Senior SecOps Engineer

The agent scans source code for security vulnerabilities (hardcoded secrets, SQL injection, XSS, command injection), assesses dependency CVEs across npm/Python/Go ecosystems, and verifies compliance against SOC 2, PCI-DSS, HIPAA, and GDPR frameworks.

Core Capabilities

• Security scanner — detect hardcoded secrets, SQL injection, XSS, command injection, and path traversal in source code.
• Vulnerability assessor — scan npm / Python / Go dependency manifests for known CVEs with CVSS scores, fixed versions, and a 0-100 risk score.
• Compliance checker — verify SOC 2, PCI-DSS, HIPAA, and GDPR controls (access control, encryption, audit logging, auth strength).
• Security workflows — audit, CI/CD security gate, CVE triage (with SLA tiers), and 5-phase incident response.
• Standards & secure coding — OWASP Top 10 prevention, secure-coding checklist, and language-specific BAD/GOOD patterns.

When to Use

• Implementing security controls or hardening a codebase.
• Conducting a security audit or pre-release security pass.
• Responding to or triaging a newly disclosed CVE.
• Meeting SOC 2, PCI-DSS, HIPAA, or GDPR compliance requirements.
• Wiring SAST/dependency/compliance gates into CI/CD.

Clarify First

Before the security pass, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Target path — the codebase or dependency manifest to scan (the subject of every scanner)
• Compliance framework — SOC 2 / PCI-DSS / HIPAA / GDPR (--framework; changes which controls are verified)
• Severity threshold — the minimum severity to report or gate on (--severity; changes the report and CI pass/fail)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Tools

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

• references/workflows-and-tooling.md — capability command reference, the 4 workflows (audit, CI/CD gate, CVE triage, incident response), full per-script flag/output/exit-code tables, and the tech stack. Read when running a workflow or invoking a script with specific flags.
• references/standards-and-playbook.md — OWASP Top 10 prevention table, secure-coding checklist, SOC 2 / PCI-DSS / HIPAA / GDPR control tables, secure-coding BAD/GOOD code patterns, anti-patterns, troubleshooting table, and success criteria. Read when applying standards or diagnosing scanner behavior.
• references/security_standards.md — deep OWASP Top 10 with code, secure coding practices, authentication standards, API security, and secrets management. Read for in-depth secure-coding guidance.
• references/vulnerability_management_guide.md — vulnerability lifecycle, CVE triage process, CVSS scoring, remediation workflows, and dependency scanning. Read when managing CVEs end to end.
• references/compliance_requirements.md — full SOC 2 / PCI-DSS / HIPAA / GDPR control detail, evidence collection, compliance automation, and audit preparation. Read when preparing for an audit.

Scope & Limitations

This skill covers:

• Static analysis of source code for common vulnerability classes (secrets, injection, XSS, command injection, path traversal).
• Dependency vulnerability assessment against a built-in CVE database for npm, Python, and Go ecosystems.
• Compliance verification for SOC 2 Type II, PCI-DSS v4.0, HIPAA Security Rule, and GDPR.
• Security workflow orchestration including CI/CD gating, CVE triage, and incident response procedures.

This skill does NOT cover:

• Dynamic application security testing (DAST) or runtime analysis -- use OWASP ZAP or Burp Suite for live scanning.
• Infrastructure-as-code security (Terraform, CloudFormation misconfigurations) -- see the senior-devops skill for IaC hardening.
• Container image scanning or Kubernetes admission control -- see the senior-devops skill or use Trivy directly.
• Penetration testing execution or red-team operations -- these require specialized tooling and authorized human operators.

Integration Points