Senior Security Engineer

Security engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing.

Table of Contents

• [Threat Modeling Workflow](#threat-modeling-workflow)
• [Security Architecture Workflow](#security-architecture-workflow)
• [Vulnerability Assessment Workflow](#vulnerability-assessment-workflow)
• [Secure Code Review Workflow](#secure-code-review-workflow)
• [Incident Response Workflow](#incident-response-workflow)
• [Security Tools Reference](#security-tools-reference)
• [Tools and References](#tools-and-references)

Threat Modeling Workflow

Identify and analyze security threats using STRIDE methodology.

Workflow: Conduct Threat Model

1. Define system scope and boundaries:

- Identify assets to protect - Map trust boundaries - Document data flows

1. Create data flow diagram:

- External entities (users, services) - Processes (application components) - Data stores (databases, caches) - Data flows (APIs, network connections)

1. Apply STRIDE to each DFD element (see [STRIDE per Element Matrix](#stride-per-element-matrix) below)
2. Score risks using DREAD:

- Damage potential (1-10) - Reproducibility (1-10) - Exploitability (1-10) - Affected users (1-10) - Discoverability (1-10)

1. Prioritize threats by risk score
2. Define mitigations for each threat
3. Document in threat model report
4. Validation: All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped

STRIDE Threat Categories

STRIDE per Element Matrix

See: [references/threat-modeling-guide.md](references/threat-modeling-guide.md)

Security Architecture Workflow

Design secure systems using defense-in-depth principles.

Workflow: Design Secure Architecture

1. Define security requirements:

- Compliance requirements (GDPR, HIPAA, PCI-DSS) - Data classification (public, internal, confidential, restricted) - Threat model inputs

1. Apply defense-in-depth layers:

- Perimeter: WAF, DDoS protection, rate limiting - Network: Segmentation, IDS/IPS, mTLS - Host: Patching, EDR, hardening - Application: Input validation, authentication, secure coding - Data: Encryption at rest and in transit

1. Implement Zero Trust principles:

- Verify explicitly (every request) - Least privilege access (JIT/JEA) - Assume breach (segment, monitor)

1. Configure authentication and authorization:

- Identity provider selection - MFA requirements - RBAC/ABAC model

1. Design encryption strategy:

- Key management approach - Algorithm selection - Certificate lifecycle

1. Plan security monitoring:

- Log aggregation - SIEM integration - Alerting rules

1. Document architecture decisions
2. Validation: Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned

Defense-in-Depth Layers

Layer 1: PERIMETER
  WAF, DDoS mitigation, DNS filtering, rate limiting

Layer 2: NETWORK
  Segmentation, IDS/IPS, network monitoring, VPN, mTLS

Layer 3: HOST
  Endpoint protection, OS hardening, patching, logging

Layer 4: APPLICATION
  Input validation, authentication, secure coding, SAST

Layer 5: DATA
  Encryption at rest/transit, access controls, DLP, backup

Authentication Pattern Selection

See: [references/security-architecture-patterns.md](references/security-architecture-patterns.md)

Vulnerability Assessment Workflow

Identify and remediate security vulnerabilities in applications.

Workflow: Conduct Vulnerability Assessment

1. Define assessment scope:

- In-scope systems and applications - Testing methodology (black box, gray box, white box) - Rules of engagement

1. Gather information:

- Technology stack inventory - Architecture documentation - Previous vulnerability reports

1. Perform automated scanning:

- SAST (static analysis) - DAST (dynamic analysis) - Dependency scanning - Secret detection

1. Conduct manual testing:

- Business logic flaws - Authentication bypass - Authorization issues - Injection vulnerabilities

1. Classify findings by severity:

- Critical: Immediate exploitation risk - High: Significant impact, easier to exploit - Medium: Moderate impact or difficulty - Low: Minor impact

1. Develop remediation plan:

- Prioritize by risk - Assign owners - Set deadlines

1. Verify fixes and document
2. Validation: Scope defined; automated and manual testing complete; findings classified; remediation tracked

For OWASP Top 10 vulnerability descriptions and testing guidance, refer to owasp.org/Top10.

