Senior Security

**Judgment:** Strong, well-structured security engineering skill suitable for senior engineers, security leads, and security-minded architects. It offers comprehensive workflows and checklists that an AI can follow to deliver methodical, defensible security guidance. **Main strengths** - Covers the full lifecycle: threat modeling (STRIDE + DREAD), secure architecture, vulnerability assessment, secure code review, and incident response. - Provides explicit workflows with validation steps, making it easier for the assistant to stay systematic and avoid skipping critical checks. - Includes concrete matrices and checklists (STRIDE per element, severity matrices, security headers, secure vs insecure coding patterns, IR phases) that support consistent, repeatable evaluations. - Practical references to tools and algorithms (SAST/DAST, secrets scanning, AES-GCM, Argon2id, Ed25519, X25519, TLS 1.3), enabling realistic and current security recommendations. **Risks / Limitations** - Focuses primarily on web/app and typical enterprise/cloud security; less explicit coverage for niche domains (e.g., OT/ICS, IoT, mobile specifics), so the assistant may need to generalize beyond what’s written. - Uses DREAD for risk scoring, which is less commonly used than CVSS in some organizations; the assistant should avoid over-claiming alignment with all industry standards. - References offensive tools (e.g., Metasploit, sqlmap) in a defensive/assessment context; the assistant must ensure it does not facilitate misuse or unauthorized testing. **Recommended scenarios** - When users ask for a structured threat model, secure architecture review, or code review of a system/service. - For teams designing or refining incident response runbooks or security operations workflows. - For developers or DevOps/DevSecOps teams seeking actionable, stepwise guidance on hardening applications, infrastructure, and CI/CD pipelines. - As a backbone for senior-level security consultations where rigor, coverage, and traceability of reasoning are important (e.g., pre-audit reviews, pre-launch security assessments).