AI Coding Assistants 1
▼
Understands basic GitHub Copilot usage for security analysis: leveraging suggestions for log analysis scripts, using Copilot Chat for SIEM rule syntax questions, critically reviewing completions for detection rule logic. Follows team guidelines for responsible AI use in security monitoring tooling.
Independently configures GitHub Copilot for security analysis workflows: crafts prompts for detection rule development and log parsing scripts, evaluates completions for false positive risks in security logic, uses Copilot Chat for incident analysis support. Understands trade-offs between AI-assisted development speed and security rule accuracy.
Designs GitHub Copilot governance for security teams: implements policies for AI use in detection rule development, configures content controls for sensitive security repositories, evaluates AI-generated security code for accuracy and false positive risks. Mentors team on responsible AI-assisted security tooling development.
Defines GitHub Copilot security governance at the product level: establishes security review requirements for AI-assisted development across teams, designs compliance frameworks for AI code generation tools, drives adoption of secure AI development practices in security-sensitive domains.
Algorithms & Data Structures 1
▼
Understands basic algorithmic concepts for security operations: simple log search patterns, basic alert filtering and sorting, linear scan through IOC lists. Follows team guidance on algorithm selection for detection rule writing.
Independently applies algorithmic thinking in SecOps: evaluates log search and correlation algorithms, selects pattern matching strategies for threat detection, understands anomaly detection algorithm behavior. Analyzes complexity of SIEM query operations and alert processing pipelines.
Applies algorithmic thinking to security operations: anomaly detection algorithms for threat identification, correlation algorithms for multi-source alert analysis, pattern matching algorithms for IOC detection in log streams. Designs efficient log analysis algorithms for real-time threat hunting at scale.
Defines algorithmic standards for SecOps team: threat detection algorithm selection criteria, log analysis optimization strategies, alert correlation algorithm evaluation. Conducts reviews of algorithmic decisions in SIEM performance and detection accuracy.
Application Security 5
▼
Understands the purpose of dependency scanning tools such as Snyk, Dependabot, and OWASP Dependency-Check. Follows established SCA policies when triaging vulnerability alerts. Recognizes common CVE severity levels and can escalate critical findings to senior analysts.
Independently runs and interprets SCA scans using Snyk, Dependabot, or Trivy across the organization's repositories. Conducts security reviews of dependency update pull requests, assessing changelog impact and potential regressions. Correlates vulnerability scanner output with threat intelligence feeds to prioritize remediation. Produces actionable reports for engineering teams with clear remediation timelines.
Designs the organization's dependency vulnerability management program, defining SLA tiers based on CVSS severity, exploitability, and asset criticality. Conducts threat modeling of the software supply chain to identify risks beyond individual CVEs, such as maintainer compromise and registry poisoning. Integrates SCA tooling (Snyk, Dependabot, Trivy) with SIEM/SOAR platforms for automated alerting and response workflows. Mentors analysts on distinguishing actionable vulnerabilities from false positives using reachability and runtime context.
Defines the security analytics team's strategy for dependency vulnerability monitoring and triage at product-line scale. Establishes standardized dashboards and KPI tracking for mean-time-to-remediate across SCA tools (Snyk, Dependabot, Trivy). Coordinates cross-team incident response when critical dependency vulnerabilities emerge, ensuring consistent communication and patching timelines. Trains analysts on advanced SCA interpretation, SBOM-driven risk assessment, and license compliance monitoring.
Understands basic OWASP and Application Security concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Applies OWASP security knowledge for security event analysis and threat correlation. Conducts security reviews of application logs identifying exploitation attempts for OWASP Top 10 vulnerabilities. Uses SIEM rules and detection logic to identify application-layer attacks and suspicious authentication patterns.
Designs application security monitoring and detection strategies aligned with OWASP attack patterns. Conducts threat modeling for detection engineering — designing correlation rules for multi-stage application attacks. Integrates security findings from SAST/DAST/pentest into SOC detection capabilities. Mentors team on application-layer threat analysis and incident forensics.
Defines security monitoring strategy for application-layer threat detection across the organization. Establishes security analysis policies, detection engineering standards, and application security incident response playbooks. Coordinates cross-team security event investigation and trains analysts on OWASP-based threat analysis.
Understands basic SAST/DAST concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Analyzes SAST/DAST scan results to assess risk levels and prioritize remediation efforts. Correlates scanner findings with threat intelligence and known vulnerability databases. Generates actionable security reports from scanning data for development and management teams.
