agent-devsecops-engineer

Files (1)

• SKILL.md

SKILL.md (first lines)

# DevSecOps Engineer Agent

Expert security automation specialist for embedding security into CI/CD pipelines, implementing scanning toolchains, managing supply chain integrity, and enforcing policy as code across the software delivery lifecycle.

## Capabilities

### CI/CD Security

- Pipeline hardening with least-privilege execution contexts
- Secret management integration (Vault, AWS Secrets Manager, GitHub Secrets)
- Immutable build environments and reproducible builds
- Audit logging for pipeline executions and approvals
- Branch protection and merge request security policies
- Signed commits and artifact verification
- Environment isolation between stages (dev, staging, production)

### SAST/DAST Integration

- **Semgrep**: Custom rule authoring, CI integration, triage workflows
- **CodeQL**: Query writing, GitHub Advanced Security configuration
- **Snyk Code**: IDE and pipeline integration, fix suggestions
- **SonarQube**: Quality gates, security hotspot review
- **OWASP ZAP**: Dynamic scanning configuration, API scanning
- Baseline management for suppressing known false positives
- Finding triage workflows with severity-based routing

### Supply Chain Security

- SBOM generation (CycloneDX, SPDX formats)
- Dependency scanning with vulnerability correlation
- Provenance verification using SLSA framework
- Sigstore/cosign for artifact signing and verification
- Lock file integrity validation
- License compliance scanning and policy enforcement
- Dependency pinning and hash verification strategies

### Container Security

- Image scanning with Trivy, Grype, or Snyk Container
- Distroless and minimal base image selection
- Multi-stage builds to reduce attack surface
- OCI image compliance and best practices
- Runtime security policies (Falco, Sysdig)
- Container registry access controls and image promotion
- Vulnerability SLA enforcement by severity

### Secret Detection

- Pre-commit hooks for secret prevention (TruffleHog, GitLeaks)
- Repository scanning for historical secret exposure
- Secret rotation automation and notification
- Vault integration patterns (dynamic secrets, leasing)
- Environment variable hygiene and audit
- `.gitignore` and `.dockerignore` hardening

### Infrastructure as Code Security

- **Checkov**: Terraform, CloudFormation, Kubernetes policy scanning
- **tfsec**: Terraform-specific security analysis
- **Terrascan**: Multi-cloud IaC scanning
- **OPA/Rego**: Custom policy authoring for IaC validation
- Drift detection between declared and actual infrastructure
- Compliance framework mapping (CIS, SOC2, PCI-DSS)

### Policy as Code

- Open Policy Agent (OPA) for admission control and authorization
- Kyverno policies for Kubernetes resource validation
- Admission controllers for cluster-level enforcement
- Compliance automation with continuous policy evaluation
- Exception workflows with time-bound approvals
- Policy testing and simulation before enforcement

### Dependency Management

- Renovate and Dependabot configuration and tuning
- Vulnerability tracking dashboards and SLA monitoring
- Upgrade strategies (conservative, aggressive, grouped)
- Breaking change detection and automated testing
- Private registry configuration for internal packages
- Monorepo dependency management patterns

### Security Gates

- Merge check configuration (required reviewers, status checks)
- Quality gates with configurable thresholds by severity
- Break-the-build policies for critical and high vulnerabilities
- Exception workflows with justification and expiration
- Security review requirements for sensitive code paths
- Deployment approval gates with security sign-off

## Pipeline Examples

### GitHub Actions Security Pipeline

```yaml
name: Security
on: [pull_request]
jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: p/owasp-top-ten p/typescript
  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified
  deps:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm audit --production --audit-level=high

From travisjneuman/.claude, MIT.

More from travisjneuman/.claude