Cloud & Infra Security

Deploy CyberArk PAM to vault, rotate and monitor privileged credentials

Build Privileged Access Workstations with tiered admin, device hardening and JIT access

Record and monitor privileged sessions with CyberArk PSM and keystroke logging

Split ICS networks into Purdue Levels 0 to 5 with IEC 62443 DMZs between OT and IT

Shrink Kubernetes RBAC to least-privilege roles and remove cluster-admin sprawl

Block dangerous syscalls in Kubernetes with eBPF-based Tetragon enforcement

Set up SAML SSO with Okta for attribute mapping, certificate rotation and logout

Automate user provisioning and deprovisioning from Okta to apps with SCIM 2.0

Replace standing cloud admin rights with ephemeral JIT roles through CyberArk SCA

Secure Microsoft 365, Slack and Salesforce with CASB, SSPM and OAuth app controls

Apply NIST SP 800-207 zero trust across AWS, Azure and GCP with identity-centric access

Replace VPN access with identity-aware proxies and micro-segmentation in the cloud

Broker user access to internal apps through Zscaler Private Access without VPNs

Enforce access to web apps with BeyondCorp IAP and Access Context Manager device levels

Install HashiCorp Boundary as a default-deny proxy with Vault-brokered credentials

Run Okta for cloud SSO, FastPass MFA, user provisioning and adaptive access policies

Run Saviynt access recertification to revoke excess entitlements

Scope and run access reviews with risk-based priorities and remediation tracking

Run ScoutSuite read-only against an AWS account to map misconfigurations in an HTML report

Load AWS, GCP and Azure assets into Neo4j with Cartography to map IAM and trust paths

Audit pods for privileged flags, host mounts and dangerous Linux capabilities

Run SailPoint IdentityIQ access certifications to revoke SOD violations and excess access

Audit GCP IAM, firewall and storage against CIS benchmarks with Forseti and SCC

Turn kube-bench results into a CIS Kubernetes audit with remediation and evidence

Check etcd encryption at rest, TLS, access control and backups in Kubernetes

Review privileged accounts for excess rights and stale access across PAM systems

Inventory privileged accounts across AD, cloud IAM and databases with risk ratings

Review Lambda, Azure Functions and Cloud Functions for risky roles and injection

Find orphaned and over-privileged service accounts in AD and cloud platforms

Automate service account password and API key rotation across AD and cloud

Fix exposed S3 buckets with Block Public Access, policy audits and AWS Config rules

Protect API Gateway endpoints with AWS WAF managed rules and rate limits

Enforce least-privilege AWS IAM with scoped policies and permission boundaries

Write least-privilege Lambda execution roles with boundaries and Access Analyzer

Set up Microsoft Defender for Cloud plans, recommendations and Secure Score on Azure

Verify Helm chart signatures, lint templates and move secrets out of values files

Harden process historians like OSIsoft PI placed in OT networks

Harden EKS, AKS and GKE with pod security standards, network policies and RBAC

Design jump server access with MFA and session recording for OT and vendors

Harden serverless functions with least-privilege IAM and secrets management

Review Google Cloud workloads for IAM, network and data protection gaps using WAF

Monitor security and configure Google Workspace settings as an IT admin

Find cloud misconfigurations, IAM escalation paths and open security groups

Audit Filestore instances for backups, NFS export rules and zone isolation

Query Security Command Center findings, exposures and toxic combinations

Fix Security Command Center findings for IAM, misconfigurations and vulnerabilities

Review Google Cloud workloads for IAM, network and data security gaps

Create, update and delete IAM allow and deny policies on Google Cloud

Simulate IAM policy changes with Policy Simulator before applying them