Rocheston Certified Cybersecurity Engineer (RCCE) Level 3

The Rocheston Certified Cybersecurity Engineer (RCCE) Level 3 course is a five-day programme in AI-driven attack surface management, automated penetration testing, autonomous cyber defence, threat hunting and security engineering.

Identity and access sit at the centre of protecting users and services, and the course reflects that. Learners apply continuous zero-trust verification with ZelZero-Trust and control access for people, services and AI agents with ZelAccess. They also manage multi-cloud risk with ZelCloud, review mobile operations with ZelFone and secure service connectivity with ZelTunnel. All of this happens in one connected enterprise environment.

The rest of the week builds around that core. On the attack day, learners map the attack surface and run AI-assisted vulnerability discovery and automated penetration testing against assigned training targets, including an AI-enabled enterprise. On the investigate day, they hunt threats and reconstruct incidents. On the code day, they secure software releases and automate security work with ZelC. The final day is a mission against a simulated company, Northstar Supply, from discovery through containment and recovery.

All labs run in a browser on Rocheston’s Zelfire cloud platform, with AINA providing the AI layer and targeting training systems only. For banks, telecom operators and fintech providers, these skills help protect customer accounts and keep services available. Engineers can shrink exposure, catch misuse early and recover quickly. Explore related options in our Rocheston programmes section.

Course Structure and Key Details

The five-day RCCE Level 3 course provides 40 scheduled training hours in four two-hour blocks each day. On Days 1 to 4, each block combines a 105-minute lab with a 15-minute briefing or review, for 16 labs in total. Day 5 consists of four 120-minute mission blocks.

Day 1, Attack, covers attack surface mapping, AI-assisted vulnerability discovery, automated penetration testing, and attacks on an AI-enabled enterprise. Day 2, Defend, covers attack surface reduction, continuous zero-trust verification, cloud risk remediation, and secure tunnels and onion services. Day 3, Investigate, covers threat hunting with ZelKill, incident and AI-context reconstruction, onion-service evidence preservation, and response coordination. Day 4, Code, covers ZelC security automation, exposure-comparison automation, secure software release and evidence protection with control assessment. Day 5, Operate, is the Northstar Supply mission, running from discovery and detection through containment and recovery to a final demonstration.

The course uses 20 core Zelfire platforms. Those most relevant to user-facing services include ZelAccess, ZelZero-Trust, ZelCloud, ZelFone, ZelTunnel, ZelScan for suspicious file and URL analysis, and ZelBreach for breach simulation, alongside ZelMap, ZelExploits, ZelXDR and ZelSOAR. Supporting tools include Vulnerability Vines AI, Noodles, and the Rocheston Cybersecurity Framework. The capstone includes an executive briefing, a technical review, a signed practical-work portfolio, and a Noodles Plan of Action and Milestones.

Rocheston recommends RCCE Level 2 or equivalent practical experience. No prior Zelfire or ZelC experience is needed, but learners should know networking, Linux and Windows administration, web applications and APIs, basic cloud and identity concepts, log investigation and simple scripting.

Rocheston states that the RCCE Level 3 Certification is awarded upon completing the five-day course, which ends with a practical capstone and technical review. No separate written exam is described. Training takes place in a browser on the Zelfire cloud platform. Our Dar es Salaam team can confirm the delivery format, dates, and included access for your group.

Course Objectives

• Enforce continuous zero-trust verification for users, services and AI agents.
• Identify and remediate risk across multi-cloud environments that host customer services.
• Analyse suspicious files and URLs linked to phishing and fraud attempts.
• Review mobile operations and secure service connectivity for digital platforms.
• Map the attack surface and test it with automated penetration testing within an authorised scope.
• Simulate breaches to understand how attacks on users and services could unfold.
• Hunt threats and reconstruct incidents that affect customer accounts or data.
• Automate security workflows with ZelC to protect services consistently.