Skill UI

Detect sophisticated Stuxnet-style cyber-physical attacks by mapping the multi-stage OT attack chain, monitoring PLC logic integrity, correlating engineering workstation compromise indicators, and validating physics-based process measurements to detect stealthy manipulation.

Uses Sysmon telemetry to detect MITRE T1055 process injection techniques by monitoring CreateRemoteThread, ProcessAccess, DLL loading, and ProcessTampering events, correlating them with process creation and known-good filters for threat hunting.

Implements full BitLocker disk encryption on Windows endpoints, covering TPM validation, GPO tuning, Intune deployment, recovery key escrow, and monitoring to help enterprises meet compliance and protect data at rest.

Deploy and configure the Dragos Platform to monitor OT networks, tapping into 600+ industrial protocols, threat-intelligence-backed detection, asset discovery, vulnerability context, and SIEM integration for SOC teams.

Implements GitHub Advanced Security with CodeQL to provide automated static analysis, secret detection, dependency review, and push protection across repositories, enabling enterprise-scale vulnerability monitoring and compliance-aligned controls.

Guides security teams through implementing PCI DSS 4.0.1 controls, from scoping and network hardening to access, monitoring, and governance, to keep cardholder data protected.

Implements Datadog Cloud SIEM, Cloud Security Management, and Workload Protection to ingest cloud logs, apply detection rules, and automate alerts for hybrid infrastructure threat response.

Uses tc, iperf3, netem, and Scapy-based flows to throttle bandwidth, add latency, and emulate Slowloris-style exhaustion so authorized testers can validate QoS controls, application resilience, and monitoring detection.

Use Claroty xDome’s passive and active monitoring flows to catalog ICS/OT assets—including PLCs, HMIs, RTUs, and network devices—via Claroty Edge, CMDB integrations, and communication maps for auditing and risk assessment.

Guides safe OT/ICS vulnerability scanning workflows with Tenable OT Security, combining passive monitoring, native protocol queries, and controlled active checks to avoid disrupting industrial processes while gathering compliance-ready risk data.

This skill covers the comprehensive automation of X.509 certificate lifecycle management, including requesting, issuing, deploying, monitoring, renewing, and revoking certificates. Utilizing Python and the ACME protocol (like Let's Encrypt), it helps organizations mitigate security risks and prevent service outages caused by expired or poorly managed certificates. Ideal for security auditing, incident response, and continuous security testing.

Guides securing public API Gateway endpoints using AWS WAF managed rule groups for OWASP coverage, custom rate limits, bot control, IP reputation filtering, and metric monitoring to keep attacks and abuse in check.