Skill UI

An expert architect specializing in designing, implementing, and managing complex hybrid and multi-cloud environments. Expertise spans major public clouds (AWS, Azure, GCP), private clouds (OpenStack, VMware), and container platforms (Kubernetes). Focus areas include cross-cloud networking, Infrastructure as Code (IaC) using Terraform, workload optimization, zero-trust security implementation, and FinOps cost management.

This comprehensive skill profile models an expert network engineer specializing in modern cloud networking, security architectures, and performance optimization. It covers multi-cloud environments (AWS, Azure, GCP), advanced concepts like Zero Trust, Service Mesh (Istio), and high-availability design. Key capabilities include implementing IaC (Terraform), load balancing, DNS management, and deep network troubleshooting. Ideal for complex DevOps, SRE, or infrastructure design roles.

This skill provides a comprehensive guide to implementing microsegmentation policies. It details how to move beyond traditional network boundaries (VLANs) to enforce least-privilege access control between individual workloads using identity and application context. Essential for preventing lateral movement and establishing a robust zero-trust architecture aligned with industry compliance standards.

A comprehensive guide on deploying Cloudflare Access and Tunnel to establish a Zero Trust Network Access (ZTNA) solution. This method replaces traditional VPNs by securely exposing self-hosted internal applications (web, SSH, RDP) without opening inbound ports. It integrates identity-aware policies, device posture checks, and robust identity providers (Okta, Azure AD) for highly secure, least-privilege access.

A comprehensive guide for implementing enterprise-grade Security Access Service Edge (SASE) architectures using Palo Alto Networks Prisma Access. This skill covers configuring ZTNA connectors, GlobalProtect agents, security policies, and device posture checks (HIP) to provide unified, cloud-delivered security, replacing traditional VPNs and maintaining zero trust principles across remote and branch offices.

This skill provides a comprehensive guide to deploying a Software-Defined Perimeter (SDP) compliant with the CSA v2.0 specification. It details implementing core zero trust mechanisms, including Single Packet Authorization (SPA) and mutual TLS (mTLS), using a controller and gateway architecture. Use this when establishing invisible, identity-centric network access (dark cloud) to harden infrastructure, enforce strict zero trust policies, or meet advanced compliance requirements.

This guide details deploying Tailscale (or self-hosted Headscale) to create a WireGuard-based zero trust mesh VPN. It establishes encrypted peer-to-peer connections between devices, eliminating the need for traditional VPN servers. Features include identity-aware Access Control Lists (ACLs), subnet routing, and secure connectivity for compliance-driven architectures. Use this when enforcing granular, identity-authenticated access control.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

A comprehensive guide to implementing Google's BeyondCorp zero trust access model. This solution enforces identity- and device-aware access control using Cloud IAP and Access Context Manager, effectively replacing traditional VPN infrastructure. Use this to secure remote and hybrid access to GCP-hosted or on-prem applications by requiring granular device posture checks and strong user authentication.

This skill implements the CISA Zero Trust Maturity Model (ZTMM) v2.0. It provides a structured framework to assess, gap-analyze, and roadmap the adoption of zero trust architecture across five core pillars: Identity, Devices, Networks, Applications, and Data. It guides organizations from Traditional to Optimal maturity, aiding compliance with NIST standards and federal mandates.

Configure Microsoft Entra ID (Azure AD) Conditional Access policies to enforce zero trust access control. This skill covers critical areas such as signal-based policy design, device compliance requirements, risk-based authentication, named locations, and session controls, aligning with NIST SP 1800-35. Essential for deploying, hardening, or assessing robust Azure AD security architecture.

This skill guides the implementation and auditing of advanced network segmentation within Kubernetes using Calico. It enables establishing zero-trust microsegmentation by creating and managing NetworkPolicy and GlobalNetworkPolicy resources. Use this to strictly control pod-to-pod traffic, enforce namespace isolation, restrict egress rules, and apply DNS-based security policies, significantly hardening your cluster's security posture.