Security

Hardens serverless compute platforms (AWS Lambda, Azure Functions, Google Cloud Functions) by enforcing least privilege IAM roles, eliminating hardcoded secrets, scanning dependencies for vulnerabilities, validating input, securing function URLs, and enabling runtime monitoring.

Identify and exploit Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during authorized security assessments.

Build a structured SOC escalation matrix defining severity tiers, response SLAs, escalation paths, and notification procedures for security incidents.

Deploy Llama Guard, NeMo Guardrails, and LLM Guard as runtime input/output scanners to block jailbreaks, prompt injection, and toxic content in production LLM applications.

Detect and prevent public-over-private name resolution in npm, PyPI, and Maven dependency manifests.

Discover and inventory undocumented API endpoints by comparing live traffic against OpenAPI specs, scanning code repositories, and analyzing cloud configurations.

Generate CycloneDX and SPDX SBOMs from container images and filesystems, scan them for vulnerabilities with Grype, and sign attestations with Cosign for supply-chain trust.

Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.

Executes a structured ransomware incident response from initial detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening.

Simulates VLAN hopping attacks using switch spoofing and double tagging techniques in authorized environments to test VLAN segmentation effectiveness and validate switch port security configurations against Layer 2 bypass attacks.

Tests WebSocket API implementations for security vulnerabilities including missing authentication, Cross-Site WebSocket Hijacking, injection attacks, and denial-of-service.

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns.

Detect kernel-level rootkits in Linux memory dumps using Volatility3 plugins and live system scanners to identify hooked syscalls, hidden modules, and tampered structures.

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic using the OWASP API Security Top 10 framework.

Configure Hardware Security Modules (HSMs) using the PKCS#11 standard interface for key generation, signing, encryption, and key management with both physical HSMs and SoftHSM2 for development.

Detect and respond to unauthorized cryptocurrency mining in AWS and Azure environments using cost anomalies, compute utilization, network traffic analysis, and runtime monitoring.

Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades, abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM.

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.

Hunt for Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons where Kerberos is expected, and correlating with credential dumping indicators.

Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.

Analyze proxy logs, DNS query logs, and netflow data to detect unauthorized SaaS and cloud service usage, classify domains, and flag high-risk services.

Detect sophisticated cyber-physical attacks that modify PLC logic while spoofing sensor readings, covering PLC integrity monitoring, process anomaly detection, and multi-stage attack chain detection.

Map AWS and Azure attack paths and find exploitable misconfigurations with CloudFox.

Identify and exploit Insecure Direct Object Reference vulnerabilities during authorized penetration tests by manipulating object identifiers in API requests and URLs.

Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.

Deploy a Velociraptor server and agents, then write and execute VQL hunts across a fleet of endpoints for threat hunting and incident response.

Configure Okta as a SAML 2.0 Identity Provider and implement SP-initiated and IdP-initiated SSO flows with attribute mapping, assertion encryption, and security hardening.

Guides the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to establish or mature a CTI program.

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization.

Enumerate Active Directory service accounts, request Kerberos TGS tickets, and crack them offline to assess password strength and privilege escalation paths.

Coordinates purple team exercises by running MITRE ATT&CK-mapped attack scenarios with real-time detection testing and collaborative gap remediation.

Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy in authorized environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms.

Secure Helm chart deployments by validating chart integrity, scanning templates for misconfigurations, and enforcing security contexts in Kubernetes releases.

Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to demonstrate client-side code execution, session hijacking, and user impersonation.

Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis.