Skill UI

Deploy DefectDojo as a centralized vulnerability dashboard that aggregates scanner results, deduplicates findings, tracks metrics, and feeds Jira/CI/CD workflows for security teams.

Creates a structured vulnerability scanning workflow that uses Nessus, Qualys, or OpenVAS to discover, prioritize, and track remediation across infrastructure, integrates scan results with SIEM and dashboards, and defines cadence, risk-based prioritization, and SLA-driven remediation tracking for SOC teams.

Guides deploying and configuring CrowdStrike Falcon EDR sensors across Windows, macOS, and Linux endpoints, covering policy tuning, response workflows, and SIEM integrations for onboarding, automated detection, and troubleshooting.

Implementing AWS Security Hub to centralize findings, map CIS/PCI DSS/NIST standards, and automate remediation with EventBridge/Lambda across multi-account environments for clearer compliance dashboards.

This guide details the implementation of Delinea Secret Server for robust Privileged Access Management (PAM). It covers infrastructure deployment (IIS, SQL Server), configuring secret templates, automating the onboarding of credentials, and establishing centralized vaulting for sensitive accounts. It is essential for organizations needing to meet compliance mandates (SOX, PCI-DSS) by eliminating plaintext credentials and automating password rotation.

Guide to configuring Proofpoint Targeted Attack Protection so suspicious attachments and URLs are detonated in isolated environments, policies are tuned, dashboards monitored, and SIEM workflows triggered for phishing defense.

Guides deploying endpoint DLP controls in Microsoft Purview and Symantec to detect and block sensitive email, USB, cloud, printing, and clipboard exfiltration; covers defining sensitive information types, policy templates, activity configurations, audit deployment, and monitoring/responding to incidents.

Integrates FIRST's EPSS API with vulnerability scan data to score CVEs by exploitation likelihood, combine with CVSS, and output ranked priorities for remediation workflows and dashboards.

Automates tracking of vulnerability remediation SLAs, detects breaches based on severity, escalates via configured contacts, and feeds compliance dashboards with status updates.

Defines the structured steps for onboarding log sources into SIEM platforms, covering discovery, collection configuration, parsing, normalization, and validation to ensure comprehensive security visibility and detection readiness.

Automates STIX 2.1 and TAXII 2.1 ingestion, validation, normalization, and routing so threat intelligence bundles can be onboarded from government or commercial feeds, mapped into SIEM/TIP schemas, and safely shared back through bi-directional TAXII pipelines.

Evaluates OAuth 2.0 and OpenID Connect deployments for redirect URI flaws, CSRF via missing state, PKCE bypasses, token leakage, and scope escalation to ensure secure authorization-code flows before production onboarding.