Senior Security Engineer

Security engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing.

---

Table of Contents

• - Threat Modeling Workflow
• Security Architecture Workflow
• Vulnerability Assessment Workflow
• Secure Code Review Workflow
• Incident Response Workflow
• Security Tools Reference
• Tools and References

---

Threat Modeling Workflow

Identify and analyze security threats using STRIDE methodology.

Workflow: Conduct Threat Model

1. 1. Define system scope and boundaries:

- Identify assets to protect - Map trust boundaries - Document data flows

1. 2. Create data flow diagram:

- External entities (users, services) - Processes (application components) - Data stores (databases, caches) - Data flows (APIs, network connections)

1. 3. Apply STRIDE to each DFD element (see STRIDE per Element Matrix below)
2. Score risks using DREAD:

- Damage potential (1-10) - Reproducibility (1-10) - Exploitability (1-10) - Affected users (1-10) - Discoverability (1-10)

1. 5. Prioritize threats by risk score
2. Define mitigations for each threat
3. Document in threat model report
4. Validation: All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped

STRIDE Threat Categories

Category	Security Property	Mitigation Focus
Spoofing	Authentication	MFA, certificates, strong auth
Tampering

Integrity | Signing, checksums, validation | | Repudiation | Non-repudiation | Audit logs, digital signatures | | Information Disclosure | Confidentiality | Encryption, access controls | | Denial of Service | Availability | Rate limiting, redundancy | | Elevation of Privilege | Authorization | RBAC, least privilege |

STRIDE per Element Matrix

DFD Element	S	T	R	I	D	E
External Entity	X		X
Process

X | X | X | X | X | X | | Data Store | | X | X | X | X | | | Data Flow | | X | | X | X | |

See: references/threat-modeling-guide.md

---

Security Architecture Workflow

Design secure systems using defense-in-depth principles.

Workflow: Design Secure Architecture

1. 1. Define security requirements:

- Compliance requirements (GDPR, HIPAA, PCI-DSS) - Data classification (public, internal, confidential, restricted) - Threat model inputs

1. 2. Apply defense-in-depth layers:

- Perimeter: WAF, DDoS protection, rate limiting - Network: Segmentation, IDS/IPS, mTLS - Host: Patching, EDR, hardening - Application: Input validation, authentication, secure coding - Data: Encryption at rest and in transit

1. 3. Implement Zero Trust principles:

- Verify explicitly (every request) - Least privilege access (JIT/JEA) - Assume breach (segment, monitor)

1. 4. Configure authentication and authorization:

- Identity provider selection - MFA requirements - RBAC/ABAC model

1. 5. Design encryption strategy:

- Key management approach - Algorithm selection - Certificate lifecycle

1. 6. Plan security monitoring:

- Log aggregation - SIEM integration - Alerting rules

1. 7. Document architecture decisions
2. Validation: Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned

Defense-in-Depth Layers

CODEBLOCK0

Authentication Pattern Selection

Use Case	Recommended Pattern
Web application	OAuth 2.0 + PKCE with OIDC
API authentication

JWT with short expiration + refresh tokens | | Service-to-service | mTLS with certificate rotation | | CLI/Automation | API keys with IP allowlisting | | High security | FIDO2/WebAuthn hardware keys |

See: references/security-architecture-patterns.md

---

Vulnerability Assessment Workflow

Identify and remediate security vulnerabilities in applications.

Workflow: Conduct Vulnerability Assessment

1. 1. Define assessment scope:

- In-scope systems and applications - Testing methodology (black box, gray box, white box) - Rules of engagement

1. 2. Gather information:

- Technology stack inventory - Architecture documentation - Previous vulnerability reports

1. 3. Perform automated scanning:

- SAST (static analysis) - DAST (dynamic analysis) - Dependency scanning - Secret detection

1. 4. Conduct manual testing:

- Business logic flaws - Authentication bypass - Authorization issues - Injection vulnerabilities

1. 5. Classify findings by severity:

- Critical: Immediate exploitation risk - High: Significant impact, easier to exploit - Medium: Moderate impact or difficulty - Low: Minor impact

1. 6. Develop remediation plan:

- Prioritize by risk - Assign owners - Set deadlines

1. 7. Verify fixes and document
2. Validation: Scope defined; automated and manual testing complete; findings classified; remediation tracked

For OWASP Top 10 vulnerability descriptions and testing guidance, refer to owasp.org/Top10.

Vulnerability Severity Matrix

Impact \ Exploitability	Easy	Moderate	Difficult
Critical	Critical	Critical	High
High

Critical | High | Medium | | Medium | High | Medium | Low | | Low | Medium | Low | Low |

---

Secure Code Review Workflow

Review code for security vulnerabilities before deployment.

