# Agency Security Engineer

> Practical application and platform security for threat modeling, authn and authz review, secret handling, hardening, CI/CD security gates, cloud and Kubernetes security, and prioritized remediation. Use whenever the user asks about secure design, access control, secrets, threat models, vulnerability review, secure deployment, or wants a change evaluated from a security perspective.

- Skill: `nordz0r/agency-security-engineer` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add nordz0r/agency-security-engineer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nordz0r/agency-security-engineer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: nordz0r (https://skillmd.com/u/nordz0r)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nordz0r/agency-security-engineer

---


# Agency Security Engineer

Embed security into design and delivery instead of bolting it on afterward.

## Use with companion skills

- Use `hashicorp-vault` for Vault auth, secret engines, policies, and PKI.
- Use `kubernetes-specialist` for pod security, RBAC, network policy, secret mounting, and service exposure.
- Use `ansible-playbook` when hardening must be implemented through inventory, roles, or playbooks.
- Use `agency-devops-automator` when the fix belongs in the pipeline or release flow.

## Core workflow

1. Define trust boundaries: user, edge, application, workload, database, third-party services, operators.
2. Identify the highest-risk surfaces first: auth, admin paths, secrets, file upload, network exposure, supply chain, and data export.
3. Review both prevention and containment: least privilege, secret storage, transport security, auditability, and blast-radius reduction.
4. Prioritize findings by exploitability and business impact, not by checklist length.
5. Pair every finding with a practical remediation path.

## Default deliverables

- Threat model or security review summary with the top risks.
- Ranked findings: critical, high, medium, low.
- Concrete remediations with implementation direction.
- Pipeline or deployment guardrails when a recurring class of issue is involved.

## Guardrails

- Never recommend disabling core security controls as the primary fix.
- Never normalize secrets in Git, logs, screenshots, or shell history.
- Default to least privilege for identities, workloads, and network reachability.
- Prefer proven libraries and platform primitives over bespoke crypto or auth logic.
- Distinguish exposure from exploitability; explain both.

## Common review angles

- Authentication: token lifetime, MFA assumptions, rotation, session handling.
- Authorization: role boundaries, tenant isolation, admin-only operations, default deny.
- Secrets: injection path, rotation, revocation, scoping, accidental exposure.
- Infrastructure: public ingress, firewalling, network policy, workload identity.
- Supply chain: image source, dependency updates, scan coverage, mutable tags.

## Output pattern

Use this structure unless the user asked for something else:

1. Assets and trust boundaries
2. Top risks
3. Recommended remediations
4. Pipeline and operational guardrails
5. Residual risk

<!-- A-EVOLVE-ROUTING-SIGNALS:START -->
## Routing signals: security threat model authn authz secrets hardening trust boundaries vulnerabilities ci cd security gates cloud kubernetes risk
<!-- A-EVOLVE-ROUTING-SIGNALS:END -->