senior-secops

name: senior-secopsdescription: >  SecOps for application security, vulnerability management, compliance, and secure  development. Use when implementing security controls, conducting security audits, responding  to vulnerabilities, or meeting compliance requirements.license: MIT + Commons Clausemetadata:   version: 1.1.0  author: borghei  category: engineering  domain: security-operations  updated: 2026-06-17  tags:     - security-operations    - vulnerability-management    - incident-response    - siem

Senior SecOps Engineer

The agent scans source code for security vulnerabilities (hardcoded secrets, SQL injection, XSS, command injection), assesses dependency CVEs across npm/Python/Go ecosystems, and verifies compliance against SOC 2, PCI-DSS, HIPAA, and GDPR frameworks.

Core Capabilities

• Security scanner — detect hardcoded secrets, SQL injection, XSS, command injection, and path traversal in source code.
• Vulnerability assessor — scan npm / Python / Go dependency manifests for known CVEs with CVSS scores, fixed versions, and a 0-100 risk score.
• Compliance checker — verify SOC 2, PCI-DSS, HIPAA, and GDPR controls (access control, encryption, audit logging, auth strength).
• Security workflows — audit, CI/CD security gate, CVE triage (with SLA tiers), and 5-phase incident response.
• Standards & secure coding — OWASP Top 10 prevention, secure-coding checklist, and language-specific BAD/GOOD patterns.

When to Use

• Implementing security controls or hardening a codebase.
• Conducting a security audit or pre-release security pass.
• Responding to or triaging a newly disclosed CVE.
• Meeting SOC 2, PCI-DSS, HIPAA, or GDPR compliance requirements.
• Wiring SAST/dependency/compliance gates into CI/CD.

Clarify First

Before the security pass, settle the inputs below. When one is missing or vague and would change the result, ask about it; when it wouldn't, use a sensible default and say which one you used.

• Target path: the codebase or dependency manifest to scan (the subject of every scanner).
• Compliance framework: SOC 2 / PCI-DSS / HIPAA / GDPR (--framework; changes which controls are verified).
• Severity threshold: the minimum severity to report or gate on (--severity; changes the report and CI pass/fail).

Ask about the two or three inputs that matter most for this request, not the whole list. If the user wants a result straight away, produce it and state your assumptions at the top.

Tools

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

• references/workflows-and-tooling.md — capability command reference, the 4 workflows (audit, CI/CD gate, CVE triage, incident response), full per-script flag/output/exit-code tables, and the tech stack. Read when running a workflow or invoking a script with specific flags.
• references/standards-and-playbook.md — OWASP Top 10 prevention table, secure-coding checklist, SOC 2 / PCI-DSS / HIPAA / GDPR control tables, secure-coding BAD/GOOD code patterns, anti-patterns, troubleshooting table, and success criteria. Read when applying standards or diagnosing scanner behavior.
• references/security_standards.md — deep OWASP Top 10 with code, secure coding practices, authentication standards, API security, and secrets management. Read for in-depth secure-coding guidance.
• references/vulnerability_management_guide.md — vulnerability lifecycle, CVE triage process, CVSS scoring, remediation workflows, and dependency scanning. Read when managing CVEs end to end.
• references/compliance_requirements.md — full SOC 2 / PCI-DSS / HIPAA / GDPR control detail, evidence collection, compliance automation, and audit preparation. Read when preparing for an audit.

Scope & Limitations

This skill covers:

• Static analysis of source code for common vulnerability classes (secrets, injection, XSS, command injection, path traversal).
• Dependency vulnerability assessment against a built-in CVE database for npm, Python, and Go ecosystems.
• Compliance verification for SOC 2 Type II, PCI-DSS v4.0, HIPAA Security Rule, and GDPR.
• Security workflow orchestration including CI/CD gating, CVE triage, and incident response procedures.

This skill does NOT cover:

• Dynamic application security testing (DAST) or runtime analysis -- use OWASP ZAP or Burp Suite for live scanning.
• Infrastructure-as-code security (Terraform, CloudFormation misconfigurations) -- see the senior-devops skill for IaC hardening.
• Container image scanning or Kubernetes admission control -- see the senior-devops skill or use Trivy directly.
• Penetration testing execution or red-team operations -- these require specialized tooling and authorized human operators.

Integration Points