Workflow: Conduct Security Code Review

1. 1. Establish review scope:

- Changed files and functions - Security-sensitive areas (auth, crypto, input handling) - Third-party integrations

1. 2. Run automated analysis:

- SAST tools (Semgrep, CodeQL, Bandit) - Secret scanning - Dependency vulnerability check

1. 3. Review authentication code:

- Password handling (hashing, storage) - Session management - Token validation

1. 4. Review authorization code:

- Access control checks - RBAC implementation - Privilege boundaries

1. 5. Review data handling:

- Input validation - Output encoding - SQL query construction - File path handling

1. 6. Review cryptographic code:

- Algorithm selection - Key management - Random number generation

1. 7. Document findings with severity
2. Validation: Automated scans passed; auth/authz reviewed; data handling checked; crypto verified; findings documented

Security Code Review Checklist

Category	Check	Risk
Input Validation	All user input validated and sanitized	Injection
Output Encoding

Context-appropriate encoding applied | XSS | | Authentication | Passwords hashed with Argon2/bcrypt | Credential theft | | Session | Secure cookie flags set (HttpOnly, Secure, SameSite) | Session hijacking | | Authorization | Server-side permission checks on all endpoints | Privilege escalation | | SQL | Parameterized queries used exclusively | SQL injection | | File Access | Path traversal sequences rejected | Path traversal | | Secrets | No hardcoded credentials or keys | Information disclosure | | Dependencies | Known vulnerable packages updated | Supply chain | | Logging | Sensitive data not logged | Information disclosure |

Secure vs Insecure Patterns

Pattern	Issue	Secure Alternative
SQL string formatting	SQL injection	Use parameterized queries with placeholders
Shell command building

Command injection | Use subprocess with argument lists, no shell | | Path concatenation | Path traversal | Validate and canonicalize paths | | MD5/SHA1 for passwords | Weak hashing | Use Argon2id or bcrypt | | Math.random for tokens | Predictable values | Use crypto.getRandomValues |

Inline Code Examples

SQL Injection — insecure vs. secure (Python):

CODEBLOCK1

Password Hashing with Argon2id (Python):

CODEBLOCK2

Secret Scanning — core pattern matching (Python):

CODEBLOCK3

---

Incident Response Workflow

Respond to and contain security incidents.

Workflow: Handle Security Incident

1. 1. Identify and triage:

- Validate incident is genuine - Assess initial scope and severity - Activate incident response team

1. 2. Contain the threat:

- Isolate affected systems - Block malicious IPs/accounts - Disable compromised credentials

1. 3. Eradicate root cause:

- Remove malware/backdoors - Patch vulnerabilities - Update configurations

1. 4. Recover operations:

- Restore from clean backups - Verify system integrity - Monitor for recurrence

1. 5. Conduct post-mortem:

- Timeline reconstruction - Root cause analysis - Lessons learned

1. 6. Implement improvements:

- Update detection rules - Enhance controls - Update runbooks

1. 7. Document and report
2. Validation: Threat contained; root cause eliminated; systems recovered; post-mortem complete; improvements implemented

Incident Severity Levels

Level	Response Time	Escalation
P1 - Critical (active breach/exfiltration)	Immediate	CISO, Legal, Executive
P2 - High (confirmed, contained)

1 hour | Security Lead, IT Director | | P3 - Medium (potential, under investigation) | 4 hours | Security Team | | P4 - Low (suspicious, low impact) | 24 hours | On-call engineer |

Incident Response Checklist

Phase	Actions
Identification	Validate alert, assess scope, determine severity
Containment

Isolate systems, preserve evidence, block access | | Eradication | Remove threat, patch vulnerabilities, reset credentials | | Recovery | Restore services, verify integrity, increase monitoring | | Lessons Learned | Document timeline, identify gaps, update procedures |

---

Security Tools Reference

Recommended Security Tools

Category	Tools
SAST	Semgrep, CodeQL, Bandit (Python), ESLint security plugins
DAST

OWASP ZAP, Burp Suite, Nikto | | Dependency Scanning | Snyk, Dependabot, npm audit, pip-audit | | Secret Detection | GitLeaks, TruffleHog, detect-secrets | | Container Security | Trivy, Clair, Anchore | | Infrastructure | Checkov, tfsec, ScoutSuite | | Network | Wireshark, Nmap, Masscan | | Penetration | Metasploit, sqlmap, Burp Suite Pro |

Cryptographic Algorithm Selection

Use Case	Algorithm	Key Size
Symmetric encryption	AES-256-GCM	256 bits
Password hashing

Argon2id | N/A (use defaults) | | Message authentication | HMAC-SHA256 | 256 bits | | Digital signatures | Ed25519 | 256 bits | | Key exchange | X25519 | 256 bits | | TLS | TLS 1.3 | N/A |

See: references/cryptography-implementation.md

---

Tools and References

Scripts

Script	Purpose
threatmodeler.py	STRIDE threat analysis with DREAD risk scoring; JSON and text output; interactive guided mode
secretscanner.py

Detect hardcoded secrets and credentials across 20+ patterns; CI/CD integration ready |

For usage, see the inline code examples in Secure Code Review Workflow and the script source files directly.

References

Document	Content
security-architecture-patterns.md	Zero Trust, defense-in-depth, authentication patterns, API security
threat-modeling-guide.md

STRIDE methodology, attack trees, DREAD scoring, DFD creation | | cryptography-implementation.md | AES-GCM, RSA, Ed25519, password hashing, key management |

---

Security Standards Reference

Security Headers Checklist

Header	Recommended Value
Content-Security-Policy	default-src self; script-src self
X-Frame-Options

DENY | | X-Content-Type-Options | nosniff | | Strict-Transport-Security | max-age=31536000; includeSubDomains | | Referrer-Policy | strict-origin-when-cross-origin | | Permissions-Policy | geolocation=(), microphone=(), camera=() |

For compliance framework requirements (OWASP ASVS, CIS Benchmarks, NIST CSF, PCI-DSS, HIPAA, SOC 2), refer to the respective official documentation.

---

Related Skills

Skill	Integration Point
senior-devops	CI/CD security, infrastructure hardening
senior-secops

Security monitoring, incident response |
| senior-backend | Secure API development |
| senior-architect | Security architecture decisions |