2.3K skills ・ Works with: AWS · sorted by popularity
Analyze AWS IAM access policies with boto3 and Cloudsplaining-style checks to find permissions that could grant greater access. Produces a JSON report linking risky permissions to users or roles, with severity ratings and remediation guidance.
Analyze AWS CloudTrail logs against normal activity patterns to spot unusual API calls, IP addresses, errors, and sensitive changes. Produce a JSON report with anomaly scores, suspicious users, and suggested investigation steps.
Detect unauthorized cryptocurrency mining in cloud workloads by combining billing changes, CPU usage, mining pool connections, and process alerts. Follow workflows to preserve evidence, isolate affected resources, and trace how attackers gained access.
Build automated responses to AWS GuardDuty security findings using EventBridge and Lambda. Configure severity filters, isolate EC2 instances, disable compromised access keys, preserve disk snapshots for investigation, and send notifications to security teams.
Scan code, configuration files, and Git history for exposed AWS credentials with TruffleHog. Checks whether detected keys remain active and guides key replacement, incident investigation, and automated checks before commits and during CI/CD.
Investigate compromised credentials across AWS, Azure, and GCP by correlating security alerts and audit logs. Examines unusual API activity and suspicious sign-ins, helps assess the affected scope, and guides containment actions such as disabling keys and revoking sessions.
Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.
Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.
Set up Cloudflare Access and Tunnel to protect internal applications using user identity and device health checks. Covers application access policies, WARP device enrollment, and audit logging for teams replacing VPN access.
Configure AWS Verified Access for VPN-free access to internal applications. Combine user identity and device security checks, write Cedar access policies, and use Terraform and AWS RAM to deploy and share access controls across AWS accounts.
Deploy Prisma Access to secure access to internal applications for remote users and branches. Configure connectors, GlobalProtect agents, access policies based on user groups and device security, and centralized logging through Strata Cloud Manager.
Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.
Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.
Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.
Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.
Review personal data handling against GDPR requirements, covering processing records, legal grounds, individual rights, breach procedures, and international transfers. Produce findings by article and a prioritized improvement roadmap with responsibilities, estimated costs, and timelines.
Use Intel CHIPSEC to inspect firmware protections, including BIOS write locks and Secure Boot settings. Save test results, extract firmware for offline comparison, and review UEFI variables to investigate configuration weaknesses or suspicious changes.
Audit Terraform infrastructure definitions and planned changes for excessive permissions, public exposure, and missing encryption. Use security scanners and custom rules to produce actionable findings and add automated checks before cloud infrastructure is deployed.
Audit AWS S3 buckets for public exposure, excessive permissions, and gaps in encryption or versioning settings. Use AWS CLI, Prowler, and access analysis to compile findings, prioritize issues, and plan or apply configuration fixes.
Audit AWS, Azure, and GCP configurations against CIS Benchmarks, security configuration guidelines. Use automated scan results to identify failed checks, prioritize fixes, report compliance by area, and establish ongoing monitoring for configuration changes.
Set up and run kube-bench to check Kubernetes configuration against CIS security benchmarks. Select the appropriate benchmark and cluster components, then export JSON or JUnit results for automated pipelines and troubleshoot skipped checks or incorrect detection.
Analyze access logs from AWS S3, GCS, and Azure Blob Storage to spot unusual downloads, unfamiliar IP addresses, and request spikes. Compare activity with normal patterns and prioritize findings for suspected data theft investigations.
Analyze access logs from AWS API Gateway, Kong, and Nginx with pandas, a Python data analysis library. Examine resource access patterns, authentication failures, and suspicious requests to investigate API abuse and inform detection rules.
Build AWS applications with managed services that reduce server administration. Follow patterns for Lambda functions, HTTP APIs, database access, and queued background processing, with guidance on deployment and delays when functions first start.