Vulnerability Severity Matrix

Secure Code Review Workflow

Review code for security vulnerabilities before deployment.

Workflow: Conduct Security Code Review

1. Establish review scope:

- Changed files and functions - Security-sensitive areas (auth, crypto, input handling) - Third-party integrations

1. Run automated analysis:

- SAST tools (Semgrep, CodeQL, Bandit) - Secret scanning - Dependency vulnerability check

1. Review authentication code:

- Password handling (hashing, storage) - Session management - Token validation

1. Review authorization code:

- Access control checks - RBAC implementation - Privilege boundaries

1. Review data handling:

- Input validation - Output encoding - SQL query construction - File path handling

1. Review cryptographic code:

- Algorithm selection - Key management - Random number generation

1. Document findings with severity
2. Validation: Automated scans passed; auth/authz reviewed; data handling checked; crypto verified; findings documented

Security Code Review Checklist

Secure vs Insecure Patterns

Inline Code Examples

SQL Injection — insecure vs. secure (Python):

# ❌ Insecure: string formatting allows SQL injection
query = f"SELECT * FROM users WHERE username = '{username}'"
cursor.execute(query)

# ✅ Secure: parameterized query — user input never interpreted as SQL
query = "SELECT * FROM users WHERE username = %s"
cursor.execute(query, (username,))

Password Hashing with Argon2id (Python):

from argon2 import PasswordHasher

ph = PasswordHasher()          # uses secure defaults (time_cost, memory_cost)

# On registration
hashed = ph.hash(plain_password)

# On login — raises argon2.exceptions.VerifyMismatchError on failure
ph.verify(hashed, plain_password)

Secret Scanning — core pattern matching (Python):

import re, pathlib

SECRET_PATTERNS = {
    "aws_access_key":  re.compile(r"AKIA[0-9A-Z]{16}"),
    "github_token":    re.compile(r"ghp_[A-Za-z0-9]{36}"),
    "private_key":     re.compile(r"-----BEGIN (RSA |EC )?PRIVATE KEY-----"),
    "generic_secret":  re.compile(r'(?i)(password|secret|api_key)\s*=\s*["\']?\S{8,}'),
}

def scan_file(path: pathlib.Path) -> list[dict]:
    findings = []
    for lineno, line in enumerate(path.read_text(errors="replace").splitlines(), 1):
        for name, pattern in SECRET_PATTERNS.items():
            if pattern.search(line):
                findings.append({"file": str(path), "line": lineno, "type": name})
    return findings

Incident Response Workflow

Respond to and contain security incidents.

Workflow: Handle Security Incident

1. Identify and triage:

- Validate incident is genuine - Assess initial scope and severity - Activate incident response team

1. Contain the threat:

- Isolate affected systems - Block malicious IPs/accounts - Disable compromised credentials

1. Eradicate root cause:

- Remove malware/backdoors - Patch vulnerabilities - Update configurations

1. Recover operations:

- Restore from clean backups - Verify system integrity - Monitor for recurrence

1. Conduct post-mortem:

- Timeline reconstruction - Root cause analysis - Lessons learned

1. Implement improvements:

- Update detection rules - Enhance controls - Update runbooks

1. Document and report
2. Validation: Threat contained; root cause eliminated; systems recovered; post-mortem complete; improvements implemented

Incident Severity Levels

Incident Response Checklist

Security Tools Reference

Recommended Security Tools

Cryptographic Algorithm Selection

See: [references/cryptography-implementation.md](references/cryptography-implementation.md)

Tools and References

Scripts

For usage, see the inline code examples in [Secure Code Review Workflow](#inline-code-examples) and the script source files directly.

References

Security Standards Reference

Security Headers Checklist

For compliance framework requirements (OWASP ASVS, CIS Benchmarks, NIST CSF, PCI-DSS, HIPAA, SOC 2), refer to the respective official documentation.

Related Skills