Designs comprehensive SAST/DAST analytics frameworks for vulnerability trend analysis. Conducts threat modeling to map scanner coverage against real attack scenarios. Integrates scanning results into SIEM for continuous security monitoring. Mentors analysts on vulnerability classification and risk scoring.
Defines SAST/DAST monitoring and reporting strategy across the organization. Establishes vulnerability management policies based on scanner data and risk classification. Coordinates cross-team remediation tracking for critical scanner findings. Trains security analysts on scan result analysis and prioritization.
Understands basic secure coding concepts from a security analysis perspective — recognizes injection patterns, authentication bypass indicators, and insecure data handling in application logs. Follows security guidelines for identifying vulnerability signatures in code review findings and SAST/DAST reports.
Applies secure coding knowledge in security event analysis — correlates SAST/DAST findings with runtime security events, identifies exploitation attempts for known code vulnerabilities, and validates security fixes in remediation workflows. Uses code analysis tools to support threat investigation and vulnerability triage.
Designs security analysis workflows integrating secure coding intelligence — correlates code-level vulnerability data with runtime threat detection, architects detection rules informed by common coding weakness patterns, and implements automated security validation workflows. Conducts threat modeling for detection engineering and mentors team on code-aware security analysis.
Defines security analysis strategy integrating secure coding intelligence across monitoring operations. Establishes policies for code-informed detection engineering, vulnerability correlation workflows, and code-level threat analysis standards. Coordinates cross-team security analysis for application vulnerabilities and trains analysts on code-aware investigation techniques.
Understands basic threat modeling methodologies (STRIDE, DREAD). Identifies common threats in simple systems using predefined templates. Documents threat scenarios following organizational guidelines. Assists in data flow diagram creation for threat analysis.
Independently conducts threat modeling for medium-complexity systems using STRIDE and attack trees. Correlates identified threats with MITRE ATT&CK framework tactics. Understands trade-offs between security controls and system usability. Produces actionable threat reports with risk-ranked mitigation recommendations.
Designs threat modeling processes for complex distributed systems and cloud-native architectures. Creates attack tree libraries mapped to industry-specific threat landscapes. Mentors analysts on advanced threat analysis techniques including kill chain modeling. Optimizes threat detection rules based on modeled attack scenarios and emerging threat intelligence.
Defines threat modeling strategy at team and product level for security operations. Establishes threat intelligence-driven modeling processes aligned with MITRE ATT&CK and industry frameworks. Coordinates threat assessments across SOC, incident response, and vulnerability management teams. Drives integration of threat models into detection engineering and monitoring strategy.
Authentication & Authorization 2
▼
Understands basic JWT / OAuth2 / OIDC concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Analyzes JWT/OAuth2 security posture: monitors authentication logs for anomalous token usage, reviews OIDC provider configurations for misconfigurations, and assesses token lifecycle policies. Creates security dashboards for authentication metrics. Conducts access reviews for OAuth2 client registrations and scope assignments.
Designs security monitoring for authentication infrastructure: SIEM correlation rules for JWT/OAuth2 attacks, anomaly detection for token usage patterns, and incident response playbooks for authentication compromises. Implements compliance controls for identity management (SOC2, PCI-DSS). Conducts threat modeling for OIDC provider deployments. Mentors team on authentication security analysis.
Defines security monitoring strategy for authentication infrastructure. Establishes detection rules, incident response procedures, and compliance requirements for identity systems. Coordinates threat intelligence for authentication-related attacks. Creates security analytics dashboards for organization-wide authentication health monitoring.
Understands basic RBAC / ABAC Authorization concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Analyzes RBAC and ABAC authorization policies for compliance and risk exposure. Reviews access control configurations and identifies excessive permissions. Uses audit tools to monitor authorization events and detect anomalous access patterns.
Designs comprehensive authorization monitoring solutions for RBAC/ABAC systems. Conducts threat modeling of access control architectures across distributed services. Integrates authorization analytics into SIEM and security operations. Mentors analysts on access control risk assessment.
Defines authorization monitoring and audit strategy for RBAC/ABAC across the organization. Establishes access control review policies and compliance frameworks. Coordinates cross-team access control incident investigations. Trains security analysts on authorization risk analysis methods.
Clean Code & Refactoring 1
▼
Understands basic code quality principles for security operations scripts. Follows team conventions for SIEM rule formatting and detection script structure. Writes simple, readable alert logic and log parsing scripts. Accepts code review feedback on security tooling code.
