Infrastructure as Code Agent Skills

Designs and implements VLAN-based network segmentation on managed switches to isolate network zones, enforce access control between segments, and reduce the attack surface by limiting lateral movement paths in enterprise network environments.

Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms.

Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements.

Design and enforce microsegmentation policies using workload identity and label-based rules to prevent lateral movement in zero trust architectures, with guidance for tools like VMware NSX, Illumio, and Calico.

Deploy Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager.

Audit Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.

Build a two-tier PKI hierarchy (Root CA + Intermediate CA) using OpenSSL and Python, including certificate issuance, CRL distribution, OCSP responder configuration, and certificate policy management.

Map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads using Akamai Guardicore Segmentation.

Design and implement network segmentation for industrial control systems using the Purdue Enterprise Reference Architecture model, separating OT and IT networks into hierarchical security zones with strict traffic control.

Assesses organizational readiness for post-quantum cryptography migration per NIST FIPS 203/204/205 standards, performs cryptographic inventory scanning, evaluates hybrid TLS configurations, and validates CRYSTALS-Kyber and CRYSTALS-Dilithium readiness.

Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation. Generates server and client configuration files with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, and reliable queue settings for high-availability syslog infrastructure.

Configure and deploy HashiCorp Boundary for identity-aware zero trust infrastructure access with dynamic credential brokering, session recording, and Vault integration.

Automates the full lifecycle of SSL/TLS certificates—requesting, issuing, deploying, monitoring, renewing, and revoking—using Python and ACME protocol tools.

Design and deploy IEC 62443-compliant conduit architecture for secure OT remote access, including jump servers, MFA gateways, session recording, and approval-based workflows for vendor and engineer access to industrial control systems.

Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy for zero-trust pod-to-pod communication.

Deploy Zero Trust Network Access using Zscaler Private Access (ZPA) to replace traditional VPN with identity-based, context-aware access to private applications through the Zscaler Zero Trust Exchange.

Automates security scanning for Infrastructure as Code templates using Checkov, tfsec, and KICS to detect misconfigurations before deployment.

Deploy and configure Suricata as a network intrusion prevention system with custom rules, Emerging Threats rulesets, and inline traffic inspection for real-time threat blocking.

Design and evolve engineering team structures for fast flow of change using the Team Topologies framework, including Conway's law, four team types, three interaction modes, and cognitive load management.

Creates Dockerfiles, configures CI/CD pipelines, writes Kubernetes manifests, and generates Terraform/Pulumi infrastructure templates for deployment automation, GitOps, and incident response.

Implement infrastructure as code with Terraform across AWS, Azure, or GCP, including module development, state management, provider configuration, multi-environment workflows, and infrastructure testing.

Orchestrates Gemini 3 Flash to audit Linux Kernel patches for memory safety, detect cost drifts in Terraform plans, and generate hardened Kubernetes security contexts.

Runs KICS to scan infrastructure-as-code files for security vulnerabilities and compliance issues.

Scaffolds AWS CDK projects and manages the CDK CLI installation for Node.js and Python environments.

Generates production-ready Terraform files for AWS infrastructure, writing complete .tf files for any cloud architecture without deploying.

Generates production-grade Kubernetes manifests including Deployments with probes and security contexts, Services, Ingress with TLS, HPA, PDB, NetworkPolicy, ConfigMaps, and Secrets, with optional Helm charts, Kustomize overlays, Istio mesh, and ArgoCD GitOps.

Generates modular Terraform infrastructure-as-code for AWS, GCP, or Azure, including VPC, compute, database, cache, CDN, and monitoring with per-environment sizing, remote state, and cost estimates.

Diseña infraestructura cloud como código con Terraform, cubriendo AWS, GCP y Azure, incluyendo arquitecturas serverless, VPC, bases de datos administradas y optimización de costos.

Diagnoses Linux server issues across CPU, memory, disk, I/O, and network, and manages systemd services, SSH, and Fail2Ban on Ubuntu, Debian, and AlmaLinux.

Automates repetitive infrastructure and deployment tasks with Terraform, OpenTofu, Ansible, GitHub Actions, and n8n, enforcing safe practices like plan review and confirmation before applying changes.

Avoid common Ansible mistakes covering YAML syntax traps, variable precedence, idempotence failures, and handler gotchas.

Designs and implements CI/CD pipelines, infrastructure automation, and workflow optimization to reduce manual tasks.

Manages AWS infrastructure across EC2, S3, Lambda, RDS, IAM, CloudFormation, and cost optimization, with guidance on security, monitoring, and operational best practices.

Manages Azure operations including Virtual Machines, App Service, Azure Functions, AKS, Cosmos DB, and Azure AD identity, with guidance on infrastructure as code and operational best practices.

Provisions and manages Azure cloud services for Flutter backends, including AKS clusters, Azure Functions, SQL databases, Cosmos DB, Blob Storage, and Key Vault.

Define and provision cloud infrastructure declaratively with Terraform, including reusable modules for Kubernetes clusters, databases, storage, and networking.