Frameworks & Standards:
  - NIST Cybersecurity Framework (CSF)
  - CIS Critical Security Controls
  - Zero Trust Architecture (ZTA)
  - Third-Party Risk Management (TPRM)

AWS Security Services:
  IAM & Identity:
    - IAM Identity Center (AWS SSO)
    - IAM roles, policies, SCPs
    - IRSA (IAM Roles for Service Accounts)
    - Cross-account access patterns

  Data Protection:
    - KMS (Key Management Service)
    - CloudHSM (Hardware Security Modules)
    - Secrets Manager
    - Certificate Manager (ACM)
    - Macie (Data Discovery & DLP)

  Threat Detection:
    - GuardDuty (Threat Detection)
    - Security Hub (Security Findings)
    - Detective (Security Investigation)
    - Inspector (Vulnerability Management)
    - Config (Compliance Monitoring)

  Network Security:
    - Network Firewall
    - WAF (Web Application Firewall)
    - Shield (DDoS Protection)
    - VPC Security (SGs, NACLs)
    - PrivateLink, Transit Gateway

Implementation Experience:
  Requirement 1: Network Security Architecture
    - Network segmentation and isolation
    - Firewall rule management
    - DMZ configuration

  Requirement 2: Secure System Configurations
    - CIS benchmark hardening
    - Automated compliance scanning
    - Configuration management

  Requirement 3: Data Protection
    - Encryption at rest (KMS, AES-256)
    - Tokenization (60% scope reduction)
    - Key management and rotation

  Requirement 4: Secure Transmission
    - TLS 1.3 enforcement
    - Mutual TLS (mTLS) via Istio
    - Certificate management

  Requirement 5: Malware Protection
    - EDR deployment (Wazuh agents)
    - GuardDuty for threat detection
    - Container image scanning

  Requirement 6: Secure Development
    - SAST, DAST, SCA integration
    - Secure SDLC implementation
    - Code review and approval gates

  Requirement 7: Access Control
    - RBAC implementation
    - Least privilege principle
    - JIT (Just-In-Time) access

  Requirement 8: Authentication
    - MFA enforcement
    - SSO integration
    - Password policies
    - Session management

  Requirement 9: Physical Security
    - AWS shared responsibility model
    - Data center compliance

  Requirement 10: Logging & Monitoring
    - Centralized logging (CloudTrail, VPC Flow)
    - SIEM integration (Wazuh)
    - Log retention and immutability

  Requirement 11: Security Testing
    - Vulnerability scanning (ASV)
    - Penetration testing
    - IDS/IPS deployment

  Requirement 12: Security Policies
    - Policy documentation
    - Security awareness training
    - Incident response plans

Wazuh SIEM:
  - HA cluster deployment
  - 200+ agent management
  - 500+ custom security rules
  - File Integrity Monitoring (10,000+ files)
  - PCI DSS compliance dashboard
  - Active response automation
  - Vulnerability management
  - CIS benchmark scanning

Security Onion:
  - Network Detection and Response (NDR)
  - Full packet capture analysis
  - Zeek and Suricata IDS/IPS
  - Integration with Wazuh
  - Threat hunting capabilities

Other SIEM:
  - Splunk (basic knowledge)
  - ELK Stack (OpenSearch/Elasticsearch)

SAST (Static Application Security Testing):
  - SonarQube
  - Semgrep
  - GitLab SAST

DAST (Dynamic Application Security Testing):
  - OWASP ZAP
  - Burp Suite (basic)

SCA (Software Composition Analysis):
  - Trivy
  - Snyk
  - Clair
  - Grype

Container & IaC Security:
  - Trivy (containers + IaC)
  - Checkov (IaC)
  - tfsec (Terraform)
  - Terrascan
  - Aqua Security (basic)

Secret Detection:
  - Gitleaks
  - TruffleHog
  - GitLab Secret Detection

Cluster Security:
  - Control Plane logging to CloudWatch
  - Secrets encryption with AWS KMS
  - Private cluster endpoints
  - IAM Roles for Service Accounts (IRSA)
  - Network policies enforcement

