Add comprehensive security skills library with 15 specialized domains

[arjunjaggi34]

Summary

This PR introduces a complete security skills library comprising 15 specialized security domains, each with detailed implementation guidance, control frameworks, and operational procedures. The library establishes a structured approach to enterprise security across strategy, operations, compliance, infrastructure, applications, and emerging AI security concerns.

Key Changes

Core Security Skills Added:

• CISO — Enterprise security strategy, risk governance, and multi-domain orchestration
• Security Operations — SOC management, threat detection, incident response coordination
• Threat Hunter — Proactive threat hunting, MITRE ATT&CK-based hypothesis generation, SIEM query development
• Incident Responder — Breach containment, forensic investigation, regulatory notification, post-incident improvement
• Compliance & Governance — Regulatory compliance strategy, framework harmonization, audit lifecycle
• Compliance Auditor — Control testing, evidence collection, SOC 2/ISO 27001/NIST/HIPAA/SOX audit execution
• Industry Compliance — Sector-specific standards (Banking/FFIEC, Healthcare/HITRUST, Hi-Tech/ITAR, Retail/PCI-DSS)
• Infrastructure Security — Cloud/on-premises architecture, Zero Trust principles, IAM strategy
• IAM Specialist — Identity architecture, RBAC/ABAC design, PAM, MFA strategy, lifecycle management
• Network & Data Security — Network architecture, firewall policy, DLP, encryption, database security
• Application Security — Secure SDLC, SAST/DAST/SCA toolchain, OWASP Top 10, vulnerability management
• Penetration Tester — Authorized security assessments, ethical hacking, red team operations
• AI Ethics & Security — AI system governance, agentic AI security, hallucination mitigation, responsible AI
• AI Security Analyst — AI threat modeling, prompt injection detection, LLM hardening, adversarial testing
• Security Trainer — Awareness programs, phishing simulations, role-based curricula, CISO reporting

Reference Materials Added:

• Secure code review checklist (195 lines) — OWASP-aligned code review standards
• Encryption standards reference (186 lines) — Approved algorithms, key lengths, compliance mappings
• AI security controls library (346 lines) — Prompt security, output filtering, model monitoring controls
• Compliance calendar template (176 lines) — Annual compliance activity planning
• Risk register template (144 lines) — Risk scoring methodology and thresholds
• Security frameworks cross-reference map (96 lines) — Control harmonization across SOC 2, ISO 27001, NIST, HIPAA, GDPR, PCI-DSS

Implementation Details

Skill Architecture:

• Each skill includes role definition, multi-phase implementation guidance, and operational procedures
• Skills are interconnected via sub-skill references (e.g., CISO orchestrates all domains; Infrastructure Security delegates to IAM Specialist and Network & Data Security)
• Consistent metadata structure with tags, version, and author attribution

Coverage Areas:

• Detection & Response: SOC, threat hunting, incident response with defined SLAs and escalation procedures
• Compliance: Multi-framework support (SOC 2, ISO 27001, NIST CSF, HIPAA, SOX, GDPR, CCPA, EU AI Act, PCI-DSS, DORA)
• Infrastructure: Zero Trust architecture, cloud security (AWS/Azure/GCP), IAM, encryption, network segmentation
• Application Security: Secure SDLC gates, threat modeling (STRIDE), vulnerability management, pen testing coordination
• AI Security: Prompt injection detection, hallucination mitigation, agentic AI security, regulatory compliance (EU AI Act, NIST AI RMF)
• Training & Culture: Security awareness, phishing simulations, role-based curricula, tabletop exercises

Operational Standards:

• Defined SLOs/SLAs for critical functions (e.g., P1 incident containment within 4 hours)
• Evidence requirements and control testing frequencies
• Risk scoring methodologies and remediation prioritization
• Audit readiness checklists

https://claude.ai/code/session_01DCyDb6K6GYb45Z61GmQ6dN