AI Coding Assistants 1
▼
Understands basic GitHub Copilot usage for security work: leveraging suggestions for security scanner scripts, using Copilot Chat for secure coding pattern questions, critically reviewing completions for security-sensitive code. Follows team guidelines for evaluating AI-generated code for vulnerability risks.
Independently configures GitHub Copilot for security workflows: crafts prompts for security scanning scripts, evaluates completions for vulnerability patterns and false positives, uses Copilot Chat for threat modeling assistance. Understands trade-offs between AI-assisted coding speed and security review thoroughness.
Designs GitHub Copilot security governance for development teams: implements security review processes for AI-generated code, configures Copilot content exclusion for sensitive repositories, evaluates AI-generated code for vulnerability introduction risks. Mentors team on secure AI-assisted development practices.
Defines GitHub Copilot security strategy at the product level: establishes security review requirements for AI-generated code, designs vulnerability scanning integration for Copilot outputs, drives adoption of secure AI-assisted development practices across engineering teams.
Algorithms & Data Structures 2
▼
Understands basic algorithmic concepts for AppSec: simple pattern matching for vulnerability detection, basic hash comparison for integrity checks, sorting findings by risk level. Follows team guidance on algorithm selection for security scanning scripts.
Independently applies algorithmic thinking in security: evaluates pattern matching algorithm efficiency for scanners, understands graph traversal for permission analysis, selects appropriate hashing algorithms for integrity checks. Analyzes computational complexity of security scanning operations.
Applies algorithmic thinking to security analysis: pattern matching algorithms for vulnerability scanning, graph traversal for attack path analysis, hashing algorithms for integrity verification. Evaluates cryptographic algorithm strength and identifies algorithmic weaknesses in authentication systems.
Defines standards for Algorithms and Complexity usage at the team/product level. Conducts architectural reviews. Creates best practices and training materials for the entire team.
Understands basic data structures for application security: vulnerability record formats, finding lists, configuration structures for SAST/DAST tools. Follows team conventions for organizing security scan configurations and vulnerability tracking data.
Independently selects appropriate data structures for security tools: hash sets for IP/domain blocklists, lookup tables for vulnerability signatures, tree structures for permission hierarchies. Understands trade-offs between data structure choices for scan performance vs memory usage.
Selects optimal data structures for security applications: bloom filters for threat intelligence lookup, trie structures for URL pattern matching, hash sets for rapid IOC detection. Optimizes data structures in SAST/DAST tools for minimal scan overhead. Designs efficient storage for vulnerability correlation and deduplication.
Defines Data Structures usage standards at the team/product level. Conducts architectural reviews. Creates best practices and training materials for the entire team.
API Gateway & Service Communication 1
▼
Knows fundamental webhook security risks including replay attacks and payload tampering. Can verify HMAC signatures on incoming webhook payloads using standard libraries. Understands the importance of HTTPS-only endpoints and basic input validation for webhook receivers. Identifies common SSRF vectors in webhook configurations.
Implements comprehensive webhook security controls including timestamp-based replay protection, constant-time HMAC comparison, and IP allowlisting. Conducts security reviews of webhook endpoint implementations to identify SSRF vulnerabilities and injection risks. Designs payload verification schemes with rotating secrets and versioned signature algorithms.
Defines organization-wide webhook security standards covering endpoint hardening, secret management lifecycle, and threat modeling for event-driven architectures. Architects defense-in-depth strategies against SSRF through URL validation, DNS rebinding protection, and network segmentation. Leads incident response for webhook-related security breaches and designs automated abuse detection systems.
Drives webhook security policy across the engineering organization, integrating security requirements into CI/CD pipelines and API governance frameworks. Evaluates emerging threats to webhook infrastructure and updates security controls proactively. Builds security champion programs focused on secure webhook implementation patterns and conducts cross-team training on SSRF prevention and payload integrity.
API Management 1
▼
Uses Postman and curl to send basic API requests and verify security headers (CORS, CSP, X-Frame-Options). Understands REST API structure and can identify missing authentication on endpoints. Follows checklists to test common API vulnerabilities from OWASP API Top 10.