Pod Security:
  - Pod Security Standards (PSS)
  - Security Context constraints
  - Read-only root filesystems
  - Non-root containers
  - Capabilities dropping

Admission Control:
  - OPA Gatekeeper policies
  - Policy as Code enforcement
  - Custom admission webhooks
  - Image signature validation

Service Mesh Security:
  - Istio for mTLS (mutual TLS)
  - Fine-grained authorization
  - Traffic encryption
  - Zero-trust networking
  - Rate limiting and circuit breaking

Runtime Security:
  - Falco for runtime threat detection
  - Behavioral monitoring
  - Anomaly detection

Container Image Security:
  - ECR (Elastic Container Registry)
  - Image scanning (Trivy, Clair)
  - Image signing (Cosign)
  - Distroless/Alpine base images
  - Multi-stage builds

Compute:
  - EC2, Auto Scaling, ELB/ALB/NLB
  - EKS (Elastic Kubernetes Service)
  - Fargate (serverless containers)
  - Lambda (serverless functions)

Networking:
  - VPC (Virtual Private Cloud)
  - Transit Gateway (hub-and-spoke)
  - PrivateLink, VPN, Direct Connect
  - Route 53 (DNS)
  - CloudFront (CDN)

Storage:
  - S3 (with encryption and lifecycle)
  - EBS, EFS
  - Glacier (archival)

Database:
  - RDS (PostgreSQL, MySQL)
  - Aurora (PostgreSQL, MySQL)
  - DynamoDB
  - ElastiCache (Redis)

Management & Governance:
  - Organizations & Control Tower
  - CloudFormation
  - Systems Manager
  - CloudWatch, CloudTrail
  - Cost Explorer, Budgets

Experience:
  - 1000+ AWS resources managed
  - Terragrunt for DRY configuration
  - Remote state management (S3 + DynamoDB)
  - Module development and reusability
  - Migration from Terraform to OpenTofu

Security Integration:
  - Checkov for compliance scanning
  - tfsec for security checks
  - Terrascan for policy enforcement
  - Sentinel for policy as code
  - Automated plan review in CI/CD

Best Practices:
  - State file encryption
  - Secret management integration
  - Drift detection
  - Cost estimation (Infracost)

Ansible:
  - AWX/Tower deployment on EKS
  - 200+ CIS hardening tasks
  - Playbook development
  - Role creation and Galaxy usage
  - Dynamic inventory (AWS, GCP)

Others:
  - Chef (basic knowledge)
  - Puppet (basic knowledge)

Pipeline Development:
  - Multi-stage pipelines (build, test, scan, deploy)
  - Security gates integration
  - Dynamic environments
  - Approval workflows
  - Parallel execution
  - Caching strategies

Security Integration:
  - SAST, DAST, SCA
  - Container scanning
  - IaC scanning
  - Secret detection
  - License compliance

GitOps:
  - GitLab + ArgoCD integration
  - Automated deployments
  - Rollback capabilities

Deployment:
  - Vault on EKS (HA configuration)
  - Auto-unseal with AWS KMS
  - Consul storage backend

Secrets Engines:
  - Dynamic secrets for databases
  - AWS credentials (STS)
  - PKI for certificate management
  - KV secrets engine

Authentication:
  - Kubernetes auth method
  - AWS IAM auth
  - AppRole for applications

Certification:
  - HashiCorp Vault Operations Professional

Prometheus Ecosystem:
  - Prometheus for metrics collection
  - Thanos for long-term storage
  - Grafana for visualization
  - AlertManager for alerting
  - Service monitors and pod monitors

Exporters:
  - Node exporter
  - Kube-state-metrics
  - Blackbox exporter
  - Custom exporters

Dashboards:
  - Infrastructure monitoring
  - Application performance
  - Security metrics
  - Cost tracking

ELK Stack:
  - Elasticsearch/OpenSearch
  - Logstash/Vector/Fluentd
  - Kibana for visualization
  - Index lifecycle management

Loki Stack:
  - Loki for log aggregation
  - Promtail for log collection
  - Grafana integration

