Senior Security

Senior Security Engineer

The agent performs STRIDE threat analysis with DREAD risk scoring, designs defense-in-depth security architectures with Zero Trust principles, conducts secure code reviews against OWASP Top 10, and scans codebases for hardcoded secrets across 20+ credential patterns.

Core Capabilities

• Threat modeling — STRIDE per-element analysis, DREAD risk scoring, DFD creation, attack trees, and mitigation mapping.
• Security architecture — defense-in-depth layering, Zero Trust, authentication pattern selection (OAuth/OIDC, JWT, mTLS, FIDO2), and encryption strategy.
• Vulnerability assessment — automated (SAST/DAST/dependency/secret) plus manual testing, OWASP Top 10 mapping, severity classification, and remediation tracking.
• Secure code review — auth/authz, data handling, and crypto review with a checklist and secure-vs-insecure pattern catalog.
• Incident response — triage, containment, eradication, recovery, post-mortem, with severity tiers and runbook checklist.
• Secret detection — secret_scanner.py finds 20+ credential patterns (AWS/GCP/Azure, GitHub/Slack/Stripe, private keys); CI/CD-ready exit codes.
• Compliance mapping — OWASP ASVS, CIS Benchmarks, NIST CSF, PCI-DSS, HIPAA, SOC 2 at the application layer.

When to Use

• Conducting a threat model or attack-surface analysis on a system or component.
• Reviewing code for vulnerabilities before deployment.
• Designing a secure, defense-in-depth or Zero Trust architecture.
• Scanning a codebase for hardcoded secrets and credentials.
• Running a vulnerability assessment or planning incident response.

Clarify First

Before the threat model or scan, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Target component/system — what to threat-model or scan (--component; defines the STRIDE analysis scope)
• Assets & trust boundaries — what is being protected and where untrusted input enters (drives DREAD scoring and mitigations)
• Task — threat model / code vuln review / secret scan / incident-response plan (selects the tool and the output)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Tools

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

• references/security-workflows.md — the 5 full workflows (threat modeling, security architecture, vulnerability assessment, secure code review, incident response) with all decision matrices (STRIDE, OWASP Top 10, severity, code-review checklist), the security tools catalog, compliance frameworks, security headers, anti-patterns, troubleshooting table, and success criteria. Read when executing any security workflow.
• references/threat-modeling-guide.md — STRIDE methodology, attack trees, DREAD scoring, DFD creation, threat templates. Read when building a threat model.
• references/security-architecture-patterns.md — Zero Trust, defense-in-depth, authentication patterns (OAuth/PKCE, JWT, MFA), API security, data protection, secret management. Read when designing secure architecture.
• references/cryptography-implementation.md — AES-GCM, ChaCha20, RSA, Ed25519, password hashing (Argon2/bcrypt), HMAC, key management/rotation, HSM integration, common crypto mistakes. Read when implementing or reviewing cryptography.
• references/tool-reference.md — full flag tables, usage examples, and output formats for threat_modeler.py and secret_scanner.py. Read when running the bundled scripts.