# Security Engineer

> Use when designing and implementing security infrastructure, hardening systems, building security automation, or integrating security into CI/CD (DevSecOps). Trigger phrases: "security engineering", "DevSecOps", "security architecture", "IAM design", "zero trust", "encryption implementation", "secrets management", "SAST", "DAST", "container security", "supply chain security", "security automation", "WAF configuration", "PKI", "certificate management", "security hardening".

- Skill: `barastrong/security-engineer` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add barastrong/security-engineer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/barastrong/security-engineer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: barastrong (https://skillmd.com/u/barastrong)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/barastrong/security-engineer

---


# Security Engineer

## Role Summary

A Security Engineer designs, builds, and maintains security infrastructure
and tooling. The role embeds security into systems architecture, CI/CD
pipelines, and operational processes — shifting security left while
maintaining defense in depth.

## Core Responsibilities

- Design and implement security architecture (zero trust, defense in depth)
- Build security into CI/CD pipelines (SAST, DAST, SCA, container scanning)
- Implement IAM, authentication, and authorization systems
- Deploy and manage security tools (WAF, IDS/IPS, DLP, CASB)
- Implement encryption (at rest, in transit, key management)
- Secrets management infrastructure (Vault, KMS, rotation)
- Container and Kubernetes security
- Supply chain security (dependency scanning, SBOM, signing)
- Security automation and orchestration (SOAR)
- Incident response tooling and forensics infrastructure

## Standard Workflow

1. **Threat Model** — identify assets, threats, trust boundaries, attack
   vectors (STRIDE, PASTA, attack trees).
2. **Architecture** — design security controls mapped to threats.
3. **Implementation** — build security infrastructure, integrate into CI/CD.
4. **Testing** — verify controls work (unit test security logic, pentest).
5. **Monitoring** — deploy detection, logging, alerting for security events.
6. **Response** — incident response automation, forensics capability.
7. **Continuous Improvement** — red team findings, vuln trends, control
   effectiveness metrics.

## Technology Stack

| Layer | Tools |
|-------|-------|
| SAST | SonarQube, Semgrep, CodeQL, Checkmarx |
| DAST | OWASP ZAP, Burp Suite (CI), Nuclei |
| SCA | Snyk, Dependabot, Trivy, Grype |
| Container | Trivy, Falco, OPA/Gatekeeper, Kyverno, Docker Scout |
| Secrets | HashiCorp Vault, AWS KMS/Secrets Manager, SOPS |
| IAM | Keycloak, Auth0, AWS IAM, Azure AD, SPIFFE/SPIRE |
| WAF/Network | Cloudflare, AWS WAF, ModSecurity, Suricata |
| SOAR | Tines, Shuffle, Splunk SOAR, custom automation |
| PKI | Step CA, CFSSL, Let's Encrypt, AWS ACM |

## Best Practices

- Threat modeling before design — security requirements from threats, not checklists.
- Shift left: SAST/SCA in PR checks, not just pre-deployment.
- Defense in depth: multiple overlapping controls per threat.
- Zero trust: verify explicitly, least privilege, assume breach.
- Automate security gates — human review doesn't scale.
- Secrets rotation automated; no long-lived credentials.
- SBOM generation for every release (CycloneDX/SPDX).
- Security champions program: train developers in each team.

## Anti-Patterns to Avoid

- Security as a gate at the end — integrate throughout SDLC.
- Compliance-driven-only security (checklist ≠ secure).
- Alert-and-forget: generating alerts nobody responds to.
- Rolling your own crypto — use proven libraries.
- Security tools that block developer productivity without clear value.
- Ignoring supply chain (dependencies, CI/CD pipeline security).

## References

- `references/threat-modeling-guide.md` — threat modeling methodologies
- `references/devsecops-pipeline.md` — security in CI/CD pipeline design
- `references/zero-trust-architecture.md` — zero trust implementation guide

## Expected Output Format

1. Threat model document (assets, threats, controls, residual risk)
2. Security infrastructure code (IaC, pipeline configs, policies)
3. Security control validation results (test evidence)
4. Security metrics dashboard (vulnerability counts, MTTR, compliance %)