Rocheston Certified Cybersecurity Engineer (RCCE) Level 3

The Rocheston Certified Cybersecurity Engineer (RCCE) Level 3 course is a five-day programme in AI-driven attack surface management, automated penetration testing, autonomous cyber defence, threat hunting and security engineering.

Detection and response sit at the heart of the course. On the investigation day, learners hunt threats across enterprise logs with ZelKill, reconstruct incidents including their AI context, preserve evidence and coordinate the response. Throughout the week, they use ZelXDR for connected detection and investigation, ZelSOAR for response orchestration and ZelRank for threat intelligence correlation, all within one connected enterprise environment.

Defenders in this course also see the attack side for themselves. On the first day, learners map the attack surface and run AI-assisted vulnerability discovery and automated penetration testing against assigned training targets. The second day turns to defence with zero-trust verification and cloud remediation, and the fourth day automates security work with ZelC. The fifth day is a full mission against a simulated company, Northstar Supply, from detection to containment and recovery.

All activity runs in Rocheston’s Zelfire cloud environment, accessed through a browser, with AINA providing the AI layer.

For security operations and response teams, the result is faster, evidence-based response. Engineers learn to hunt proactively, reconstruct what happened, and use automation to contain threats consistently. Explore further options in our Rocheston courses hub.

Course Structure and Key Details

RCCE Level 3 runs over five days and 40 scheduled training hours, in four two-hour blocks per day. On Days 1 to 4, each block pairs a 105-minute lab with a 15-minute briefing or review. Day 5 uses four 120-minute mission blocks.

The five themes build on each other. Day 1, Attack, covers attack surface mapping, AI-assisted vulnerability discovery, automated penetration testing, and attacks on an AI-enabled enterprise. Day 2, Defend, covers attack surface reduction, continuous zero-trust verification, cloud risk remediation, and secure tunnels and onion services. Day 3, Investigate, covers threat hunting with ZelKill, incident and AI-context reconstruction, onion-service evidence preservation, and response coordination. Day 4, Code, covers ZelC security automation, exposure-comparison automation, secure software release and evidence protection with control assessment. Day 5, Operate, is the Northstar Supply mission, covering discovery, detection, containment, recovery, and a final demonstration.

The labs draw on 20 core Zelfire platforms. Those most relevant to detection and response include ZelXDR, ZelSOAR, ZelKill, ZelRank, ZelDrift for configuration drift and ZelPosture for exposure measurement, alongside ZelMap, ZelExploits and ZelCloud. Supporting tools include Vulnerability Vines AI, Noodles, and the Rocheston Cybersecurity Framework. The capstone ends with a five-minute executive briefing, a ten-minute technical review, a signed practical-work portfolio, and a Noodles Plan of Action and Milestones.

Rocheston recommends RCCE Level 2 or equivalent practical experience. No prior Zelfire or ZelC experience is required, but learners should be familiar with networking, Linux and Windows administration, web applications and APIs, cloud and identity concepts, security log investigation and simple scripting.

Rocheston states that the RCCE Level 3 Certification is awarded upon completing the five-day course, which ends with a practical capstone and technical review. No separate written exam is described. Training takes place in a browser on the Zelfire cloud platform. Contact our Doha advisors to confirm the delivery format, dates, and included access for your team.

Course Objectives

• Hunt threats across enterprise logs using hypothesis-driven investigation.
• Reconstruct incidents in full, including the role of AI systems and agents.
• Correlate threat intelligence with detections to prioritise response.
• Orchestrate containment and recovery with connected detection and response tools.
• Preserve evidence during an active incident, including evidence from onion services.
• Detect configuration drift and measure changes in exposure over time.
• Understand AI-driven attack techniques by applying them to assigned training targets.
• Brief executives and technical reviewers on incident outcomes and next steps.