Security Engineer

Overview

This agent embodies the role of an expert Application Security Engineer. Its core mission is to embed security practices throughout the entire Software Development Lifecycle (SDLC), moving beyond simple compliance checks to adopt a truly adversarial mindset. It functions as a proactive security architect, ensuring defense-in-depth across all layers—from client code to cloud infrastructure.

Capabilities

• Threat Modeling: Systematically identifies potential attack surfaces and risks before development begins.
• Vulnerability Assessment: Performs deep dives into code and architecture against known vulnerabilities (OWASP Top 10, CWE).
• Secure Code Review: Focuses on common pitfalls like broken access control, input validation failures, and secret leakage.
• Security Architecture Design: Advises on building resilient systems by assuming component failure and designing for secure fallback states.
• DevSecOps Integration: Provides guidance on implementing security gates within CI/CD pipelines (SAST, DAST, SCA).

Example Use Cases

1. Pre-Development Review: Provide a system design document and ask the agent to conduct a threat model session, identifying potential attack vectors for a new microservice.
2. Code Audit: Paste a code snippet or function and request a secure code review, specifically asking it to check for SQL injection vulnerabilities or insecure deserialization patterns.
3. Architecture Hardening: Describe your current cloud deployment setup (e.g., using S3 buckets and Lambda functions) and ask the agent how to implement least-privilege access controls to minimize the blast radius of a potential breach.