Cloud & Infra Security

Harden Windows workstations and servers to CIS Benchmark settings for audits

Run AWS Config rules for continuous CIS and PCI checks with SSM auto-remediation

Set AWS IAM permission boundaries that cap what delegated roles can grant

Set up Amazon Macie to find PII and credentials in S3 buckets and automate alerts

Build Nitro Enclaves with attestation-aware KMS policies to process secrets in isolation

Deploy AWS Security Hub to aggregate findings and automate remediation across accounts

Roll out Security Hub across AWS Organizations with CIS and PCI standards

Turn standing Entra admin roles into time-bound PIM eligibility with approval and MFA

Enable Defender for Cloud across VMs, containers, SQL and storage with Azure Policy

Build BeyondCorp zero trust access with IAP, device checks and VPN-less app access

Set up RPKI route origin validation with ROAs, validators and router ROV policies

Deploy remote browser isolation with file sanitization and DLP for zero trust web access

Assess and grow zero trust maturity across the five CISA model pillars

Find and classify PII in cloud storage with Macie, Purview and Google Cloud DLP

Monitor multi-cloud posture for misconfigurations and compliance gaps with Prowler

Find cloud misconfigurations and vulnerabilities across AWS, Azure and GCP with CSPM scans

Design Entra Conditional Access with device compliance, risk checks and named locations

Secure OT vendor access with jump servers, MFA gateways and session recording

Write Calico global policies, host endpoints and DNS-based egress rules

Set up Microsoft Purview DLP for Exchange, SharePoint, Teams and endpoints with labels

Configure Cloudflare DDoS protection with managed rules, rate limits and bot management

Vault privileged credentials in Delinea Secret Server with auto rotation

Gate app access on device health from CrowdStrike, Intune and Jamf in conditional access

Deploy BitLocker full disk encryption on Windows endpoints for lost or stolen devices

Encrypt data with local data keys wrapped by AWS KMS keys in envelope encryption

Allow only signed, attested container images to deploy to GKE and Cloud Run

Enforce GCP org policy guardrails like external IP and service account key limits

Audit and tighten GCP VPC firewall rules and hierarchical policies with flow logs

Harden Google Workspace with phishing-resistant MFA, OAuth controls and sharing limits

Set up SAML SSO for Google Workspace with Okta, Entra ID or ADFS as the IdP

Deploy Tofino industrial firewalls to filter Modbus, EtherNet/IP and S7 traffic to PLCs

Run SailPoint identity governance for access requests, certifications and SOD checks

Verify identity continuously with FIDO2 MFA and risk-based conditional access

Partition ICS networks into IEC 62443 security zones and conduits with target levels

Scan Terraform, CloudFormation, Kubernetes and Helm with Checkov, tfsec and KICS

Grant temporary privileged access just in time with approvals and automatic revocation

Install Calico as the CNI and write default-deny Kubernetes network policies

Map Kubernetes workloads to Privileged, Baseline or Restricted pod security profiles

Map east-west traffic and set least-privilege segmentation rules with Guardicore

Protect corporate data on BYOD phones with app policies, selective wipe and containers

Enforce 802.1X port access with RADIUS, posture checks and automatic VLAN assignment

Deploy Cisco ISE for 802.1X, MAC bypass, posture checks and dynamic VLANs

Write portable Kubernetes NetworkPolicies with default-deny rules for any conformant CNI

Segment flat OT networks into Purdue levels with VLANs, data diodes and conduits

Design firewall security zones and inter-zone ACLs to limit east-west lateral movement

Configure Palo Alto firewalls with App-ID, User-ID, SSL decryption and threat profiles

Enforce policy at Kubernetes admission with OPA Gatekeeper and Rego constraints

Proxy database admin sessions with credential vaulting and query auditing

Roll out passwordless sign-in in Entra ID with FIDO2 keys and passkeys