Senior Security Engineer

The agent performs STRIDE threat analysis with DREAD risk scoring, designs defense-in-depth security architectures with Zero Trust principles, conducts secure code reviews against OWASP Top 10, and scans codebases for hardcoded secrets across 20+ credential patterns.

Table of Contents

• Threat Modeling Workflow
• Security Architecture Workflow
• Vulnerability Assessment Workflow
• Secure Code Review Workflow
• Incident Response Workflow
• Security Tools Reference
• Tools and References

Threat Modeling Workflow

Identify and analyze security threats using STRIDE methodology.

Workflow: Conduct Threat Model

1. Define system scope and boundaries:
   • Identify assets to protect
   • Map trust boundaries
   • Document data flows
2. Create data flow diagram:
   • External entities (users, services)
   • Processes (application components)
   • Data stores (databases, caches)
   • Data flows (APIs, network connections)
3. Apply STRIDE to each DFD element:
   • Spoofing: Can identity be faked?
   • Tampering: Can data be modified?
   • Repudiation: Can actions be denied?
   • Information Disclosure: Can data leak?
   • Denial of Service: Can availability be affected?
   • Elevation of Privilege: Can access be escalated?
4. Score risks using DREAD:
   • Damage potential (1-10)
   • Reproducibility (1-10)
   • Exploitability (1-10)
   • Affected users (1-10)
   • Discoverability (1-10)
5. Prioritize threats by risk score
6. Define mitigations for each threat
7. Document in threat model report
8. Validation: All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped

STRIDE Threat Categories

STRIDE per Element Matrix

See: references/threat-modeling-guide.md

Security Architecture Workflow

Design secure systems using defense-in-depth principles.

Workflow: Design Secure Architecture

1. Define security requirements:
   • Compliance requirements (GDPR, HIPAA, PCI-DSS)
   • Data classification (public, internal, confidential, restricted)
   • Threat model inputs
2. Apply defense-in-depth layers:
   • Perimeter: WAF, DDoS protection, rate limiting
   • Network: Segmentation, IDS/IPS, mTLS
   • Host: Patching, EDR, hardening
   • Application: Input validation, authentication, secure coding
   • Data: Encryption at rest and in transit
3. Implement Zero Trust principles:
   • Verify explicitly (every request)
   • Least privilege access (JIT/JEA)
   • Assume breach (segment, monitor)
4. Configure authentication and authorization:
   • Identity provider selection
   • MFA requirements
   • RBAC/ABAC model
5. Design encryption strategy:
   • Key management approach
   • Algorithm selection
   • Certificate lifecycle
6. Plan security monitoring:
   • Log aggregation
   • SIEM integration
   • Alerting rules
7. Document architecture decisions
8. Validation: Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned

Defense-in-Depth Layers

Layer 1: PERIMETER
  WAF, DDoS mitigation, DNS filtering, rate limiting

Layer 2: NETWORK
  Segmentation, IDS/IPS, network monitoring, VPN, mTLS

Layer 3: HOST
  Endpoint protection, OS hardening, patching, logging

Layer 4: APPLICATION
  Input validation, authentication, secure coding, SAST

Layer 5: DATA
  Encryption at rest/transit, access controls, DLP, backup

Authentication Pattern Selection

See: references/security-architecture-patterns.md

Vulnerability Assessment Workflow

Identify and remediate security vulnerabilities in applications.

Workflow: Conduct Vulnerability Assessment

1. Define assessment scope:
   • In-scope systems and applications
   • Testing methodology (black box, gray box, white box)
   • Rules of engagement
2. Gather information:
   • Technology stack inventory
   • Architecture documentation
   • Previous vulnerability reports
3. Perform automated scanning:
   • SAST (static analysis)
   • DAST (dynamic analysis)
   • Dependency scanning
   • Secret detection
4. Conduct manual testing:
   • Business logic flaws
   • Authentication bypass
   • Authorization issues
   • Injection vulnerabilities
5. Classify findings by severity:
   • Critical: Immediate exploitation risk
   • High: Significant impact, easier to exploit
   • Medium: Moderate impact or difficulty
   • Low: Minor impact
6. Develop remediation plan:
   • Prioritize by risk
   • Assign owners
   • Set deadlines
7. Verify fixes and document
8. Validation: Scope defined; automated and manual testing complete; findings classified; remediation tracked

OWASP Top 10 Mapping

Vulnerability Severity Matrix

Secure Code Review Workflow

Review code for security vulnerabilities before deployment.

