Information Security Engineer

Information Security Engineer

When to Use

• Implement and operate security controls such as SSO, RBAC, PAM, KMS, certificate management, WAF, DLP, EDR, or SIEM integrations
• Translate security architecture, audit findings, or policies into deployable guardrails and validation checks
• Build identity, encryption, secrets, logging, or security automation workflows
• Harden cloud accounts, endpoints, SaaS apps, and baseline configurations with security ownership
• Validate remediation for vulnerabilities and control gaps

When NOT to Use

• Board briefings, risk appetite, security budget, crisis exec comms → chief-information-security-officer
• Define security strategy or enterprise security program → cybersecurity
• GRC program, framework scope, audit prep, questionnaires → compliance-specialist
• Triage alerts, SOC playbooks, or shift ops → soc-analyst
• Deep investigation, hunts, or detection authoring → defensive-security-analyst
• Execute authorized pentests or exploit validation → penetration-tester, network-pentester, web-pentester
• Plan adversary simulation or purple-team campaigns → red-team-specialist
• Add CI/CD security gates, SBOMs, or artifact signing only → devsecops
• Design tenant isolation and product data-plane boundaries → product-infrastructure-security-engineer
• Cloud org guardrails, CSPM, multi-account IAM/network security → cloud-security-engineer
• IAM program design, access reviews, federation, PAM, SoD (without tool deploy) → iam-specialist

Related skills

Core Workflows

1. Control implementation

Translate architecture or policy into deployable controls:

1. Confirm requirement source (policy, threat model, audit finding) 2. Choose control type: preventive, detective, corrective 3. Implement in IaC or managed config (versioned, reviewed) 4. Define validation test (automated where possible) 5. Document owner, exception process, and review cadence

See `references/control_hardening.md` for baselines and guardrail patterns.

2. Identity and access engineering

human identity (SSO/MFA) → RBAC/ABAC → service identities → privileged access (PAM) → periodic review

• Federate apps to IdP; enforce MFA and conditional access
• Least-privilege IAM roles; no long-lived access keys on humans
• Break-glass accounts monitored and rare
• Quarterly access reviews with evidence export

See `references/identity_access_engineering.md` for patterns and anti-patterns.

3. Encryption and secrets

Never commit secrets; scan repos; rotate on incident.

See `references/encryption_secrets.md` for key lifecycle and TLS checklist.

4. Security tooling integration

Integration checklist:

1. Log/agent deployment coverage target (e.g., 95% endpoints) 2. Parser/normalization and field mapping 3. Correlation rules owned by detection team 4. SOAR playbooks for approved auto-actions only 5. Health monitoring on collectors and API quotas

See `references/security_tooling.md` for SIEM/EDR/SOAR integration notes.

5. Vulnerability remediation engineering

Work with app and platform teams:

1. Ingest findings (scanner, pentest, bug bounty) 2. Prioritize: exploitability × asset criticality × exposure 3. Assign owner and SLA by severity 4. Implement or review fix (patch, config, code) 5. Validate with rescan or analyst sign-off 6. Track exceptions with expiry

See `references/vulnerability_remediation.md` for SLA table and validation steps.

6. Change and release for security systems

Security changes are production changes:

• Peer review on IaC and policy PRs
• Staged rollout (dev → stage → prod)
• Rollback plan for IdP, WAF, or SIEM parser changes
• Post-change validation within 24h

When to load references

• Baselines and guardrails → references/control_hardening.md
• SSO, IAM, PAM → references/identity_access_engineering.md
• KMS, TLS, secrets → references/encryption_secrets.md
• SIEM, EDR, SOAR → references/security_tooling.md
• Fix tracking and validation → references/vulnerability_remediation.md

Control hardening

Table of contents

1. Baseline sources 2. Cloud guardrails 3. Validation

Baseline sources

Encode baselines in IaC (Terraform, CloudFormation) or policy-as-code (OPA, Kyverno, SCPs).

Cloud guardrails

Examples (adapt per org):

• Deny public S3 buckets and open security groups by default
• Require encryption on new storage
• Restrict region and instance types via SCP
• Centralize logging to security account
• Enforce IMDSv2, disable legacy auth where possible

Validation

• Automated compliance scan (e.g., Prowler, Security Hub) on schedule
• Drift detection on IaC
• Sample manual check quarterly for net-new services

Document exceptions: owner, risk acceptance, expiry date.

Encryption and secrets

Table of contents

1. Key management 2. TLS 3. Secrets handling

Key management

• Customer-managed keys (CMK) for regulated data when required
• Key policies: least privilege; separate admin vs usage roles
• Enable key rotation and CloudTrail/KMS audit logs
• Document data classification → key tier mapping

TLS

• TLS 1.2 minimum; prefer 1.3
• Automate cert renewal (ACME or internal CA)
• HSTS on public web; strong cipher suites
• Monitor cert expiry 30/14/7 days before

Secrets handling

• Central secret store; no secrets in git or images
• Rotation on schedule and on compromise
• Pre-commit and CI secret scanning
• Inject at runtime via sidecar or platform secret mount

Identity and access engineering

Table of contents

1. Human access 2. Service accounts 3. Privileged access 4. Anti-patterns

Human access

• Single IdP (OIDC/SAML) for workforce apps
• MFA required; phishing-resistant methods for admins
• Group-based RBAC; avoid direct user-to-resource bindings at scale
• Joiner/mover/leaver automation from HR source of truth

Service accounts

• One workload = one identity (no shared “app user”)
• Short-lived credentials via IAM roles / workload identity
• API keys only when unavoidable; stored in secret manager with rotation

Privileged access

• PAM or just-in-time elevation for production admin
• Session recording where required by policy
• Separate admin accounts; no daily-driver admin

Anti-patterns

• Long-lived root/cloud owner keys
• Shared break-glass without monitoring
• Role sprawl with *:* permissions
• SAML/OIDC misconfiguration allowing assertion replay or weak signature validation

Security tooling integration

Table of contents

1. Logging pipeline 2. EDR 3. SOAR

Logging pipeline

source → collector/agent → normalize → SIEM index → detections → ticket/SOAR

• Standardize timestamps (UTC), host, user, action, outcome
• Retention per compliance tier (hot/warm/cold)
• Integrity: restrict who can delete indexes; separate admin roles

EDR

• Deploy to servers and workstations per policy
• Tamper protection enabled
• Test isolation API in non-prod before IR use
• Export telemetry to SIEM for correlation

SOAR

• Automate only low-risk actions (enrichment, ticketing)
• Human approval for containment in production
• Version playbooks; test against recorded alerts
• Rate-limit API calls to avoid vendor lockout

Vulnerability remediation

Table of contents

1. SLA guidance 2. Prioritization 3. Validation

SLA guidance

Compensating controls may extend SLA with documented approval.

Prioritization

Score = severity × asset tier × internet exposure × exploit availability

Deprioritize scanner-only issues without reproduction path.

Validation

• Rescan same asset/build after fix
• For code fixes: merged PR + deployed version tag
• For config: IaC apply + compliance scan green
• Close ticket with evidence link; retest failures reopen

Exception record: CVE ID, reason, compensating control, expiry, approver.