Conducts systematic API security testing using Burp Suite and custom Postman scripts. Tests for BOLA/IDOR, mass assignment, rate limiting bypass, and JWT manipulation. Analyzes OpenAPI specs to map attack surface and identify unprotected or overly permissive endpoints. Automates repetitive security checks with collection runners.
Architects API security testing strategies across microservice ecosystems. Builds custom Burp Suite extensions and security testing frameworks for automated detection of OWASP API Top 10 vulnerabilities. Designs API gateway security policies and validates mTLS, token scoping, and rate limiting implementations. Mentors team on API threat modeling and secure API design review practices.
Defines API strategy at the product level. Establishes design standards. Conducts API design reviews. Coordinates cross-team API interactions.
Application Security 5
▼
Understands basic Dependency Vulnerability Scanning concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Independently configures and maintains SCA tools (Snyk, Dependabot, Trivy) across multiple repositories. Analyzes transitive dependency trees to assess real exploitability of reported CVEs. Understands trade-offs between auto-merge policies for patch updates and manual review for major version bumps. Integrates dependency scanning into CI/CD pipelines with appropriate break-build thresholds.
Designs organization-wide dependency scanning architecture integrating Snyk, Dependabot, and container image scanners like Trivy and Grype. Conducts threat modeling of the software supply chain, covering package registries, lock file integrity, and typosquatting risks. Implements SBOM generation (CycloneDX, SPDX) as part of the SDLC to meet regulatory compliance requirements. Mentors engineers on evaluating vulnerability exploitability using CVSS contextual scoring and reachability analysis.
Defines the team-wide dependency scanning strategy, selecting and standardizing SCA tools (Snyk, Dependabot, Trivy) across all product lines. Establishes vulnerability remediation SLA policies with escalation paths based on CVSS, EPSS, and business impact. Coordinates incident response for zero-day dependency vulnerabilities such as Log4Shell-class events. Trains engineering teams on secure dependency management, license compliance, and SBOM adoption.
Understands basic OWASP and application security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Applies OWASP Top 10 and application security practices to secure development workflows. Conducts security-focused code reviews identifying injection, authentication, and access control vulnerabilities. Uses SAST/DAST tools (SonarQube, Burp Suite, OWASP ZAP) for automated vulnerability scanning and triage.
Designs enterprise application security programs aligned with OWASP frameworks — implements secure development lifecycle practices, threat modeling methodologies, and automated security pipeline integration. Conducts architectural-level threat modeling for complex systems. Mentors team on security architecture patterns and vulnerability root cause analysis.
Defines application security strategy aligned with OWASP frameworks across product portfolios. Establishes security policies for secure SDLC, vulnerability management SLAs, and security training programs. Coordinates cross-team incident response for application security breaches and trains development teams on threat modeling.
Understands basic SAST/DAST concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Configures and runs SAST/DAST tools to identify vulnerabilities in application code and running services. Conducts security code reviews using static analysis findings as input. Triages scanner results, eliminates false positives, and tracks confirmed issues to resolution.
Designs security solutions with SAST/DAST. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines organization-wide SAST/DAST strategy and tool selection standards. Establishes security scanning policies, quality gates, and remediation SLAs for development teams. Coordinates vulnerability response across products when critical scanner findings arise. Trains engineers on effective SAST/DAST adoption.
Understands basic Secure Coding Practices concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Applies secure coding practices in application security workflows — conducts in-depth security code reviews identifying injection, authentication, and cryptographic weaknesses. Uses SAST tools (Semgrep, CodeQL) for automated vulnerability detection and develops custom security rules for organization-specific risk patterns.
Designs enterprise secure coding programs — implements security-by-design frameworks, creates organization-specific secure coding standards, and integrates automated security validation into CI/CD pipelines. Conducts architectural threat modeling and mentors development teams on writing defensive code against emerging attack vectors.
