Offensive Security Analyst
When to Use
- Plan or execute authorized penetration tests, red-team exercises, or exploit validation
- Confirm rules of engagement, in-scope assets, test windows, and emergency stop conditions
- Perform reconnaissance, vulnerability validation, PoC development, and attack-path chaining within scope
- Prioritize exploitable findings by impact and likelihood
- Write remediation-focused offensive security reports and retest plans
When NOT to Use
- Investigate SOC alerts, logs, or suspicious activity →
defensive-security-analyst
- Define security strategy, policy, or GRC program direction →
cybersecurity
- Add CI/CD or supply-chain security controls →
devsecops
- Implement enterprise security tooling and guardrails →
information-security-engineer
- Test LLM prompts, agent tools, or AI jailbreak resistance →
ai-redteam
Related skills
| Need |
Skill |
| CVD intake, embargo, advisory publication |
technical-program-manager-security-cvd |
| Blue-team triage and detections |
defensive-security-analyst |
| Security program, policies, IR program |
cybersecurity |
| Pipeline and supply-chain testing in CI |
devsecops |
| LLM/agent adversarial testing |
ai-redteam |
| Findings documentation for customers |
tech-writer-researcher |
Core Workflows
1. Engagement scope and authorization
Do not test without written authorization.
- Confirm signed SOW/ROE: in-scope assets, methods, windows, contacts
- Define out-of-scope (prod data destruction, social engineering, DoS unless approved)
- Set severity rubric aligned with customer
- Establish emergency stop and escalation path
- Use isolated lab or designated test tenants when possible
See references/engagement_scope.md for ROE checklist and severity rubric.
2. Reconnaissance and enumeration
passive OSINT → asset inventory → service/version ID → auth surface mapping → prioritize targets
Document everything: source, timestamp, tool, raw output hash or path.
See references/recon_enumeration.md for recon phases and asset tracking.
3. Vulnerability assessment and validation
- Run scans appropriate to scope (authenticated where allowed)
- Validate each finding manually—no report-only scanner noise
- Classify: exploitable, conditional, informational
- Map to CWE/CVE and ATT&CK where applicable
- Note compensating controls that block exploitation
See references/vulnerability_assessment.md for validation criteria and false positive filters.
4. Exploitation and attack paths
PoC requirements:
- Minimal steps to demonstrate impact
- Evidence: request/response, screenshot, command output
- Clear preconditions (role, network position, config)
- Stop at agreed impact (e.g., proof of RCE without lateral movement unless scoped)
Chain findings into attack paths: initial access → privilege → objective.
See references/exploitation_chain.md for PoC template and chaining worksheet.
5. Post-exploitation (when in scope)
Only within ROE:
- Credential access proof (hashed, not exfiltrating real secrets unnecessarily)
- Lateral movement to agreed segment
- Data access proof without excessive collection
Document cleanup: accounts created, shells, persistence removed before closeout.
6. Reporting and remediation
Per finding:
| Field |
Content |
| Title |
Business-readable |
| Severity |
Per agreed rubric |
| Description |
What and where |
| Impact |
Confidentiality, integrity, availability |
| Reproduction |
Numbered steps |
| Evidence |
Redacted artifacts |
| Remediation |
Specific fix + validation retest |
Deliver executive summary + technical appendix; schedule retest for critical/high.
See references/reporting_remediation.md for report structure and retest checklist.
