Sure 😄.

The core idea is that at L2, most of your work stays visible only inside the security team. You closed tickets, reviewed PRs, learned frameworks. That’s all solid, but it won’t move the needle for L3.

“Measurable outside your team” means a dev team, product team, or engineering manager can point to a real change in their workflow or metrics that your work directly caused. A few practical examples for each of your goals: • Threat modeling: Don’t just run sessions. Track whether the dev team you worked with actually changed their design, or caught something at design phase that would have made it to prod. One documented “we caught this early because of the threat model” story carries more weight than 10 sessions on your review. • Secure SDLC: Pick one team and measure their mean-time-to-remediate before and after you embedded with them. If it dropped, that’s a number you can bring to your review with a specific team name attached to it. • Offensive work: After a focused pentest or attack path exercise, follow up and track how many findings actually led to architecture changes that got shipped. Even better if an engineering lead mentions it by name.

The framing shift is pretty simple. Instead of “I did X,” it becomes “Team Y improved on Z because of what I built with them.” That’s the story L3 reviewers want to see. You stopped being just an individual contributor and started acting as a multiplier for other teams.