libre-secops

Detection engineering and threat hunting: Sigma and YARA rules with SIEM translations, detection-as-code, and hypothesis-driven hunts mapped to MITRE ATT&CK.

2 skills · 2 commands · 2 agents

Methodology for authorized bug bounty programs: scope-respecting reconnaissance, attack surface mapping, and vulnerability reports that triagers can reproduce.

2 skills · 2 commands · 2 agents

Compliance assessment, gap analysis, and audit evidence planning for SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, and NIST frameworks.

2 skills · 2 commands · 2 agents

Container security for Docker and Podman: Dockerfile and Compose hardening, image vulnerability scanning with SBOMs, and runtime isolation.

2 skills · 2 commands · 2 agents

Security-integrated CI/CD: pipeline security architecture, SAST, SCA, secrets, IaC, and container scanning in GitHub Actions, GitLab CI, and Jenkins, and build-breaking security gates.

2 skills · 2 commands · 2 agents

Digital forensics for authorized investigations: investigation planning, chain of custody, disk and artifact analysis, timelines, and memory forensics with Volatility.

2 skills · 2 commands · 2 agents

Identity and access management: IAM architecture, SSO and MFA design, RBAC/ABAC/ReBAC access control models, authentication flow review, and access audits.

2 skills · 2 commands · 2 agents

Kubernetes security: cluster hardening, RBAC audits, Pod Security Standards, NetworkPolicy, and admission control with Gatekeeper or Kyverno.

2 skills · 2 commands · 2 agents

Defensive malware analysis for incident responders: triage, static and sandbox-based dynamic analysis in an isolated lab, IOC extraction, and detection signatures.

2 skills · 2 commands · 2 agents

Mobile application security for Android and iOS: OWASP MASVS/MASTG assessments, secure code review, hardening checklists, and mobile crypto patterns.

2 skills · 2 commands · 2 agents

Privacy engineering: privacy by design, GDPR data protection impact assessments, personal data flow mapping, and technical privacy controls.

2 skills · 2 commands · 2 agents

Adversary simulation planning for authorized red and purple team engagements: rules of engagement, MITRE ATT&CK mapping, and detection validation.

2 skills · 2 commands · 2 agents

Secrets management: leaked secret detection, vault architecture with HashiCorp Vault and cloud secret managers, secret injection, and credential rotation.

2 skills · 2 commands · 2 agents

Secure coding: security-focused code review, injection prevention, secure authentication and session patterns, and targeted vulnerability fixes.

2 skills · 2 commands · 2 agents

Security awareness training and policy: role-based training, authorized phishing simulations for an organization's own staff, and plain-language security policies mapped to regulations.

2 skills · 2 commands · 2 agents

SIEM and log management: SIEM architecture and log source planning, detection and hunting queries in Splunk SPL, Elastic KQL/EQL, and Sentinel KQL, and cross-source event correlation.

2 skills · 2 commands · 2 agents

Social engineering defense: analysis of phishing, BEC, vishing, and physical pretexts, organizational exposure assessments, layered technical and human controls, and awareness programs.

2 skills · 2 commands · 2 agents

Threat modeling with STRIDE, attack trees, DREAD risk ranking, and MITRE ATT&CK mapping that turns a design into ranked threats with concrete mitigations.

3 skills · 1 command · 2 agents

Defensive AWS security: IAM, S3, VPC, KMS, and logging architecture reviews, CIS and Well-Architected compliance audits, and hardening patterns.

2 skills · 1 command · 2 agents

Cryptography guidance: algorithm and parameter selection, password hashing, key management and rotation, TLS configuration, and crypto code audits.

2 skills · 1 command · 2 agents

Security incident response: incident command and coordination, forensic evidence handling, playbooks for common incident types, and blameless postmortems.

1 skill · 2 commands · 2 agents

Network security: firewall rules, segmentation and trust zones, IDS/IPS with Suricata, Snort, and Zeek, VPN review, and network audits.

2 skills · 1 command · 2 agents

Penetration testing methodology for authorized assessments: scoping and rules of engagement, attack surface mapping, test planning, and risk-rated vulnerability analysis.

1 skill · 2 commands · 2 agents

Security orchestration, automation, and response (SOAR): platform selection, playbook design, and working automation for alert enrichment, phishing triage, and containment with human approval gates.

2 skills · 1 command · 2 agents

System hardening and CIS Benchmark assessment for Linux and Windows hosts, containers, Kubernetes, web servers, databases, and cloud accounts, with implementation and verification steps.

1 skill · 2 commands · 2 agents

Software supply chain security: dependency vulnerability and license audits, SBOM generation, and detection of typosquatting, dependency confusion, and compromised packages.

2 skills · 1 command · 2 agents

Vulnerability scanning and triage for systems you own or are authorized to assess: scanner selection across SAST, SCA, container, IaC, cloud, and secrets, plus CVSS and exploitability-based prioritization.

1 skill · 2 commands · 2 agents

Zero trust architecture: NIST SP 800-207 design, CISA maturity assessments, and microsegmentation with network policies, service mesh authorization, and workload identity.

2 skills · 1 command · 2 agents

API security assessment for REST, GraphQL, gRPC, and WebSocket interfaces against the OWASP API Security Top 10, including authentication flow audits and secure auth patterns.

1 skill · 1 command · 2 agents

Defensive Azure security: Entra ID, Conditional Access, RBAC, networking, storage, and Key Vault reviews, plus CIS Azure and Microsoft Cloud Security Benchmark audits.

1 skill · 1 command · 2 agents

Defensive Google Cloud security: IAM and Workload Identity, Organization Policies, VPC Service Controls, and CIS GCP benchmark audits.

1 skill · 1 command · 2 agents

Web application security: OWASP Top 10 (2021) source code audits and cross-site scripting analysis with context-correct fixes for common web frameworks.

1 skill · 1 command · 2 agents

Optional security hooks: a one-line security profile of the project at session start, a confirmation prompt before Claude edits secret or key files, and a local pattern scan for vulnerabilities after each edit.

hooks