engineering

What have you built on top of a model?Tools, agents, retrieval, evaluation sets, orchestration. A chat wrapper is a fair answer if that is the honest one.

0 / 2000

How do you currently keep client data out of unapproved models?What is enforced in code, what relies on your judgement, and where the gaps are. An honest answer here does not disqualify you. A polished one that is not true will not survive the exam.

0 / 2000

Public workAnything public we can look atResearch, tooling, talks, advisories, disclosures. Optional — plenty of excellent testers have no public footprint and it is not held against you.

Before you submit

I have read the program policies (version 1.0.0-pilot) including the code of ethics, exam rules and the immediate fail conditions, and I understand that course completion is not certification.I consent to Security Arsenal processing this application for eligibility review, and I confirm that nothing I have written here is covered by a confidentiality obligation I am bound by.

No payment is taken and no account is created at this point. If we accept you, we will set up a candidate account then. Your application is retained for the period stated in the policies and then deleted.