What a Mid-level } should know

Monitors cloud environments using SIEM platforms and CloudTrail analysis. Conducts security reviews of cloud resource configurations. Uses cloud-native detection tools to identify suspicious activity, analyze security events, and escalate confirmed threats for incident response.

Independently runs and interprets SCA scans using Snyk, Dependabot, or Trivy across the organization's repositories. Conducts security reviews of dependency update pull requests, assessing changelog impact and potential regressions. Correlates vulnerability scanner output with threat intelligence feeds to prioritize remediation. Produces actionable reports for engineering teams with clear remediation timelines.

Performs initial forensic triage on security alerts using log analysis and artifact collection. Preserves digital evidence following established procedures and chain of custody requirements. Uses forensic imaging tools to create verified copies of affected systems for detailed investigation.

Applies GDPR/152-FZ compliance in security analysis: monitors data processing activities for regulatory violations, conducts DPIA assessments, and validates data retention policies. Uses DLP tools to detect unauthorized PII transfers.

Executes incident response procedures including detection, containment, and initial investigation. Classifies incidents by severity using established criteria and escalates appropriately. Performs log analysis and IOC correlation in SIEM to determine attack scope and impact on affected systems.

Analyzes JWT/OAuth2 security posture: monitors authentication logs for anomalous token usage, reviews OIDC provider configurations for misconfigurations, and assesses token lifecycle policies. Creates security dashboards for authentication metrics. Conducts access reviews for OAuth2 client registrations and scope assignments.

Monitors Kubernetes clusters for security events using Falco and audit logs. Analyzes container runtime behavior to detect anomalous activity and potential breaches. Investigates Kubernetes-specific security alerts including unauthorized API access, privilege escalation, and suspicious pod deployments.

Independently monitors and investigates network security events using SIEM and IDS/IPS platforms. Correlates firewall logs, NetFlow data, and DNS queries to detect lateral movement and C2 communication. Tunes IDS signatures to reduce false positives and documents network-based indicators of compromise for incident response playbooks.

Applies OWASP security knowledge for security event analysis and threat correlation. Conducts security reviews of application logs identifying exploitation attempts for OWASP Top 10 vulnerabilities. Uses SIEM rules and detection logic to identify application-layer attacks and suspicious authentication patterns.

Applies PCI DSS controls during security assessments and risk analysis. Monitors compliance status across systems processing cardholder data. Uses scanning and log analysis tools to detect deviations from PCI requirements.

Analyzes RBAC and ABAC authorization policies for compliance and risk exposure. Reviews access control configurations and identifies excessive permissions. Uses audit tools to monitor authorization events and detect anomalous access patterns.

Analyzes SAST/DAST scan results to assess risk levels and prioritize remediation efforts. Correlates scanner findings with threat intelligence and known vulnerability databases. Generates actionable security reports from scanning data for development and management teams.

Monitors secrets usage patterns for security anomalies: analyzes Vault audit logs, detects unauthorized access attempts, and tracks secret lifecycle compliance. Conducts periodic access reviews for secret-consuming services. Uses SIEM integration for secrets-related incident detection.

Applies secure coding knowledge in security event analysis — correlates SAST/DAST findings with runtime security events, identifies exploitation attempts for known code vulnerabilities, and validates security fixes in remediation workflows. Uses code analysis tools to support threat investigation and vulnerability triage.

Applies SOC 2 compliance frameworks in daily security operations. Conducts control testing, collects audit evidence, and maintains documentation for Trust Services Criteria across availability, security, and confidentiality.

Applies supply chain security analysis in daily work: reviews SBOM outputs for vulnerability exposure, tracks CVE impact across dependency graphs, and assesses third-party component risks. Uses SCA scanning tools to monitor software composition and produces risk reports for stakeholders.

Independently conducts threat modeling for medium-complexity systems using STRIDE and attack trees. Correlates identified threats with MITRE ATT&CK framework tactics. Understands trade-offs between security controls and system usability. Produces actionable threat reports with risk-ranked mitigation recommendations.

Triages and prioritizes vulnerabilities based on risk scoring, asset criticality, and threat context. Monitors vulnerability feeds and correlates with organizational exposure. Uses vulnerability management platforms to generate remediation reports and track SLA compliance across teams.