IT Security Risk Assessment for a FinTech Mobile App

FreeVerified credential2 weeksIntermediate

Overview

What this challenge is about.

Perform a STRIDE threat model and risk assessment on a FinTech app’s architecture, then earn your verifiable certificate.

The scenario

Fintech companies operate in one of the most heavily regulated and targeted sectors for cybersecurity. Mexican fintechs must comply with regulations including CNBV, LFPDPPP, and the upcoming DORA-like regulation, while also defending against sophisticated threats. A single data breach can cost a fintech its banking license, customer trust, and potentially the entire business. Yet many growing fintechs underinvest in security risk management, treating it as a compliance checkbox rather than a strategic business function. A Mexico City-based fintech startup providing open banking APIs to retail banks has grown to 45 employees and processes 2 million API transactions per day containing sensitive financial data. They have passed their initial CNBV regulatory review but need a comprehensive IT security risk assessment ahead of their Series B funding round.

CredentialBlockchain-anchored

ShareableLinkedIn-ready

LanguageEnglish

PaceSelf-paced

The Brief

What you'll do, and what you'll demonstrate.

Conduct a structured IT security risk assessment for the fintech startup using the ISO 27005 framework, identifying critical assets, threat vectors, vulnerabilities, and risk levels, and deliver a risk treatment plan that addresses the top 10 risks within a realistic budget.

Program Fit

Where this fits in your program.

Sharpens the same skills your degree expects you to demonstrate.

Aligned coursework coming soon.

Skills

Skills you'll demonstrate.

Each one shows up on your verified credential.

Careers

Career paths this challenge builds toward

Completing this challenge demonstrates skills that transfer directly to these roles:

Career paths this builds toward

Canonical roles

Security AnalystFuture-proof
On any given Tuesday, a security analyst might be triaging an alert from Splunk that turns out to be nothing, then catching a real intrusion attempt two hours later that the automation missed. The role is pattern recognition under pressure, anchored in frameworks like MITRE ATT&CK and informed by digital forensics tools when the pattern becomes an incident. The best analysts develop a feel for what normal looks like on a network so abnormal stands out before it becomes a breach. Students who like puzzles and don't mind being wrong publicly tend to thrive. Expect to grow by working real tickets, contributing to detection rules, and slowly building the instinct that separates a curious anomaly from the one worth waking someone up for.
Engineering & IT

One more thing

You can put a credential on your CV by Friday.

Start this challenge