diff --git a/content/pages/about.md b/content/pages/about.md index d93c416c..66e39e63 100644 --- a/content/pages/about.md +++ b/content/pages/about.md @@ -3,79 +3,37 @@ Slug: about Author: RivasSec Summary: Security engineer profile - cloud-native infrastructure security, Kubernetes and AWS IAM hardening, compliance automation. -## DevSecOps | Infrastructure Security | Automation +## Staff Security Engineer - Cloud & Platform Security -Cloud-native security engineer focused on designing hardened infrastructure, building scalable security pipelines, and implementing pragmatic compliance automation to support secure and efficient cloud operations. - ---- - -### Writing & Blog - -Insights on Kubernetes security, IAM hardening, incident retrospectives, and security automation: - [**rivassec.com**](https://rivassec.com) +I build and ship security controls in public: an AWS IAM blast-radius +analyzer with a live tool, a Pulumi IAM library with safe defaults, and +a threat-model addendum for the case where the operator is the adversary. +Most of my day-job security work happens in private repositories, so this +profile shows the side of it I can build in public. --- -### GitHub Stats +### Projects -![Top Language](https://img.shields.io/github/languages/top/rivassec/secure-iam-lint?color=blue&label=Top%20Language) -![Stars](https://img.shields.io/github/stars/rivassec/secure-iam-lint?style=social) -![Last Commit](https://img.shields.io/github/last-commit/rivassec/secure-iam-lint) +* [`secure-iam-lint`](https://github.com/rivassec/secure-iam-lint) - Client-side AWS IAM policy blast-radius analyzer (fail-closed, zero-backend); powers the live tool at [rivassec.com/tools/iam-blast-radius](https://rivassec.com/tools/iam-blast-radius/). [Testing an IAM Analyzer Against Its Own Claims](https://rivassec.com/testing-an-iam-analyzer-against-its-own-claims.html) +* [`iam-safe-defaults`](https://github.com/rivassec/iam-safe-defaults) - Pulumi component library for AWS IAM with safe defaults that fail loud: mandatory permissions boundary, no wildcard trust, every opt-out explicit. [IAM Roles That Fail Loud](https://rivassec.com/iam-safe-defaults-fail-loud.html) +* [`weaponization-threat-model`](https://github.com/rivassec/weaponization-threat-model) - One-page addendum to STRIDE/LINDDUN/PASTA for modeling the legitimate operator as the adversary. Applied in [When Telemetry Turns Predatory](https://rivassec.com/telemetry-turns-predatory.html) +* [`devsecops-notes`](https://github.com/rivassec/devsecops-notes) - Source for [rivassec.com](https://rivassec.com): Pelican with link-check, accessibility (pa11y), and gitleaks CI. +* Smaller and archival: [`cf-token-links`](https://github.com/rivassec/cf-token-links) (token-scoped redirects), [`elasticsearch-tools`](https://github.com/rivassec/elasticsearch-tools) (least-privilege snapshot verification), [`efi-bruteforce`](https://github.com/rivassec/efi-bruteforce) (2013 Teensy EFI research, featured on Hackaday). --- -### Security-Focused Contributions - -* [`secure-iam-lint`](https://github.com/rivassec/secure-iam-lint) - CI-ready IAM policy linter to detect insecure patterns early in development -* [`cf-token-links`](https://github.com/rivassec/cf-token-links) - Flask-based microservice for generating expiring access links -* [`eks-rbac-audit`](https://github.com/rivassec/eks-rbac-audit) - RBAC role analyzer for Kubernetes focused on privilege escalation detection -* [`elasticsearch-tools`](https://github.com/rivassec/elasticsearch-tools) - Hardened snapshot verification scripts with Prometheus observability -* [`tw-disinfo-defense`](https://github.com/rivassec/tw-disinfo-defense) - Toolkit for investigating Twitter disinformation using OAuth automation -* [`efi-bruteforce`](https://github.com/rivassec/efi-bruteforce) - Early research into USB-based EFI input automation (featured on Hackaday) +### Writing - [rivassec.com](https://rivassec.com) ---- +Start here: [Testing an IAM Analyzer Against Its Own Claims](https://rivassec.com/testing-an-iam-analyzer-against-its-own-claims.html). Latest: -### Professional Contributions - -Work under [@oliveratprimer](https://github.com/oliveratprimer) includes: - -* Designing FedRAMP-aligned security automation pipelines -* Deploying Zero Trust and hardened Kubernetes environments -* Building CI/CD workflows that support compliance and audit readiness + +- [Every Alert Is Your Alert: When IR Tooling