Security skills

Leverages Splunk Enterprise Security and SPL (Search Processing Language)

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence…

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to…

Analyzes structured and unstructured threat intelligence feeds to extract

Query a MISP (Malware Information Sharing Platform) instance via PyMISP

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and…

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo

Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,

Analyzes malicious VBA macros embedded in Microsoft Office documents

Detonate malware samples in Cuckoo Sandbox to observe runtime behavior

Query the Malpedia API to look up malware family aliases and naming

Use Sysinternals Autoruns to systematically enumerate and analyze malware

Detect sandbox and VM evasion techniques in malware samples by analyzing

Auditing Terraform infrastructure-as-code for security misconfigurations

Build structured communication templates for malware incidents (ransomware,

Assessing JSON Web Token implementations for cryptographic weaknesses,

Tests WebSocket API implementations for missing upgrade-handshake authentication,

Discovers and maps adversary-controlled infrastructure (C2 servers,

Triages security alerts in Splunk Enterprise Security by classifying

Performs initial triage of security incidents using the NIST SP

Classifies and prioritizes security incidents using structured IR

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the…

API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

Generates security-focused guidance for Google Cloud workloads based on the Google Cloud Well-Architected Framework (WAF). Use to evaluate a workload, identify security requirements, and provide actionable…