Most security interviews don't ask, "Can you find a bug?" They ask something harder: can you rank what actually matters, catch your tools when they're wrong, reconstruct what happened from the logs, and explain the consequence like a senior. This kit is where you practice that — on your own time, as many times as you want. The Security Engineer Practice Kit is a self-paced, downloadable simulation of the take-home and practical screens used to hire security engineers. No setup, nothing to run — you read a real-feeling codebase, a scanner report you can't trust, 24 hours of logs with an incident buried in the noise, and detection rules that look fine until you check them. It comes with two complete, independent scenarios, both set at a fictional HIPAA-covered health-tech company: Variant 1 (start here): a patient-booking service, where the attacker forges their identity and your edge is spotting the lie. Variant 2 (harder): a provider-credentialing service, where the attacker is a real, authenticated user abusing what they're wrongly allowed to do — nothing forged, which quietly breaks every detection that keys on identity. Each variant is about a two-hour exercise with four tasks that mirror the real screen: Vulnerability triage — rank real risk in context and catch the scanner's false positives and its missed criticals. Detection engineering — rebuild the incident from the logs and work out why four deployed rules all missed it, each for a different, defensible reason. Compliance mapping — translate your findings into HIPAA and HITRUST language a compliance lead and an auditor actually use. AI-usage reflection — a template for showing the disciplined, verified use of AI that hiring teams now probe for. What's inside: A realistic Node/Express codebase with interview-grade planted bugs An intentionally unreliable scanner report, so you practice cross-examining a tool instead of trusting it 24 hours of JSON logs per variant with a full attacker timeline hidden in normal traffic Four detection rules per variant, each with a subtle, realistic gap to diagnose A complete answer key plus a junior-vs-senior scoring rubric for every task, so you can grade yourself honestly A study guide of the transferable judgment patterns behind it all — the part that makes the next real assessment easier Real, public CVEs in the dependency data, including a deliberate lesson on which severity score to trust This is for you if you're prepping for a security take-home or practical interview, moving from IT or development into security, or you can already find bugs but want to learn to rank them and sound senior explaining why. It's not a certification cram sheet or a multiple-choice quiz, and it's not a tool you run — it's judgment you build. Everything here is fictional except the CVEs, which are real and checkable. It's an honest training artifact: compliance clause numbers are flagged for you to verify, and the detection queries are readable pseudo-syntax to reason about, not to paste into a live system. Get instant access below. Use code LAUNCH30 at checkout to save during launch.