Independently applies code quality practices in security operations scripting. Writes clean SIEM correlation rules and incident response runbooks. Understands trade-offs between detection sensitivity and alert fatigue. Reviews security tooling code for log parsing accuracy, alert logic correctness, and response procedure clarity.
Designs code quality standards for security operations tooling: SIEM rule structure, incident response automation scripts, threat intelligence integration code. Refactors detection logic for accuracy and performance. Establishes review practices for alert quality, forensic script reliability, and chain-of-custody compliance.
Defines code quality standards for security operations team: SIEM rule conventions, incident response automation guidelines, threat detection code reviews. Conducts reviews of detection logic accuracy and alert quality. Establishes quality gates for security tooling reliability.
Code Review 1
▼
Understands basic security-oriented code review: reviewing security monitoring rule changes, checking alert correlation logic modifications, validating SIEM query updates. Follows team review guidelines for SecOps code quality.
Independently conducts code reviews for SecOps code: evaluates SIEM rule quality, reviews threat detection logic implementations, checks alert correlation rule correctness. Provides constructive feedback on security monitoring code reliability and detection accuracy.
Designs code review processes for SecOps: SIEM rule review standards, threat detection logic review checklists, alert quality review gates. Mentors team on reviewing security monitoring code for detection accuracy and operational reliability.
Defines code review strategy for SecOps team: SIEM rule review standards, threat detection code review governance, security monitoring review practices. Establishes review culture for SecOps code quality and detection accuracy.
Compliance 3
▼
Understands basic GDPR / 152-FZ Compliance concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Applies GDPR/152-FZ compliance in security analysis: monitors data processing activities for regulatory violations, conducts DPIA assessments, and validates data retention policies. Uses DLP tools to detect unauthorized PII transfers.
Designs security solutions with GDPR / 152-FZ Compliance. Conducts threat modeling. Integrates security practices into SDLC. Mentors the team.
Defines GDPR/152-FZ compliance monitoring strategy: establishes data processing registers, incident classification criteria, and regulatory reporting workflows. Coordinates with legal team on cross-border data transfer assessments and supervisory authority interactions.
Understands basic PCI DSS concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Applies PCI DSS controls during security assessments and risk analysis. Monitors compliance status across systems processing cardholder data. Uses scanning and log analysis tools to detect deviations from PCI requirements.
Designs security solutions with PCI DSS. Conducts threat modeling. Integrates security practices into SDLC. Mentors the team.
Defines PCI DSS compliance monitoring strategy across the organization. Establishes security analytics policies for cardholder data environments. Coordinates incident response and forensic analysis for PCI breaches. Trains analysts on PCI assessment methodologies.
Understands basic SOC2 Compliance concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Applies SOC 2 compliance frameworks in daily security operations. Conducts control testing, collects audit evidence, and maintains documentation for Trust Services Criteria across availability, security, and confidentiality.
Designs security solutions with SOC2 Compliance. Conducts threat modeling. Integrates security practices into SDLC. Mentors the team.
Defines SOC 2 compliance program spanning all Trust Services Criteria. Establishes control frameworks, manages audit relationships, coordinates remediation of control gaps, and trains cross-functional teams on compliance requirements.
Containerization 1
▼
Understands basic Docker concepts for security analysis: containerized SIEM components, Docker images for log analysis tools, basic docker-compose for security monitoring stack. Uses ready-made configurations for SecOps tooling containers.
Independently configures Docker for security operations: containerized SIEM components, docker-compose for threat detection lab environments, Dockerfile for custom log analysis tool images. Understands container security hardening and network isolation for sensitive security monitoring infrastructure.
Designs Docker infrastructure for security operations: containerized SIEM/SOC architecture, hardened monitoring containers, isolated forensic analysis environments. Implements best practices for container runtime security, log collection from containerized services, and threat detection in container environments.
Defines Docker strategy for security operations: containerized SOC/SIEM architecture standards, security monitoring container governance, forensic environment isolation guidelines. Conducts architecture reviews for SecOps container infrastructure and establishes container security monitoring SLAs.
Docs-as-Code 1
▼
Understands the fundamentals of Diagramming: Mermaid, PlantUML, D2. Applies basic practices in daily work. Follows recommendations from the team and documentation.
Applies Mermaid, PlantUML, or D2 to build threat model diagrams, basic attack trees, and network topology maps. Understands trade-offs between diagram formats for security documentation. Creates incident flow visuals independently.