Defines enterprise secure coding strategy across all development teams. Establishes security policies for SDLC integration, secure coding standards adoption, and automated security gate enforcement. Coordinates cross-team incident response for code-level security vulnerabilities and trains development teams on security-first coding culture.
Understands basic Threat Modeling concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Independently conducts threat modeling sessions for application components using STRIDE methodology. Builds data flow diagrams and identifies trust boundaries. Prioritizes threats using DREAD or risk matrices. Integrates threat modeling into SDLC gates and tracks remediation of identified risks.
Designs threat modeling frameworks tailored to the organization's tech stack and risk profile. Integrates automated threat analysis into CI/CD pipelines (IaC scanning, dependency threat assessment). Mentors development teams on continuous threat modeling practices. Establishes threat libraries and reusable patterns for microservice architectures.
Defines threat modeling strategy at team and product level. Establishes mandatory threat modeling gates in the development lifecycle. Coordinates cross-team threat assessments for shared infrastructure and API boundaries. Builds a threat modeling culture by training product teams and integrating threat analysis into sprint planning and architecture reviews.
Authentication & Authorization 2
▼
Understands basic JWT / OAuth2 / OIDC concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Validates JWT/OAuth2 implementations in applications: reviews token validation logic, audits OAuth2 flow configurations for security weaknesses, and tests for common JWT attacks (algorithm confusion, claim injection). Conducts security code reviews focusing on authentication middleware. Uses tools like jwt.io and Burp Suite for token analysis.
Designs security solutions with JWT / OAuth2 / OIDC. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines application security standards for authentication across the organization. Establishes JWT/OAuth2 security review checklists, secure coding guidelines for token handling, and authentication architecture review processes. Drives adoption of centralized identity management. Trains security champions on authentication vulnerability detection.
Understands basic RBAC / ABAC authorization concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Implements RBAC and ABAC authorization models in application security reviews. Conducts code reviews focused on access control logic and permission enforcement. Uses static analysis tools to detect authorization bypass vulnerabilities in application code.
Designs security solutions with RBAC / ABAC authorization. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines organization-wide RBAC/ABAC authorization strategy and access control standards. Establishes security policies for role hierarchies and attribute-based access decisions. Coordinates authorization incident response across products. Trains teams on secure authorization design patterns.
CI/CD 1
▼
Understands basic GitHub Actions for security work: running SAST/DAST scans in CI pipelines, reading security scan results from workflow outputs, understanding action configurations for security tools. Follows team conventions for security scanning pipeline integration.
Independently creates GitHub Actions workflows for security: configures SAST/DAST/SCA scanning pipelines, implements secret detection and dependency audit steps, automates security compliance checks in CI. Manages security-focused CI/CD configurations.
Designs CI/CD security architecture: implements security scanning pipeline optimization for speed and coverage, designs progressive security gates across deployment stages, architects supply chain security controls in CI/CD. Mentors team on DevSecOps pipeline best practices.
Defines DevSecOps strategy with GitHub Actions: establishes CI/CD security standards across teams, implements platform-level security scanning integration, drives adoption of supply chain security controls in all deployment pipelines.
Compliance 3
▼
Understands basic GDPR / 152-FZ Compliance concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Applies GDPR/152-FZ compliance in application security: conducts privacy-focused code reviews, implements data minimization checks, and validates consent management flows. Uses SAST tools to detect PII exposure and logging violations.
Designs privacy-by-design architecture aligned with GDPR/152-FZ: data classification systems, automated PII discovery, and pseudonymization pipelines. Implements privacy threat modeling (LINDDUN) and conducts compliance audits of application stacks.
Defines GDPR/152-FZ compliance strategy for application security: establishes privacy review processes, data processing agreement templates, and breach notification procedures. Coordinates DPO collaboration and cross-team privacy training.
Understands core PCI DSS requirements for cardholder data protection. Follows secure coding guidelines aligned with PCI standards. Recognizes common application vulnerabilities that may lead to PCI compliance violations in codebases.
Applies PCI DSS requirements when reviewing application security architecture. Conducts security code reviews focused on cardholder data handling and encryption. Uses vulnerability scanning tools to verify PCI compliance across services.