When to load references
- Scope, ROE, authorization →
references/engagement_scope.md
- Recon and enumeration →
references/recon_enumeration.md
- Scanning and validation →
references/vulnerability_assessment.md
- PoCs and attack paths →
references/exploitation_chain.md
- Reports and retest →
references/reporting_remediation.md
1---2name: offensive-security-analyst3description: Guides authorized offensive security work—engagement scoping and rules of engagement, reconnaissance, vulnerability validation, exploitation proof-of-concept, attack-path chaining, MITRE ATT&CK mapping, and remediation-focused reporting for pentests and red-team exercises. Use when planning or executing authorized penetration tests, validating findings with reproducible PoCs, prioritizing exploitable issues, simulating adversary TTPs within scope, or writing offensive findings for engineering remediation—not for SOC alert triage (defensive-security-analyst), security program or GRC design (cybersecurity), CI/CD hardening (devsecops), or LLM jailbreak and prompt-injection testing (ai-redteam).4---56# Offensive Security Analyst78## When to Use910- Plan or execute authorized penetration tests, red-team exercises, or exploit validation11- Confirm rules of engagement, in-scope assets, test windows, and emergency stop conditions12- Perform reconnaissance, vulnerability validation, PoC development, and attack-path chaining within scope13- Prioritize exploitable findings by impact and likelihood14- Write remediation-focused offensive security reports and retest plans1516## When NOT to Use1718- Investigate SOC alerts, logs, or suspicious activity → `defensive-security-analyst`19- Define security strategy, policy, or GRC program direction → `cybersecurity`20- Add CI/CD or supply-chain security controls → `devsecops`21- Implement enterprise security tooling and guardrails → `information-security-engineer`22- Test LLM prompts, agent tools, or AI jailbreak resistance → `ai-redteam`2324## Related skills2526| Need | Skill |27|---|---|28| CVD intake, embargo, advisory publication | `technical-program-manager-security-cvd` |29| Blue-team triage and detections | `defensive-security-analyst` |30| Security program, policies, IR program | `cybersecurity` |31| Pipeline and supply-chain testing in CI | `devsecops` |32| LLM/agent adversarial testing | `ai-redteam` |33| Findings documentation for customers | `tech-writer-researcher` |3435## Core Workflows3637### 1. Engagement scope and authorization3839**Do not test without written authorization.**40411. Confirm signed SOW/ROE: in-scope assets, methods, windows, contacts422. Define out-of-scope (prod data destruction, social engineering, DoS unless approved)433. Set severity rubric aligned with customer444. Establish emergency stop and escalation path455. Use isolated lab or designated test tenants when possible4647**See `references/engagement_scope.md` for ROE checklist and severity rubric.**4849### 2. Reconnaissance and enumeration5051```52passive OSINT → asset inventory → service/version ID → auth surface mapping → prioritize targets53```5455**Document everything:** source, timestamp, tool, raw output hash or path.5657**See `references/recon_enumeration.md` for recon phases and asset tracking.**5859### 3. Vulnerability assessment and validation60611. Run scans appropriate to scope (authenticated where allowed)622. **Validate** each finding manually—no report-only scanner noise633. Classify: exploitable, conditional, informational644. Map to CWE/CVE and ATT&CK where applicable655. Note compensating controls that block exploitation6667**See `references/vulnerability_assessment.md` for validation criteria and false positive filters.**6869### 4. Exploitation and attack paths7071**PoC requirements:**7273- Minimal steps to demonstrate impact74- Evidence: request/response, screenshot, command output75- Clear preconditions (role, network position, config)76- Stop at agreed impact (e.g., proof of RCE without lateral movement unless scoped)7778Chain findings into **attack paths**: initial access → privilege → objective.7980**See `references/exploitation_chain.md` for PoC template and chaining worksheet.**8182### 5. Post-exploitation (when in scope)8384Only within ROE:8586- Credential access proof (hashed, not exfiltrating real secrets unnecessarily)87- Lateral movement to agreed segment88- Data access proof without excessive collection8990Document cleanup: accounts created, shells, persistence removed before closeout.9192### 6. Reporting and remediation9394**Per finding:**9596| Field | Content |97|---|---|98| Title | Business-readable |99| Severity | Per agreed rubric |100| Description | What and where |101| Impact | Confidentiality, integrity, availability |102| Reproduction | Numbered steps |103| Evidence | Redacted artifacts |104| Remediation | Specific fix + validation retest |105106Deliver executive summary + technical appendix; schedule retest for critical/high.107108**See `references/reporting_remediation.md` for report structure and retest checklist.**109110## When to load references111112- **Scope, ROE, authorization** → `references/engagement_scope.md`113- **Recon and enumeration** → `references/recon_enumeration.md`114- **Scanning and validation** → `references/vulnerability_assessment.md`115- **PoCs and attack paths** → `references/exploitation_chain.md`116- **Reports and retest** → `references/reporting_remediation.md`
daemon-blockint-tech