Rocheston Certified Cybersecurity Engineer (RCCE) Level 3

RCCE Level 3 training is built on that principle. The Rocheston Certified Cybersecurity Engineer (RCCE) Level 3 course is a five-day programme in AI-driven attack surface management, automated penetration testing, autonomous cyber defence, threat hunting and security engineering.

The course starts by putting learners in the attacker’s position, within strict limits. Against assigned training targets, they map an enterprise attack surface, use AI-assisted vulnerability discovery and run automated penetration tests, including attacks on an AI-enabled enterprise. Every later day builds on what they found. They reduce the attack surface, apply continuous zero-trust verification, and remediate cloud risk. They then hunt threats, reconstruct incidents, including their AI context, and coordinate the response.

The fourth day is about engineering at scale. Learners automate security work with ZelC, an agentic AI programming language for scoped security workflows, and secure software releases with scanning and release gates. The fifth day is a full operational mission against a simulated company, Northstar Supply, covering discovery, detection, containment, and recovery. It ends with an executive briefing and a technical review.

All work takes place in one connected enterprise environment on Rocheston’s Zelfire cloud platform, accessed through a browser, with AINA providing the AI layer. For enterprises, the result is a security team that can match automated attackers with automated defence, while keeping people in charge of scope and judgement. Rocheston’s wider portfolio appears on our Rocheston cybersecurity certifications page.

Course Structure and Key Details

RCCE Level 3 runs over five days and 40 scheduled training hours, in four two-hour blocks each day. On Days 1 to 4, each block combines a 105-minute lab with a 15-minute briefing or review, giving 16 labs. Day 5 consists of four 120-minute mission blocks. Breaks are in addition to the scheduled hours.

Day 1, Attack, covers attack surface mapping, AI-assisted vulnerability discovery, automated penetration testing, and attacks on an AI-enabled enterprise. Day 2, Defend, covers attack surface reduction, continuous zero-trust verification, cloud risk remediation, and secure tunnels and onion services. Day 3, Investigate, covers threat hunting with ZelKill, incident and AI-context reconstruction, onion-service evidence preservation, and response coordination. Day 4, Code, covers ZelC security automation, exposure-comparison automation, secure software release, and evidence protection with control assessment. Day 5, Operate, is the Northstar Supply mission, covering discovery, detection, containment and recovery and finishing with a final demonstration.

The course uses 20 core Zelfire platforms. They are ZelTester for engagement management and reporting, ZelC, ZelWall for network segmentation, ZelCloud for multi-cloud risk, ZelAccess for human, service, and agent access, ZelScan for file and URL analysis, and ZelRank for threat intelligence correlation. They continue with ZelDrift for configuration drift, ZelXDR for detection and investigation, ZelSOAR for response orchestration, ZelPosture for exposure measurement, ZelZero-Trust, ZelExploits for automated testing, and ZelKill for threat hunting. The last six are ZelCode for code security and release gates, ZelBreach for breach simulation, ZelDB for linking findings and evidence, ZelFone for mobile review, ZelTunnel for scoped connectivity, and ZelMap for asset discovery. Supporting tools include Vulnerability Vines AI, Noodles, and the Rocheston Cybersecurity Framework, with AINA across the whole course.

Rocheston recommends RCCE Level 2 or equivalent practical experience. Prior Zelfire or ZelC experience is not required. Learners should be familiar with networking, Linux and Windows administration, web applications and APIs, basic cloud and identity concepts, security log investigation, and simple scripting.

Rocheston states that the RCCE Level 3 Certification is awarded upon completing the five-day course, which ends with a practical capstone and technical review. The capstone includes a five-minute executive briefing, a ten-minute technical review, a signed practical-work portfolio with a verification manifest, and a Noodles Plan of Action and Milestones. No separate written exam is described. Training takes place in a browser on the Zelfire cloud platform. Delivery format, dates, fees, and included access are confirmed for each offering, so check them with our team when you enquire.

Course Objectives

• Explain how attackers use automation and AI to find and exploit enterprise exposure.
• Map an attack surface and run automated, AI-assisted penetration tests within an authorised scope.
• Reduce exposure through segmentation, zero-trust verification and cloud remediation.
• Hunt threats and reconstruct incidents, including the actions of AI systems and agents.
• Orchestrate detection and response across connected security tools.
• Automate security workflows with ZelC and measure changes in exposure over time.
• Secure software delivery with scanning, secrets detection, SBOMs, and release gates.
• Lead an enterprise mission and present results to executives and technical reviewers.