Development & Security Skills

Triage a SIEM/EDR alert end-to-end — validate it's real, enrich and scope it, reach a consistent verdict, and decide escalate vs. close with documented rationale. Use when working a SOC alert queue and you need a repeatable, defensible triage.

Assess and establish build artifact provenance and integrity — SLSA provenance level, signing/attestation (Sigstore/cosign, in-toto), and verification at deploy/admission. Use when you need to prove an artifact (container image, package, binary) came from the expected source and build, untampered.

Gap-assess an organization or system against a compliance framework (SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, NIST CSF/800-53), mapping controls to evidence, identifying gaps, and producing a prioritized remediation and audit-readiness plan. Use for compliance gap analysis, certification prep, or audit readiness.

Score a vulnerability with CVSS v3.1: derive the base metric vector, compute the score and severity rating, and explain each metric choice. Use whenever a finding needs a defensible severity rather than a guess.

Extract and operationalize indicators (IOCs) and behaviors (IOAs) from an incident or sample — atomic, computed, and behavioral — and prepare them for detection, blocking, and intel sharing. Use after/within an investigation to turn findings into defensive value.

Review a mobile app (Android/iOS) against the OWASP MASVS control groups — storage, crypto, auth, network, platform, code quality, and resilience — producing a per-control finding set. Use for a structured mobile security assessment or design review. Authorized testing only.

Assess a REST or GraphQL API against the OWASP API Security Top 10 (2023), producing a per-category finding set with severity and remediation. Use when reviewing or pentesting an API. Authorized testing only.

Look up and map to the right OWASP Top 10 family — Web, API, LLM, or Mobile — and give the canonical category ID/name for a finding. Use when you need a consistent OWASP reference for tagging findings, scoping a review, or aligning a report across the appsec/genai plugins.

Assess a web application against the OWASP Top 10 (2021), producing a per-category finding set with severity and remediation. Use when reviewing or pentesting a web app for the most common, highest-impact web risks. Authorized testing only.

Run the PASTA (Process for Attack Simulation and Threat Analysis) seven-stage, risk-centric threat model that ties technical threats to business impact. Use for a deeper, attacker-simulation threat model where business risk alignment matters (vs. the faster STRIDE pass).

Gather people- and organization-focused OSINT for an authorized social-engineering assessment — org structure, roles, contact patterns, and public footprint that inform realistic phishing/pretext scenarios. Use only within an authorized engagement; focus on assessing susceptibility and improving awareness.

Rank a set of enumerated threats or findings by risk (likelihood × impact) and map each to a prioritized mitigation. Use after STRIDE/PASTA enumeration or any time you have a threat/finding list that needs prioritization.

Run or ingest static application security testing (SAST) results on a codebase, triage them to remove false positives, and confirm the real issues with code evidence and remediation. Use when reviewing source code for security flaws or cleaning up noisy scanner output.