Workflow: Conduct Security Code Review

1. Establish review scope:
   • Changed files and functions
   • Security-sensitive areas (auth, crypto, input handling)
   • Third-party integrations
2. Run automated analysis:
   • SAST tools (Semgrep, CodeQL, Bandit)
   • Secret scanning
   • Dependency vulnerability check
3. Review authentication code:
   • Password handling (hashing, storage)
   • Session management
   • Token validation
4. Review authorization code:
   • Access control checks
   • RBAC implementation
   • Privilege boundaries
5. Review data handling:
   • Input validation
   • Output encoding
   • SQL query construction
   • File path handling
6. Review cryptographic code:
   • Algorithm selection
   • Key management
   • Random number generation
7. Document findings with severity
8. Validation: Automated scans passed; auth/authz reviewed; data handling checked; crypto verified; findings documented

Security Code Review Checklist

Secure vs Insecure Patterns

Incident Response Workflow

Respond to and contain security incidents.

Workflow: Handle Security Incident

1. Identify and triage:
   • Validate incident is genuine
   • Assess initial scope and severity
   • Activate incident response team
2. Contain the threat:
   • Isolate affected systems
   • Block malicious IPs/accounts
   • Disable compromised credentials
3. Eradicate root cause:
   • Remove malware/backdoors
   • Patch vulnerabilities
   • Update configurations
4. Recover operations:
   • Restore from clean backups
   • Verify system integrity
   • Monitor for recurrence
5. Conduct post-mortem:
   • Timeline reconstruction
   • Root cause analysis
   • Lessons learned
6. Implement improvements:
   • Update detection rules
   • Enhance controls
   • Update runbooks
7. Document and report
8. Validation: Threat contained; root cause eliminated; systems recovered; post-mortem complete; improvements implemented

Incident Severity Levels

Incident Response Checklist

Security Tools Reference

Recommended Security Tools

Cryptographic Algorithm Selection

See: references/cryptography-implementation.md

Tools and References

Scripts

python threat_modeler.py --component "Authentication"

python secret_scanner.py /path/to/project

Threat Modeler Features:

• STRIDE analysis for any system component
• DREAD risk scoring
• Mitigation recommendations
• JSON and text output formats
• Interactive mode for guided analysis

Secret Scanner Features:

• Detects AWS, GCP, Azure credentials
• Finds API keys and tokens (GitHub, Slack, Stripe)
• Identifies private keys and passwords
• Supports 20+ secret patterns
• CI/CD integration ready

References

Security Standards Reference

Compliance Frameworks

Security Headers Checklist

Related Skills

Anti-Patterns

• Security by obscurity -- hiding endpoints or using non-standard ports is not a control; implement authentication, authorization, and encryption
• MD5/SHA1 for password hashing -- both are broken for this purpose; use Argon2id or bcrypt with cost factor >= 12
• Math.random for tokens -- predictable values allow session hijacking; use

  crypto.getRandomValues()

  or

  secrets.token_hex()

• Shell=True in subprocess -- enables command injection; use argument lists with

  subprocess.run(["cmd", "arg"])

• Threat model without data flow diagram -- STRIDE analysis requires DFD elements to be systematic; skip the DFD and you miss entire attack surfaces
• Accepted risks without review cadence -- DREAD scores drift as systems evolve; re-validate accepted risks every 90 days

Troubleshooting

--severity critical

file_extensions

.conf

.env

.yml

COMPONENT_MAPPING

COMPONENT_MAPPING

threat_modeler.py

Success Criteria

• Zero critical- or high-severity secrets detected by

  secret_scanner.py

  across the entire codebase before every release.
• Threat model coverage above 90%: every component in the data flow diagram has a completed STRIDE analysis with documented mitigations.
• All OWASP Top 10 vulnerability categories addressed in the security architecture with at least one compensating control per category.
• Mean time to remediate critical vulnerabilities under 48 hours from discovery to verified fix.
• 100% of authentication and authorization code paths reviewed with the Secure Code Review Checklist before merge.
• Incident response exercises (tabletop or simulated) conducted at least quarterly with post-mortem documentation.
• DREAD risk scores for all remaining accepted risks reviewed and re-validated every 90 days.