Cloud Native:
  - CloudWatch Logs
  - CloudWatch Insights
  - Log Groups and Streams

PostgreSQL:
  - Aurora PostgreSQL (production)
  - RDS PostgreSQL
  - Performance tuning
  - Replication and HA
  - Backup and recovery

MySQL:
  - Aurora MySQL
  - RDS MySQL
  - Query optimization

Firewall & IDS/IPS:
  - AWS Network Firewall
  - OPNsense (firewall/IDS)
  - Suricata (IDS/IPS)
  - iptables/nftables

Network Architecture:
  - Hub-and-spoke topology
  - Transit Gateway
  - VPC peering
  - Network segmentation
  - Micro-segmentation
  - Zero Trust networking

VPN & Remote Access:
  - Site-to-Site VPN
  - Client VPN
  - WireGuard
  - OpenVPN

Load Balancing:
  - Application Load Balancer (ALB)
  - Network Load Balancer (NLB)
  - Nginx
  - HAProxy

Proficient:
  - Python: Automation, scripting, tools development
  - Bash: Shell scripting, system automation
  - HCL: Terraform/Packer configuration
  - YAML: Configuration management
  - SQL: Database queries and optimization

Basic/Working Knowledge:
  - Go: Kubernetes operators, tools
  - JavaScript/Node.js: Basic web development
  - Ruby: Basic scripting

Git:
  - Advanced branching strategies
  - Git workflows (GitFlow, trunk-based)
  - Rebase, cherry-pick, bisect
  - Submodules and subtrees

Platforms:
  - GitLab: Self-hosted, CI/CD
  - GitHub: Public repositories, Actions
  - Bitbucket: Basic knowledge

Distributions:
  - Ubuntu/Debian (primary)
  - Amazon Linux 2/2023
  - CentOS/RHEL
  - Alpine (containers)

System Administration:
  - Systemd service management
  - Package management (apt, yum, dnf)
  - User and permission management
  - Filesystem management (LVM, RAID)
  - Performance tuning
  - Kernel parameters tuning

Security Hardening:
  - CIS benchmarks implementation
  - SELinux/AppArmor
  - Firewall configuration
  - SSH hardening
  - Audit logging

Kubernetes:
  - Velero for cluster backups
  - Persistent volume snapshots
  - Automated backup schedules

AWS Native:
  - AWS Backup
  - EBS snapshots
  - RDS automated backups
  - S3 versioning and lifecycle

Database:
  - Point-in-time recovery (PITR)
  - Cross-region replication
  - Automated backup verification

Strategies:
  - RPO/RTO definition
  - 3-2-1 backup rule
  - DR testing and validation

HashiCorp:
  ✓ Terraform Associate
  ✓ Vault Operations Professional

AWS (Udemy Completed):
  ✓ Security Specialty
  ✓ Solutions Architect Professional
  ✓ DevOps Engineer Professional
  ✓ Advanced Networking Specialty
  ✓ SysOps Administrator
  ✓ Cloud Practitioner

Kubernetes & Cloud Native:
  ✓ Istio Hands-On for Microservices
  ✓ AWS EKS Masterclass
  ✓ Kubernetes Security Best Practices

Security & Compliance:
  ✓ DevSecOps with GitLab
  ✓ PCI DSS Implementation (on-the-job)

Monitoring & Observability:
  ✓ Prometheus & Grafana
  ✓ Elasticsearch 7 Complete Guide
  ✓ Zabbix 6 Certification

Development & Tools:
  ✓ Apache Kafka Series
  ✓ Complete Git Guide
  ✓ SQL & PostgreSQL for Beginners

Currently Exploring:
  - AI/ML-driven security (anomaly detection)
  - Quantum-resistant cryptography
  - Confidential computing (AWS Nitro Enclaves)
  - eBPF for security and observability
  - Service mesh evolution (Cilium, Linkerd)

On Roadmap:
  - CISSP Certification
  - AWS Security Specialty (official cert)
  - Certified Kubernetes Security Specialist (CKS)
  - GIAC Security Certifications