Results for “cisa-framework”

Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.

Integrates SAST, DAST, and SCA security scanning into CI/CD pipelines using open-source tools like Semgrep, Trivy, OWASP ZAP, and Gitleaks.

Applies the PCI-DSS framework to identify, assess, and mitigate security risks in systems, processes, and data handling.

Assess and implement the CISA Zero Trust Maturity Model v2.0 across identity, devices, networks, applications, and data pillars to achieve progressive zero trust maturity.

Conduct a maturity assessment against the NIST Cybersecurity Framework (CSF) 2.0, using Implementation Tiers to measure organizational cybersecurity posture and create improvement roadmaps.

Designs and documents structured incident response playbooks aligned with NIST SP 800-61r3 and SANS PICERL frameworks, covering playbook structure, decision trees, escalation criteria, RACI matrices, and SOAR integration.

Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.

Implement continuous identity verification for zero trust using phishing-resistant MFA (FIDO2/WebAuthn), risk-based conditional access, and identity governance aligned with the CISA Zero Trust Maturity Model.

Orchestrates multi-framework compliance programs by selecting applicable frameworks, mapping control overlaps, simulating audits, and consolidating evidence checklists.

Design Security Operations Centers with processes. TRIGGERS - Use when user needs help with soc-design related tasks.

Chief Security Officer mode. (gstack)

Build a SCIM 2.0-compliant API server and integrate it with Okta for automated user provisioning, deprovisioning, profile updates, and group management.

Performs free, open-source reverse engineering with Ghidra using headless or GUI modes, including decompilation, cross-references, and optional MCP workflows when IDA is unavailable.

Automates security and compliance checks using OPA policies, Trivy vulnerability scanning, AWS CIS benchmark verification, and Kubernetes remediation scripts.

Assess software supply chain security by generating SBOMs, scanning dependencies, auditing CI/CD pipelines, analyzing container images, and verifying vulnerability reachability.

Applies the SOC 2 framework to identify, assess, and mitigate security risks in systems, processes, and data handling.

Applies the California Consumer Privacy Act framework to identify, assess, and mitigate security risks in systems, processes, and data handling.

Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection.