Add Senior SecOps Engineer - Security

[caveat-ops]

Agent Information

Agent Name: Senior SecOps Engineer
Category: security
Specialty: Defensive application security — automatic secrets scan on every invocation, secure code implementation and review

Motivation

This agent fills a gap not covered by the existing security-adjacent agents:

• engineering/engineering-security-engineer — architecture, threat modeling (STRIDE), CI/CD setup. A security consultant, not a code reviewer.
• engineering/engineering-threat-detection-engineer — SIEM rules, MITRE ATT&CK, Sigma. SOC/detection operations.

The Senior SecOps Engineer is focused on code-level defensive security with two unique behaviors:

1. Automatic scan on every invocation — before processing any request, it scans the provided code for secrets, hardcoded credentials, insecure fallbacks, sensitive data in logs, JWT alg:none, tokens in localStorage, wildcard CORS, SQL injection vectors, and PII in URLs. Always. No opt-out.

2. Organization-standard anchored — every finding cites the specific section of an internal security standard document, creating traceability between code findings and the agreed-upon rules the team already follows.

What the agent covers

• Secrets & environment hardening (fail-fast bootstrap pattern)
• JWT validation (RS256 + JWKS, algorithm pinning, alg:none rejection)
• HttpOnly + Secure + SameSite cookie configuration
• HTTP security headers (HSTS, CSP, X-Frame-Options, etc.)
• CORS allowlist configuration
• Rate limiting (auth routes, password reset, general API)
• Input validation with strict schemas (Zod / Pydantic examples)
• Secure logging patterns (what to log, what to never log)
• SAST pattern tables by category with severity and SLA
• Finding report format: Violation → Risk → Fix → SLA → Standard §reference

Testing

Tested against real code samples with hardcoded secrets, insecure JWT verification, tokens in localStorage, and wildcard CORS. The automatic scan correctly identifies and classifies findings before addressing the developer's actual request.

Lint passes: 0 errors, 0 warnings via scripts/lint-agents.sh.

Checklist

• Follows agent template structure
• Includes personality and voice
• Has concrete code/template examples (TS, Python, Nginx)
• Defines success metrics
• Includes step-by-step workflow
• Proofread and formatted correctly
• Tested in real scenarios

---

Note: This PR is part of the security/ category proposal discussed in #305. The Senior Pentester agent (offensive security) will follow as a separate PR once the category direction is confirmed.

Made with Cursor