Designs application security solutions ensuring full PCI DSS compliance. Conducts threat modeling for payment processing workflows. Integrates PCI-focused security checks into CI/CD pipelines and SDLC. Mentors developers on secure cardholder data handling.
Defines organizational PCI DSS compliance strategy for application security. Establishes security policies and standards for cardholder data environments. Coordinates incident response for PCI-related breaches. Trains engineering teams on PCI requirements and secure development.
Understands basic SOC2 Compliance concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Implements SOC 2 security controls in application architecture: access logging, encryption at rest/in transit, and vulnerability management. Conducts security code reviews aligned with Trust Services Criteria.
Designs security solutions with SOC2 Compliance. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines SOC 2 compliance strategy for application security: establishes secure SDLC policies, incident response procedures, and continuous monitoring requirements. Coordinates with auditors on technical control validation.
Container Security 1
▼
Understands basic container security scanning concepts: image vulnerability scanning with Trivy/Grype, base image selection. Uses pre-configured scanning pipelines and follows team guidelines for addressing critical CVEs in container images.
Independently configures and manages Container Security Scanning. Writes IaC for typical tasks. Understands networking and security basics.
Designs container security scanning architecture with multi-layer vulnerability detection: base image, application dependencies, and runtime behavior. Implements SBOM generation, policy-as-code enforcement, and automated remediation workflows for container supply chain.
Defines container security scanning strategy and governance framework. Establishes vulnerability management SLAs, scanning coverage requirements, and exception handling processes. Coordinates container security standards across development and platform teams.
Containerization 1
▼
Understands basic Docker concepts for security work: containerized security scanning tools, Docker images for vulnerability assessment environments, basic docker-compose for isolated testing labs. Uses ready-made configurations for security tooling containers.
Independently configures Docker for security work: containerized SAST/DAST scanning environments, docker-compose for isolated vulnerability testing labs, Dockerfile hardening practices. Understands container security scanning, image vulnerability assessment, and network isolation for security tooling.
Designs Docker infrastructure with security focus: container image vulnerability scanning pipelines, runtime security monitoring, Dockerfile hardening standards. Implements best practices for supply chain security, distroless base images, and container isolation for sensitive workloads.
Defines Docker security strategy: container image supply chain governance, runtime security monitoring standards, container hardening and compliance frameworks. Conducts architecture reviews for container security posture and establishes vulnerability scanning SLAs.
Git & Workflows 1
▼
Understands basic Git advanced features for security work: bisect for finding vulnerability-introducing commits, blame for tracing security-sensitive code changes, signed commits for audit trails. Follows team conventions for security-related branching and tagging.
Independently uses Git advanced features for security workflows: automated security checks via Git hooks (pre-commit secret scanning), bisect for efficient vulnerability root cause analysis, reflog for incident investigation and recovery. Understands trade-offs between different branching models for secure SDLC compliance.
Designs Git security workflows for development teams: implements commit signing infrastructure and verification policies, configures advanced pre-commit hooks for SAST/secret scanning, designs branch protection strategies for compliance requirements. Mentors team on secure Git practices and incident response through version history.
Defines Git security strategy for the product: establishes commit signing policies and verification workflows, designs repository security scanning pipelines, drives adoption of secure branching and access control patterns across development teams.
Incident Response 3
▼
Understands basic Digital Forensics concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Applies digital forensics techniques to investigate application security incidents. Collects and preserves application logs, memory dumps, and network captures maintaining chain of custody. Uses forensic tools (Volatility, Autopsy) to analyze artifacts from compromised web applications.
Designs security solutions with Digital Forensics Basics. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines forensic readiness strategy for application security ensuring logging, monitoring, and evidence collection capabilities are built into systems by design. Establishes forensic investigation playbooks and trains teams on evidence handling procedures for application-layer incidents.
Understands basic Incident Response Process concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Participates in application security incident response following established playbooks. Triages security alerts related to application vulnerabilities (SQLi, XSS, SSRF). Collects application logs and artifacts for investigation and communicates findings to the incident commander clearly.