Designs production-grade threat modeling diagrams, multi-layer attack trees, and detailed network topology maps using Mermaid, PlantUML, or D2. Optimizes diagram complexity for incident response playbooks. Mentors analysts on security diagramming practices.
Defines diagramming strategy for threat modeling, attack surface visualization, and incident response documentation. Establishes standards for security architecture diagrams, network topology maps, and compliance visuals. Conducts reviews of security diagram accuracy and completeness.
Git & Workflows 1
▼
Understands basic Git advanced features for security analysis: blame for tracing code changes related to security incidents, bisect for narrowing down vulnerability introduction points, signed commits for verifying code authenticity. Follows team conventions for secure repository management.
Independently uses Git advanced features for security analysis: automated security scanning via hooks, bisect for narrowing vulnerability windows in commit history, reflog analysis for forensic investigation of repository changes. Understands trade-offs between branch protection levels and developer workflow friction.
Designs Git security practices for organizations: implements repository auditing frameworks using Git history analysis, configures enterprise-grade commit signing and verification infrastructure, designs access control policies for sensitive codebases. Mentors team on using Git forensics for security incident investigation.
Defines Git security strategy at the product level: establishes repository audit policies and compliance frameworks, designs incident response procedures using Git forensics, drives adoption of commit signing and branch protection across all development teams.
Incident Management 1
▼
Understands on-call basics for security operations: security alert triage procedures, SIEM dashboard monitoring, and security incident escalation paths. Participates in SOC rotations as junior analyst. Follows team procedures for security event investigation and documentation.
Configures on-call management for security operations: security alert correlation rules, threat severity-based triage automation, and SOC shift handoff procedures. Creates security monitoring dashboards with threat intelligence integration. Analyzes security incident patterns for detection rule improvement.
Designs on-call management for security operations center: advanced threat detection automation, SOAR integration for incident response orchestration, and cross-functional security incident coordination. Implements distributed tracing for security event correlation. Defines security-specific SLIs (detection time, containment time). Conducts security post-mortems and drives detection engineering improvements.
Defines on-call management strategy for security operations. Establishes SOC shift management, threat response SLA targets, and security incident escalation framework. Coordinates cross-team security incident response. Optimizes MTTD/MTTR for security events across the organization.
Incident Response 3
▼
Understands basic Digital Forensics concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Performs initial forensic triage on security alerts using log analysis and artifact collection. Preserves digital evidence following established procedures and chain of custody requirements. Uses forensic imaging tools to create verified copies of affected systems for detailed investigation.
Leads complex forensic investigations across multiple systems and environments. Performs advanced timeline analysis, memory forensics, and malware reverse engineering. Integrates forensic findings into threat intelligence workflows and SIEM correlation rules. Mentors junior analysts on forensic methodologies.
Defines the organization's digital forensics strategy including tooling, processes, and team capabilities. Establishes forensic readiness policies ensuring systems produce investigation-quality logs and artifacts. Coordinates forensic investigations with legal counsel and law enforcement when required.
Understands basic Incident Response Process concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Executes incident response procedures including detection, containment, and initial investigation. Classifies incidents by severity using established criteria and escalates appropriately. Performs log analysis and IOC correlation in SIEM to determine attack scope and impact on affected systems.
Leads incident response for complex multi-vector security incidents across cloud and on-premise environments. Conducts advanced threat hunting and root cause analysis. Develops and refines incident response playbooks based on emerging threats. Mentors team on incident handling and coordinates with external stakeholders.
Defines the organization's incident response framework including team structure, escalation paths, and communication plans. Establishes incident classification standards, SLAs for response times, and post-incident review processes. Coordinates tabletop exercises and drives continuous improvement of IR capabilities.
Understands basic Vulnerability Management concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Triages and prioritizes vulnerabilities based on risk scoring, asset criticality, and threat context. Monitors vulnerability feeds and correlates with organizational exposure. Uses vulnerability management platforms to generate remediation reports and track SLA compliance across teams.
Designs comprehensive vulnerability management programs with risk-based prioritization frameworks. Conducts threat modeling to map vulnerability exposure across organizational assets. Integrates vulnerability data into security operations for proactive risk mitigation. Mentors analysts on advanced triage and remediation tracking.
Defines vulnerability management program strategy with risk-based metrics and executive reporting. Establishes vulnerability triage policies, remediation SLAs, and exception management processes. Coordinates organization-wide vulnerability response during zero-day events. Trains security analysts on vulnerability intelligence and prioritization.
