Cybersecurity

Cybersecurity

When to Use

• Define enterprise security strategy, policy, and control architecture
• Assess risk across identity, infrastructure, applications, vendors, and incident readiness
• Design defense-in-depth programs aligned to NIST CSF, ISO 27001, SOC 2, or similar frameworks
• Scope penetration tests, vulnerability management programs, or security incident response
• Prepare high-level GRC, board, or leadership security narratives

When NOT to Use

• GRC program, framework scope, gap plans, audit prep → compliance-specialist
• Implement audit evidence automation or control-by-control mapping → compliance-engineer
• Add SAST, SBOM, OIDC, or pipeline security gates → devsecops
• Triage SOC alerts, SIEM queues, or SOAR cases → soc-analyst
• Proactive threat hunts and hunt program design → threat-hunter
• Alert-driven investigation and detection tuning → defensive-security-analyst
• Execute authorized penetration tests or PoCs → penetration-tester
• Lead red team / adversary simulation campaigns → red-team-specialist
• Execute web/API OWASP assessments → web-pentester
• Hands-on binary, firmware, or protocol reverse engineering → reverse-engineer
• Provision cloud networks, clusters, or infrastructure modules → infrastructure-engineer
• Design application integration ADRs → senior-system-architecture

Related skills

Core Workflows

1. Security architecture and control design

1. Identify assets, data classes, and trust boundaries 2. Apply defense-in-depth: prevent, detect, respond, recover 3. Map controls to framework (NIST CSF, ISO 27001 Annex A) 4. Document accepted risks with owner and review date 5. Validate with architecture review before major launches

See `references/security_architecture.md` for control catalogs and network zoning.

2. Vulnerability and exposure management

Program cadence:

Prioritize: exploitability × exposure × asset criticality.

See `references/vuln_threat_management.md` for SLAs, pentest scope, and threat intel use.

3. Identity and access security

• Enforce MFA for all human access; phishing-resistant where possible
• Least privilege; periodic access reviews (quarterly for prod)
• Separate break-glass accounts; log and alert on use
• Service accounts: scoped credentials, rotation, no shared passwords

See `references/identity_access.md` for IAM patterns and PAM considerations.

4. Security incident response

Phases: prepare → detect → analyze → contain → eradicate → recover → post-incident.

See `references/incident_response.md` for playbooks and evidence preservation.

5. GRC and audit support

• Maintain control matrix linked to evidence
• Track exceptions/waivers with expiry
• Coordinate with legal on breach notification thresholds
• Align third-party risk with vendor reviews

See `references/grc_compliance.md` for SOC 2 / ISO mapping and audit artifacts.

When to load references

• Architecture and controls → references/security_architecture.md
• Vulns, pentest, threats → references/vuln_threat_management.md
• IAM and access → references/identity_access.md
• Incidents → references/incident_response.md
• GRC and audits → references/grc_compliance.md

GRC and compliance

Table of contents

1. Control matrix 2. SOC 2 evidence 3. Exceptions

Control matrix

Columns: control ID, description, owner, evidence source, test frequency, last result.

SOC 2 evidence

Examples: access reviews, change tickets, vuln scan reports, backup tests, policies with approval dates.

Exceptions

Register: control, rationale, compensating control, approver, expiry, review date.

Identity and access

Table of contents

1. Human access 2. Service accounts 3. Access reviews

Human access

• SSO to all SaaS; disable local accounts
• Role-based groups; no standing admin for daily work
• Just-in-time elevation with ticket and time bound

Service accounts

• One account per integration; document owner
• Rotate keys on schedule and on departure
• Prefer workload identity over long-lived keys

Access reviews

Quarterly for production; verify managers attest removals within SLA.

Incident response

Table of contents

1. Preparation 2. Containment actions 3. Evidence

Preparation

• Runbooks per scenario (ransomware, credential leak, DDoS)
• Contact tree and legal/comms roles
• Tabletop exercise annually

Containment actions

Evidence

Chain of custody for disk images and log exports; coordinate with legal before broad notification.

Security architecture

Table of contents

1. Defense in depth 2. Network zones 3. Control families

Defense in depth

Network zones

• Public: CDN, WAF only
• DMZ: Load balancers, ingress
• Application: workloads, no inbound from internet
• Data: databases, restricted ACLs

Control families

Map designs to ISO 27001 Annex A or NIST CSF: Identify, Protect, Detect, Respond, Recover.

Vulnerability and threat management

Table of contents

1. Patch SLAs 2. Pentest scope 3. Threat intel

Patch SLAs

Adjust for compensating controls and exposure.

Pentest scope

Include: external attack surface, auth flows, major APIs, admin interfaces.

Exclude without approval: social engineering, destructive tests on prod.

Deliverables: executive summary, finding list, retest window.

Threat intel

Use feeds for IOC blocking; map TTPs to MITRE ATT&CK for detection gaps.