Designs security solutions with Incident Response Process. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines application-specific incident response strategy including detection rules, response playbooks, and communication protocols. Establishes application security monitoring standards to reduce mean time to detection. Coordinates cross-team incident response drills focused on application-layer attack scenarios.
Understands basic Vulnerability Management concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Manages vulnerability lifecycle from discovery to remediation in application environments. Conducts security code reviews to validate and classify identified vulnerabilities. Uses vulnerability scanners and tracking tools to maintain accurate inventory of application security issues.
Designs security solutions with Vulnerability Management. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines organization-wide vulnerability management strategy for application security. Establishes remediation policies, SLAs, and escalation procedures for critical vulnerabilities. Coordinates cross-team vulnerability response and drives adoption of shift-left practices. Trains engineering teams on vulnerability lifecycle management.
Infrastructure Security 4
▼
Understands basic Cloud Infrastructure Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Applies cloud security principles to application workloads. Conducts security reviews of cloud-native apps using CSPM tools. Performs container image scanning and serverless function analysis to identify misconfigurations and vulnerabilities in deployment pipelines.
Designs security solutions with Cloud Infrastructure Security. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines cloud application security strategy incorporating CSPM, container security, and serverless protection standards. Establishes security policies for cloud-native development workflows. Coordinates incident response for application-layer cloud breaches and trains teams on secure cloud coding practices.
Understands basic Kubernetes Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Applies Kubernetes security practices to containerized applications including pod security standards, network policies, and RBAC configurations. Scans container images for vulnerabilities using Trivy or Snyk. Reviews Kubernetes manifests for security misconfigurations and hardening compliance.
Designs security solutions with Kubernetes Security. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines Kubernetes security standards for the organization including admission control policies, image signing requirements, and supply chain security. Establishes OPA/Gatekeeper policy libraries for application workloads. Coordinates security reviews of cluster architectures and trains development teams on secure Kubernetes patterns.
Understands basic Network Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Independently configures and audits network security controls protecting application infrastructure: WAF rules, reverse proxy hardening, TLS certificate management. Analyzes network traffic for signs of application-layer attacks (SQLi over HTTP, SSRF, DNS exfiltration). Integrates IDS/IPS alerts with application security monitoring workflows.
Designs security solutions with Network Security. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines team-level network security strategy for application environments: standardizes WAF policies, establishes network segmentation requirements for microservice deployments, and drives adoption of zero-trust network access for internal services. Coordinates with infrastructure teams on IDS/IPS tuning and ensures network security controls are integrated into CI/CD pipelines and deployment workflows.
Understands basic Secrets Management concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Integrates secrets management into application security workflows: scans codebases for hardcoded secrets (TruffleHog, git-secrets), reviews Vault policies for least-privilege access, and validates secret rotation procedures. Conducts security code reviews focusing on credential handling patterns.
Designs application security architecture for secrets management: secure secret injection patterns, runtime credential protection, and secret-aware CI/CD pipelines. Implements secret detection in SAST/DAST tooling. Conducts threat modeling for secret exposure vectors across application stack. Mentors team on secure credential handling patterns and vault integration best practices.
Defines application security standards for secrets management across the organization. Establishes secret scanning policies, credential handling guidelines, and incident response procedures for secret compromise. Drives adoption of centralized secrets management and zero-trust credential patterns. Trains security champions on secrets-related threat modeling.
Logging 2
▼
Understands the fundamentals of ELK Stack (Elasticsearch, Logstash, Kibana). Reads security-related logs in Kibana, applies basic KQL queries to filter events. Follows team guidelines for log ingestion pipelines and index naming conventions.
Configures ELK Stack pipelines for application security monitoring. Builds Logstash filters to parse WAF, RASP, and DAST tool outputs. Creates Kibana dashboards for vulnerability trend analysis and OWASP Top 10 coverage. Sets up Elasticsearch alerts for suspicious patterns such as injection attempts and privilege escalation.