Infrastructure Security 4
▼
Understands basic Cloud Infrastructure Security concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Monitors cloud environments using SIEM platforms and CloudTrail analysis. Conducts security reviews of cloud resource configurations. Uses cloud-native detection tools to identify suspicious activity, analyze security events, and escalate confirmed threats for incident response.
Designs cloud threat detection strategies using advanced SIEM correlation rules and CloudTrail analytics. Conducts threat modeling for cloud-hosted services. Integrates cloud incident response playbooks into the SDLC and mentors analysts on cloud forensics and threat hunting techniques.
Defines cloud security monitoring strategy using SIEM, CloudTrail, and cloud-native detection services. Establishes cloud security policies and alert triage procedures. Coordinates cloud incident response across distributed teams and trains analysts on cloud threat intelligence and forensic investigation methods.
Understands basic Kubernetes Security concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Monitors Kubernetes clusters for security events using Falco and audit logs. Analyzes container runtime behavior to detect anomalous activity and potential breaches. Investigates Kubernetes-specific security alerts including unauthorized API access, privilege escalation, and suspicious pod deployments.
Leads Kubernetes security monitoring strategy with advanced detection rules for cluster-level threats. Conducts deep investigation of container compromise incidents including forensic analysis of pod artifacts and network traffic. Integrates Kubernetes audit telemetry into SIEM and develops automated response playbooks for cluster incidents.
Defines organization-wide Kubernetes security monitoring and incident response strategy. Establishes detection engineering standards for container runtime, orchestration events, and service mesh telemetry. Coordinates security operations coverage for multi-cluster environments and drives adoption of runtime protection platforms.
Understands basic Network Security concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Independently monitors and investigates network security events using SIEM and IDS/IPS platforms. Correlates firewall logs, NetFlow data, and DNS queries to detect lateral movement and C2 communication. Tunes IDS signatures to reduce false positives and documents network-based indicators of compromise for incident response playbooks.
Designs network threat detection strategies: builds advanced SIEM correlation rules for multi-stage network attacks, architects honeypot deployments for early threat detection, and creates network forensics procedures. Mentors analysts on deep packet inspection, encrypted traffic analysis, and advanced persistent threat identification across network layers.
Leads the team's network security monitoring and response capabilities: defines SIEM use cases for network threat detection, establishes SLAs for network incident triage, and builds runbooks for common network attack patterns. Coordinates with SOC and infrastructure teams to ensure comprehensive network visibility and drives adoption of NDR (Network Detection and Response) solutions.
Understands basic Secrets Management concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Monitors secrets usage patterns for security anomalies: analyzes Vault audit logs, detects unauthorized access attempts, and tracks secret lifecycle compliance. Conducts periodic access reviews for secret-consuming services. Uses SIEM integration for secrets-related incident detection.
Designs security monitoring for secrets infrastructure: Vault audit log analysis pipelines, anomaly detection for credential usage, and incident response playbooks for secret compromise. Implements compliance reporting for regulatory requirements (SOC2, PCI-DSS credential handling). Conducts penetration testing focused on secrets extraction vectors. Mentors team on threat modeling for credential flows.
Defines security monitoring strategy for secrets infrastructure. Establishes audit policies for Vault operations, compliance reporting requirements, and secret lifecycle governance. Coordinates incident response for organization-wide credential compromise. Creates threat intelligence integration for credential-based attacks.
Logging 1
▼
Understands basic structured logging for security analysis: reading SIEM-ingested structured logs, understanding log formats for threat detection, basic log correlation for security event investigation. Follows team conventions for security log analysis and alert triage procedures.
Configures structured logging for security operations: implements SIEM correlation rules for threat detection, creates security dashboards for real-time monitoring, sets up alerts for IOC (Indicators of Compromise) patterns. Analyzes security incidents using cross-system log correlation and forensic timelines.
Designs observability strategy for security operations: implements advanced SIEM correlation for multi-stage attack detection, defines SLI/SLO for security monitoring coverage and response times, conducts post-mortems for security incidents. Mentors team on forensic log analysis and threat hunting through structured logs.
Defines security observability strategy at the product level: establishes SLO-based approach for security monitoring effectiveness and response times, coordinates security incident management across teams, optimizes MTTD/MTTR for threat detection through advanced correlation and automation.
Networking 1
▼
Understands basic networking concepts for security monitoring — packet capture analysis, IDS/IPS alert interpretation, and network traffic pattern recognition. Uses ready-made configurations for SIEM network rules and performs simple network security event triage under senior guidance.