Trips Your Own EDR](https://rivassec.com/every-alert-is-your-alert.html) +- [Finding the Cryptominer Hiding in a Docker overlay2 Layer](https://rivassec.com/cryptominer-in-the-docker-layer.html) +- [When Telemetry Turns Predatory: A DevSecOps Look at Digital Repression in Venezuela](https://rivassec.com/telemetry-turns-predatory.html) + --- -### Toolbox - -* **Infrastructure:** AWS, EKS, Terraform, Pulumi, CloudFormation -* **Security:** IAM, RBAC, CIS Benchmarks, FIPS, Zero Trust -* **Tooling:** Trivy, Checkov, Vault, CrowdStrike, GitHub Actions -* **Languages:** Python, Bash, YAML (daily use), Go (familiar) - ---- - -### Areas of Focus - -* Scaling Kubernetes and AWS hardening efforts -* Policy-as-code pipelines for audit-driven security automation -* Tooling that bridges security assurance and developer velocity -* Embedding compliance into infrastructure and CI/CD workflows -* Reproducibility and observability in DevSecOps systems - ---- - -### Featured Projects - -* [`secure-iam-lint`](https://github.com/rivassec/secure-iam-lint) - Linter for AWS IAM policies, designed to prevent privilege escalation and misconfigurations in CI pipelines. -* [`eks-rbac-audit`](https://github.com/rivassec/eks-rbac-audit) *(in progress)* - Kubernetes RBAC analyzer to surface overly permissive roles and privilege escalation vectors. -* [`cf-token-links`](https://github.com/rivassec/cf-token-links) - Secure access link service with expiration controls, built for shareable profiles and recruiter access. -* [`elasticsearch-tools`](https://github.com/rivassec/elasticsearch-tools) - Minimal-permission scripts for verifying Elasticsearch snapshots and exposing Prometheus-style metrics. -* [`tw-disinfo-defense`](https://github.com/rivassec/tw-disinfo-defense) - OAuth-driven automation toolkit for analyzing disinformation patterns on Twitter. -* [`efi-bruteforce`](https://github.com/rivassec/efi-bruteforce) - Archival project demonstrating low-level input automation on EFI screens, featured in 2013 by Hackaday. - ---- - -> Security is infrastructure, not a feature. - -All contributions are built for clarity, reproducibility, and operational reliability. +> Controls that fail closed. diff --git a/scripts/proposed-github-profile-README.md b/scripts/proposed-github-profile-README.md deleted file mode 100644 index e5ecb721..00000000 --- a/scripts/proposed-github-profile-README.md +++ /dev/null @@ -1,42 +0,0 @@ -# RivasSec - -Senior Security Engineer at Primer.AI, PRIFED Security Administrator, writing about DevSecOps at scale. - -I build and operate the defensive side of security infrastructure: SIEM correlation, EDR fleet response, IAM architecture, cloud posture, and Kubernetes runtime hardening. Field notes and post-mortems live at [rivassec.com](https://rivassec.com). - ---- - -## Areas of focus - -- **Kubernetes and container security** - Pod Security Standards, RBAC minimization, EKS operator patterns, Falcon runtime protection -- **Cloud security posture** - AWS Config, GuardDuty, WAF policy, service control policies, cross-account boundary hardening -- **Incident response and retrospectives** - post-mortem discipline, runbook design, alert triage under load - ---- - -## Selected writing - -- [Adoption Is a Security Control: Notes from Paving a Road](https://rivassec.com/paved-road-adoption-as-control.html) - Rebuilding a cloud security model around making the secure path the easy path. 40% lower remediation time, 27% lower pipeline latency, and a four-month adoption stall I caused myself. -- [IAM Safe Defaults Should Fail Loud](https://rivassec.com/iam-safe-defaults-fail-loud.html) - Safe defaults that fail silently are worse than no defaults at all. -- [Teensy, EFI Brute-Force, and the Value of Hours-Late Discovery](https://rivassec.com/teensy-efi-bruteforce-hours-late.html) - What a 2013 EFI project taught me about incident latency. - -More writing at [rivassec.com](https://rivassec.com) and in the [archives](https://rivassec.com/archives.html). - ---- - -## Toolbox - -- **Cloud:** AWS, EKS, Terraform, Pulumi, CloudFormation -- **Security:** IAM, RBAC, CIS Benchmarks, FIPS-aligned baselines, Zero Trust patterns -- **Runtime:** CrowdStrike Falcon, Wazuh, Vault, GitHub Actions -- **Languages:** Python, Bash, YAML daily; Go familiar - ---- - -## Contact - -GitHub issues on any of my repos, or reach out through this profile. - ---- - -> Security is infrastructure, not a feature.