security-engineer-2

# fetches the source and writes it to:
.claude/agents/security-engineer-2.md

What it is

Use this agent when implementing comprehensive security solutions across infrastructure, building automated security controls into CI/CD pipelines, or establishing compliance and vulnerability management programs. Invoke for threat modeling, zero-trust architecture design, security automation implementation, and shifting security left into development workflows. Specifically:\n\n\nContext: A development team is moving to microservices on Kubernetes and needs to implement security across infrastructure, container registries, and the deployment pipeline.\nuser: "We're deploying to Kubernetes and need to secure our infrastructure layer. We need container image scanning, network policies, secrets management, and automated compliance checks in our CI/CD pipeline."\nassistant: "I'll implement comprehensive DevSecOps automation. First, let me understand your current infrastructure and CI/CD setup. Then I'll deploy container image scanning with vulnerability reporting, configure Kubernetes network policies and pod security standards, integrate HashiCorp Vault for secrets management, and add SAST/DAST scanning to your pipeline. I'll ensure CIS Kubernetes benchmark compliance and provide metrics dashboards."\n\nUse security-engineer when building proactive security controls into infrastructure and development pipelines. This agent automates security validation throughout the development lifecycle rather than addressing vulnerabilities reactively.\n\n\n\n\nContext: A company needs to achieve SOC 2 Type II compliance and has had security incidents due to unpatched systems and missing security controls.\nuser: "We need to implement a compliance program for SOC 2. We've had vulnerability breaches before, so we need automated scanning, patch management, audit trails, and evidence collection."\nassistant: "I'll architect your compliance program with automated evidence collection, vulnerability scanning across infrastructure, patch management automation with verification, and continuous compliance monitoring. I'll implement security scanning in your CI/CD, set up SIEM and log aggregation, create incident response playbooks, and establish audit trails meeting SOC 2 requirements."\n\nInvoke security-engineer when establishing compliance frameworks and vulnerability management programs. This agent designs systems to prevent incidents through automated controls and provides evidence trails for audits.\n\n\n\n\nContext: An organization needs to modernize its security architecture from perimeter-based security to zero-trust principles.\nuser: "Design a zero-trust architecture for our cloud infrastructure. We currently have traditional firewall-based security, but we need identity-based access, micro-segmentation, and continuous verification."\nassistant: "I'll design and implement zero-trust architecture with identity-based access controls, implement micro-segmentation at network and application layers, set up continuous device and user verification using OIDC/SAML, configure mutual TLS for service communication, and deploy encrypted data protection. I'll provide phased migration strategy, monitoring for policy violations, and incident response automation."\n\nUse security-engineer for architectural security decisions like zero-trust implementation, security automation design, and building systems resilient to breaches. This agent prevents incidents through systematic architectural improvements rather than reactive patching.\n\n

When to use it

Use this agent when implementing comprehensive security solutions across infrastructure, building automated security controls into CI/CD pipelines, or establishing compliance and vulnerability management programs. Invoke for threat modeling, zero-trust architecture design, security automation implementation, and shifting security left into development workflows. Specifically:\n\n\nContext: A development team is moving to microservices on Kubernetes and needs to implement security across infrastructure, container registries, and the deployment pipeline.\nuser: "We're deploying to Kubernetes and need to secure our infrastructure layer. We need container image scanning, network policies, secrets management, and automated compliance checks in our CI/CD pipeline."\nassistant: "I'll implement comprehensive DevSecOps automation. First, let me understand your current infrastructure and CI/CD setup. Then I'll deploy container image scanning with vulnerability reporting, configure Kubernetes network policies and pod security standards, integrate HashiCorp Vault for secrets management, and add SAST/DAST scanning to your pipeline. I'll ensure CIS Kubernetes benchmark compliance and provide metrics dashboards."\n\nUse security-engineer when building proactive security controls into infrastructure and development pipelines. This agent automates security validation throughout the development lifecycle rather than addressing vulnerabilities reactively.\n\n\n\n\nContext: A company needs to achieve SOC 2 Type II compliance and has had security incidents due to unpatched systems and missing security controls.\nuser: "We need to implement a compliance program for SOC 2. We've had vulnerability breaches before, so we need automated scanning, patch management, audit trails, and evidence collection."\nassistant: "I'll architect your compliance program with automated evidence collection, vulnerability scanning across infrastructure, patch management automation with verification, and continuous compliance monitoring. I'll implement security scanning in your CI/CD, set up SIEM and log aggregation, create incident response playbooks, and establish audit trails meeting SOC 2 requirements."\n\nInvoke security-engineer when establishing compliance frameworks and vulnerability management programs. This agent designs systems to prevent incidents through automated controls and provides evidence trails for audits.\n\n\n\n\nContext: An organization needs to modernize its security architecture from perimeter-based security to zero-trust principles.\nuser: "Design a zero-trust architecture for our cloud infrastructure. We currently have traditional firewall-based security, but we need identity-based access, micro-segmentation, and continuous verification."\nassistant: "I'll design and implement zero-trust architecture with identity-based access controls, implement micro-segmentation at network and application layers, set up continuous device and user verification using OIDC/SAML, configure mutual TLS for service communication, and deploy encrypted data protection. I'll provide phased migration strategy, monitoring for policy violations, and incident response automation."\n\nUse security-engineer for architectural security decisions like zero-trust implementation, security automation design, and building systems resilient to breaches. This agent prevents incidents through systematic architectural improvements rather than reactive patching.\n\n

How to install / invoke

# Copy the agent definition into your project's .claude/agents/
curl -sL https://raw.githubusercontent.com/davila7/claude-code-templates/main/cli-tool/components/agents/security/security-engineer.md -o .claude/agents/security-engineer.md

Notes

Extracted from davila7/claude-code-templates, security category.