Independently analyzes network security events — performs deep packet inspection, correlates network anomalies with threat intelligence, and configures SIEM rules for network-based attack detection. Writes IaC for network monitoring infrastructure and understands advanced traffic analysis patterns for threat hunting.
Designs network security monitoring architectures for enterprise environments. Implements advanced threat detection through network behavior analysis, encrypted traffic inspection, and ML-based anomaly detection. Optimizes SIEM network correlation rules and implements security hardening for network infrastructure.
Defines network security monitoring strategy across the organization's infrastructure. Establishes IaC standards for SIEM network detection rules and threat hunting playbooks. Conducts architecture reviews of network monitoring coverage and drives adoption of advanced network analytics across security operations.
REST API 1
▼
Understands basic REST API concepts for security analysis: API audit logging, authentication token analysis, common API attack vectors in SIEM alerts. Follows team conventions for monitoring API security events.
Independently monitors REST API security: API access pattern analysis, anomaly detection in API usage, API authentication event correlation. Understands best practices for API threat detection rules, abuse pattern identification, and API security monitoring in SIEM.
Designs API security monitoring architecture: API-specific threat detection rules, API abuse pattern analytics, API authentication anomaly detection. Defines API security monitoring standards and incident response procedures. Mentors team on API threat intelligence and analysis.
Defines API security monitoring strategy at product level: API threat detection standards, API abuse analytics governance, API security incident response policies. Conducts API security monitoring architecture reviews and establishes API security alerting.
Supply Chain Security 1
▼
Understands basic supply chain security concepts: SBOM generation, dependency vulnerability databases (NVD, OSV), and package provenance verification. Follows security guidelines for triaging dependency alerts and documenting component inventories. Recognizes common supply chain risks in third-party software.
Applies supply chain security analysis in daily work: reviews SBOM outputs for vulnerability exposure, tracks CVE impact across dependency graphs, and assesses third-party component risks. Uses SCA scanning tools to monitor software composition and produces risk reports for stakeholders.
Designs security solutions with Supply Chain Security. Conducts threat modeling. Integrates security practices into SDLC. Mentors the team.
Defines organizational supply chain security strategy: establishes SBOM compliance requirements, vulnerability SLA policies, and third-party risk assessment frameworks. Coordinates incident response for dependency compromises across teams. Trains analysts on supply chain threat intelligence and regulatory compliance.
Technical Documentation 2
▼
Understands the fundamentals of architecture documentation including C4 diagrams and arc42 templates. Can read threat models and security architecture documents. Follows team guidelines when documenting security controls and their placement within the system architecture. Creates basic security component diagrams under guidance.
Independently creates security architecture documentation using C4 diagrams at context, container, and component levels. Writes ADRs for security-related decisions such as authentication flows and encryption strategies. Understands trade-offs between documentation granularity and maintenance overhead in security contexts. Documents trust boundaries and data classification in arc42 security sections.
Designs comprehensive security architecture documentation frameworks combining C4 models with threat modeling outputs (STRIDE, PASTA). Creates detailed arc42 security views covering trust boundaries, encryption layers, and compliance requirements. Mentors the team on documenting security architecture decisions with proper risk assessment in ADRs. Optimizes documentation workflows to ensure security reviews are reflected in architecture artifacts.
Defines the security architecture documentation strategy at the team and product level. Establishes standards for documenting security boundaries, data flows, and threat models using C4 and arc42. Conducts security architecture reviews ensuring ADRs properly capture risk decisions, compliance rationale, and mitigation strategies. Drives adoption of security documentation practices across development teams through templates and review checklists.
Understands the role of runbooks in SOC operations and alert triage. Follows existing playbooks for common alert types: phishing, malware detection, unauthorized access attempts. Documents incident handling steps and escalation decisions.
Independently writes SOC runbooks for alert investigation: SIEM correlation rule triage, endpoint detection response workflows, threat intelligence integration procedures. Understands trade-offs between automated SOAR playbooks and manual analyst decision points.
Designs SOC runbook frameworks integrating SIEM, SOAR, and EDR workflows: advanced threat hunting playbooks, insider threat investigation procedures, cross-organizational incident coordination runbooks. Mentors analysts on writing runbooks that balance automation with critical human judgment points.
Defines runbook strategy for SOC operations at the team level: establishes playbook governance frameworks, drives SOAR-integrated automated response procedures, creates runbook effectiveness metrics tied to MTTD and MTTR improvements.