+1. I’m not sure with the OP's familiarly with writing secure code and passing down knowledge to others but there's a def gap in general here.

If WEB-300 is too hardcore, the exam is 48 hours and not including the report writing, the new WEB-200 is at least a good start.