Test design, vulnerability assessment, and quality assurance (13K skills)
Assess iOS and Android app security using OWASP MASTG, a mobile security testing guide. Examine app files, runtime behavior, stored data, authentication, and API traffic, then document vulnerabilities, their impact, and suggested fixes.
Plan tiered administration for Active Directory by separating administrative accounts and systems into three levels. Cover dedicated administration workstations, authentication restrictions, and verification checks to help limit credential theft and the spread of compromise.
Analyze malicious JavaScript from phishing pages, payment data theft scripts, and malware downloaders. Unwrap encoded strings and nested execution layers to reveal hidden behavior, identify stolen data fields, and document suspicious destinations for incident response.
Plan authorized spearphishing simulations, personalized phishing tests aimed at specific people. Prepare scenarios and email infrastructure, track delivery and participant responses, and document findings to assess email security controls and improve security awareness.
Plan and measure defensive deception operations with MITRE Engage. Connect decoy systems and credentials to specific attacker techniques, define measurable objectives, and document operating boundaries, response procedures, and criteria for assessing results.
Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.
Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.
Deploy CrowdStrike Falcon sensors across Windows, macOS, and Linux endpoints. Configure threat prevention and response policies, verify installation and detection, troubleshoot sensor issues, and connect events to SIEM platforms, which collect security logs for analysis.
Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.
Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.
Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.
Build a two-tier certificate authority with OpenSSL and Python, separating the offline root from the issuing authority. Covers server and client certificates, revocation checks, and policies that define certificate usage and trust.
Configure Windows security logs for threat detection and incident investigation. Covers detailed audit policies, process command line recording, log storage sizing, and centralized forwarding so monitoring systems receive useful authentication and activity records.
Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.
Set up repeatable security tests for LLM apps with Promptfoo and DeepTeam. Connect them to automated build pipelines, detect renewed vulnerabilities to malicious instructions or data leakage, and compare results across model or prompt changes.
Simulate man-in-the-middle attacks, where traffic is intercepted between communicating systems, in authorized environments. Use Bettercap, Ettercap, and mitmproxy to test encryption enforcement, certificate validation, and network detection, then document findings and recommendations.
Investigate reported phishing emails by checking sender details, links, and attachments. Identify affected recipients and exposed login credentials, guide removal of malicious messages across the organization, and secure compromised accounts with password resets and session revocation.
Analyze RAM dumps with Volatility 3 to investigate suspicious processes, network connections, injected code, and credential theft. Guides memory capture and evidence extraction, then organizes findings into a forensic report for incident response.
Deploy and configure Snort 3 to detect suspicious network traffic. Create custom detection rules, tune community rules to reduce false alerts, test them against captured traffic, and forward alerts to a central security monitoring platform.
Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.
Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.
Guide a structured review after a security incident, using timelines and response data to identify root causes and process gaps. Produce review notes, response metrics, and practical improvements with named owners and deadlines.
Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.
Configure cryptographic key storage and operations through PKCS#11, a standard interface for security devices. Work with physical HSMs or SoftHSM2 for development to generate keys, sign data, encrypt information, and check key export restrictions.