Designs observability strategy with ELK Stack. Implements distributed tracing. Defines SLIs/SLOs. Conducts post-mortems.
Defines product observability strategy. Establishes SLO-based approach. Coordinates incident management. Optimizes MTTD/MTTR.
Understands basic structured logging for security work: security event logging formats and standards, audit trail logging requirements, reading structured logs for security incident detection. Follows team conventions for security-relevant logging patterns and compliance requirements.
Configures structured logging for security monitoring: implements security event logging pipelines, creates SIEM dashboards for threat detection, sets up alerts for suspicious activity patterns. Participates in security incident response using log-based forensics.
Designs security observability strategy: implements advanced security event correlation and threat detection pipelines, defines SLIs/SLOs for security monitoring effectiveness, conducts post-mortems for security incidents with forensic log analysis. Mentors team on security logging best practices and detection engineering.
Defines security observability strategy at the product level: establishes SLO-based approach for security monitoring coverage, coordinates security incident management and response processes, optimizes MTTD/MTTR for security events through improved detection pipelines.
Networking 1
▼
Understands HTTP/HTTPS, DNS basics, TCP vs UDP. Knows what ports, IP addresses, and localhost are. Can use curl for API testing.
Understands the TCP/IP stack. Configures TLS/SSL. Works with load balancers and reverse proxies (nginx). Understands DNS resolution and TTL. Debugs network issues (tcpdump, wireshark basics).
Designs network security architecture for production application environments — VPC network segmentation, zero-trust micro-segmentation, and WAF rule engineering. Configures service mesh security policies with mTLS and authorization rules. Understands gRPC/HTTP2/HTTP3 security implications and designs DNS security strategies including DNSSEC. Optimizes network-level security controls for application performance.
REST API 1
▼
Understands basic REST API concepts from security perspective: common API vulnerabilities (IDOR, broken auth), API authentication mechanisms, OWASP API Security Top 10 basics. Follows team conventions for security testing of API endpoints.
Independently reviews REST API security: authentication/authorization implementation review, input validation for API endpoints, rate limiting and abuse prevention patterns. Understands best practices for API security testing and OWASP API Security Top 10 mitigation.
Designs API security architecture: API gateway security patterns, OAuth2/OIDC integration for API authentication, rate limiting and abuse prevention at scale. Defines API security standards and conducts API threat modeling. Mentors team on secure API design principles.
Defines API security strategy at product level: API security standards and compliance requirements, API threat modeling governance, security testing integration for API CI/CD. Conducts API security architecture reviews and establishes vulnerability management for APIs.
Supply Chain Security 1
▼
Understands basic Supply Chain Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.
Applies SBOM and supply chain security practices in CI/CD pipelines: integrates SCA tools (Snyk, Grype, Trivy), enforces license policies, and automates vulnerability patching workflows. Conducts security reviews of dependency trees and evaluates third-party component risks for production applications.
Designs security solutions with Supply Chain Security. Conducts threat modeling. Implements security practices in SDLC. Mentors the team.
Defines supply chain security strategy: establishes SBOM generation standards, SCA tool governance, and dependency management policies across the organization. Coordinates incident response for supply chain compromises. Trains development teams on secure dependency practices and SLSA framework adoption.
Technical Documentation 1
▼
Understands the purpose of runbooks and playbooks for security incident response. Follows existing runbooks during incidents, documenting steps taken. Assists in maintaining runbook repositories and updating known procedure changes.
Independently writes runbooks for application security incident response: vulnerability disclosure handling, SAST/DAST alert triage, dependency vulnerability remediation. Understands trade-offs between automation and manual steps in security playbooks.
Designs comprehensive runbook frameworks for application security operations: secure SDLC incident response, zero-day vulnerability handling, supply chain compromise playbooks. Mentors team members on writing effective, actionable security runbooks with proper escalation matrices.
Defines runbook strategy for the application security program: standardizes playbook templates across security teams, establishes runbook review and update cadences, integrates runbook metrics into security KPIs. Drives adoption of executable runbooks with SOAR platform integration.