Skill UI

An expert architect specializing in designing, implementing, and managing complex hybrid and multi-cloud environments. Expertise spans major public clouds (AWS, Azure, GCP), private clouds (OpenStack, VMware), and container platforms (Kubernetes). Focus areas include cross-cloud networking, Infrastructure as Code (IaC) using Terraform, workload optimization, zero-trust security implementation, and FinOps cost management.

This skill provides comprehensive guidance on establishing secure, high-performance connectivity between on-premises data centers and major public cloud providers (AWS, Azure, GCP). It covers various connection options, including Site-to-Site VPN, AWS Direct Connect, Azure ExpressRoute, and GCP Cloud Interconnect. Use this skill to design and implement complex hybrid network patterns (e.g., Hub-and-Spoke, Multi-Cloud), ensuring high availability, proper routing (BGP), and adherence to security best practices.

This comprehensive skill profile models an expert network engineer specializing in modern cloud networking, security architectures, and performance optimization. It covers multi-cloud environments (AWS, Azure, GCP), advanced concepts like Zero Trust, Service Mesh (Istio), and high-availability design. Key capabilities include implementing IaC (Terraform), load balancing, DNS management, and deep network troubleshooting. Ideal for complex DevOps, SRE, or infrastructure design roles.

Expert in implementing Infrastructure as Code (IaC) using Terraform across multi-cloud environments, including AWS, Azure, and GCP. Specializes in creating reusable, modular components, advanced state management (backends, locking, migrations), ensuring security best practices, and developing robust, production-grade cloud infrastructure pipelines.

A comprehensive guide for managing secrets and environment variables throughout the entire development lifecycle, from local development to production. This skill covers secret leak auditing (detecting committed credentials), implementing robust rotation workflows, and integrating with industry-leading secret stores like HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault. Essential for hardening CI/CD pipelines and ensuring compliance.

A comprehensive guide to deploying Microsoft Sentinel as a cloud-native SIEM/SOAR solution. Covers multi-cloud data connector setup (AWS, Azure, GCP), writing advanced KQL queries for threat detection and hunting, and building automated response playbooks using Logic Apps. Ideal for establishing centralized SOCs in complex, multi-cloud environments.

This skill provides a comprehensive guide to establishing SAML 2.0 identity federation between on-premises Active Directory and Microsoft Entra ID (Azure AD). It covers the architecture, prerequisites, and practical steps (including PowerShell scripting) required to achieve seamless Single Sign-On (SSO) and centralized authentication authority for hybrid environments and third-party SaaS applications.

Establishes a repeatable, structured operational process for managing Microsoft Patch Tuesday security updates. The workflow guides users through advisory review, vulnerability triaging (including zero-days), phased testing, and deployment across major platforms (Windows, Azure, Office). Ideal for maturing patch management programs and defining risk-based remediation SLAs.

A comprehensive guide on deploying Cloudflare Access and Tunnel to establish a Zero Trust Network Access (ZTNA) solution. This method replaces traditional VPNs by securely exposing self-hosted internal applications (web, SSH, RDP) without opening inbound ports. It integrates identity-aware policies, device posture checks, and robust identity providers (Okta, Azure AD) for highly secure, least-privilege access.

A comprehensive guide and analysis framework for detecting compromised Office 365 or Google Workspace email accounts. It focuses on analyzing unified audit logs and Azure AD sign-in logs to identify indicators of account takeover (ATO) or Business Email Compromise (BEC). Detection methods include monitoring impossible travel events, identifying malicious inbox rules (e.g., external forwarding or deletion rules), and analyzing suspicious Microsoft Graph API access patterns.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

This skill provides a structured methodology for threat hunting DNS-based persistence mechanisms. It detects unauthorized changes such as DNS hijacking, dangling CNAME records enabling subdomain takeover, wildcard DNS abuse, or unauthorized NS delegation modifications. By utilizing passive DNS history (e.g., SecurityTrails API) and auditing cloud DNS logs (Route53, Azure, Cloudflare), users can identify persistent attack vectors that survive traditional remediation efforts.