Scope & Limitations

This skill covers:

• Application-level security: threat modeling, secure code review, secret detection, and vulnerability assessment for web applications and APIs.
• Security architecture design: defense-in-depth layering, Zero Trust patterns, authentication/authorization model selection, and encryption strategy.
• Incident response planning: severity classification, containment procedures, post-mortem frameworks, and runbook creation.
• Compliance mapping: OWASP ASVS, CIS Benchmarks, NIST CSF, PCI-DSS, HIPAA, and SOC 2 alignment at the application layer.

This skill does NOT cover:

• Infrastructure and cloud security hardening (see senior-devops and aws-solution-architect).
• Runtime security monitoring, SIEM rule authoring, and SOC operations (see senior-secops).
• Full regulatory compliance programs, audit evidence collection, and certification processes (see ra-qm-team).
• Network penetration testing tooling, red team operations, and physical security assessments.

Integration Points

Tool Reference

threat_modeler.py

Purpose: Performs STRIDE threat analysis on system components with DREAD risk scoring, mitigation recommendations, and structured reporting.

Usage:

python threat_modeler.py --component "User Authentication"
python threat_modeler.py --component "API Gateway" --assets "user_data,tokens" --json
python threat_modeler.py --component "Database" --output report.txt
python threat_modeler.py --interactive
python threat_modeler.py --list-threats

Flags:

--component

-c

--interactive

--list-threats

--assets

-a

--json

--interactive

-i

--list-threats

-l

--output

-o

Example:

$ python threat_modeler.py --component "API Gateway" --json --output api-threats.json
Report written to api-threats.json

Output Formats:

• Text (default): Structured report grouped by STRIDE category with risk scores, DREAD ratings, attack vectors, and mitigations.
• JSON (

  --json

  ): Machine-readable object containing

  component

  ,

  analysis_date

  ,

  summary

  (counts by risk level), and

  threats

  array with full DREAD breakdown per threat.

secret_scanner.py

Purpose: Detects hardcoded secrets, API keys, credentials, and private keys in source code. Supports 20+ secret patterns across cloud providers (AWS, GCP, Azure), authentication tokens (GitHub, GitLab, Slack, Stripe, Twilio, SendGrid), cryptographic keys, and generic credential patterns. Exits with code 1 when critical or high findings are present, making it CI/CD-ready.

Usage:

python secret_scanner.py /path/to/project
python secret_scanner.py /path/to/file.py
python secret_scanner.py /path/to/project --format json --output report.json
python secret_scanner.py /path/to/project --severity critical
python secret_scanner.py --list-patterns

Flags:

path

--list-patterns

--format

-f

text

json

text

--output

-o

--list-patterns

-l

--severity

-s

critical

high

medium

low

Example:

$ python secret_scanner.py ./src --severity high --format json
{
  "target": "./src",
  "scan_date": "2026-03-21T10:30:00",
  "summary": { "total": 2, "by_severity": { "critical": 1, "high": 1, "medium": 0, "low": 0 } },
  "findings": [ ... ]
}

Output Formats:

• Text (default): Severity-grouped report showing pattern ID, file path with line number, masked match text, and remediation recommendation.
• JSON (

  --format json

  ): Machine-readable object with

  target

  ,

  scan_date

  ,

  summary

  (counts by severity), and

  findings

  array. Each finding includes

  pattern_id

  ,

  name

  ,

  severity

  ,

  file_path

  ,

  line_number

  ,

  matched_text

  (masked), and

  recommendation

  .