SKILL.md Library

Active Directory Security

Skill · cybersecurity

CISSP-level AD security expert — attack techniques, detection, hardening, and privileged access management

BGP Troubleshooting

Skill · networking

CCIE-level BGP diagnostic expert -- neighbor failures, missing routes, path selection, flapping

Cisco IOS/IOS-XE · Cisco IOS XR · Cisco NX-OS

Cisco ASA Firewall

Skill · cybersecurity

ASA/FTD expert -- packet-tracer diagnosis, NAT order of operations, ACL troubleshooting, AnyConnect, failover

Cisco ASA

Cloud Security Posture

Skill · cybersecurity

CISSP-level cloud security expert — AWS/Azure/GCP IAM hardening, network security, CSPM, logging, and compliance frameworks (CIS, NIST, SOC2, PCI-DSS)

Crypto-Agility

Skill · cybersecurity

Almost no system can change algorithm without a redesign -- which is what turns a migration into a multi-year programme instead of a config change

Database Schema Design

Skill · databases

Relational modelling as a set of trade-offs: keys and UUID locality, constraints, the data types people get wrong, soft deletes, JSONB versus columns, multi-tenancy

Database Security

Skill · databases

The layer that decides how much a breach costs: pg_hba first-match, the PUBLIC grant, SECURITY DEFINER hijacking, RLS and its three bypasses, and why sslmode=require verifies nothing.

Datacenter BGP EVPN / VXLAN

Skill · networking

CCIE DC expert -- spine-leaf fabric, EVPN route types 1-5, VTEP troubleshooting, anycast gateway, multi-tenancy

Cisco NX-OS · Arista EOS

Detection as Code

Skill · cybersecurity

A rule edited in a console has no author, no reason, no review and no way back. The pipeline from lint to verified-deployed, the false-positive test nobody can run because they have no benign corpus, and exceptions with expiry dates.

Detection Engineering

Skill · cybersecurity

Write Sigma, YARA and Suricata rules that survive contact with production — tuned, validated, and honest about what they do not cover.

Digital Forensics (DFIR)

Skill · cybersecurity

Findings that survive challenge: the pull-the-plug decision that destroys the encryption key, what a write blocker does not prove, $FILE_NAME versus $STANDARD_INFORMATION and how timestomping is caught, and why presence is not execution.

DMVPN / FlexVPN / GETVPN

Skill · networking

CCIE-level expert for Cisco DMVPN Phase 1/2/3, FlexVPN (IKEv2), and GETVPN (GDOI) — hub/spoke design, spoke-to-spoke tunnels, troubleshooting

Cisco IOS/IOS-XE · Cisco IOS XR

F5 APM Access Policies

Skill · cybersecurity

An access policy is a state machine that runs once per session, not a rule list. Editing it does not affect anyone logged in, AD Query without AD Auth checks no password, and the licence is concurrent sessions.

F5 BIG-IP

F5 BIG-IP Troubleshooting

Skill · networking

Isolates an F5 fault to the right object in the chain — virtual server, pool, monitor, profile, SNAT or iRule — instead of guessing at the config.

F5 BIG-IP

F5 BIG-IP DNS / GTM

Skill · networking

GSLB is DNS with a cache in front of it. The TTL that bounds every failover, the fallback method that ignores availability, topology scored by longest match, and the fact that GTM sees the resolver and never the client.

F5 BIG-IP

F5 iRules Patterns

Skill · networking

Event-driven TCL on the data path: the event order that decides what exists when, CMP demotion with no error message, the missing HTTP::release that hangs the connection, and the first question - should this be an LTM policy?

F5 BIG-IP

F5 LTM Fundamentals

Skill · networking

The data path as a chain: most-specific virtual server match, the full proxy, SNAT and the return path that kills connections, monitors that only prove the port is open, and persistence that silently does nothing.

F5 BIG-IP

F5 TMOS Administration

Skill · networking

The platform under the virtual servers: port lockdown that blocks HA, the sync direction that overwrites the wrong unit, traffic groups as the real unit of failover, and what a UCS cannot restore.

F5 BIG-IP

F5 ASM / Advanced WAF Tuning

Skill · cybersecurity

A WAF is almost never defeated, it is switched off. Policies that learned from attackers, signature staging expiring into an outage, and accepting suggestions until the policy means nothing.

F5 BIG-IP

Fortinet FortiGate NGFW

Skill · cybersecurity

FortiOS expert -- diagnose debug flow, policy lookup, VDOMs, SD-WAN rule precedence, UTM profiles, FGCP HA

Fortinet

HAProxy Load Balancing

Skill · networking

Read the termination state, find the timeout that actually fired, and map an F5 LTM design onto frontend/backend without losing persistence

HAProxy

Incident Response

Skill · cybersecurity

NIST SP 800-61r3 -- Revision 2 was withdrawn and the four-phase lifecycle with it. Triage, the containment decision, evidence handling, scoping, eradication criteria, and why your playbook still works.

Infoblox NIOS — DDI Fundamentals

Skill · networking

IPAM is a claim about reality that decays. The Grid Master outage that is a change freeze and not an outage, views that break a site while the config looks right, host records versus A plus PTR, and Extensible Attributes as the only reason IPAM means anything.

Infoblox

IPv6 Enterprise Operations

Skill · networking

Ask where the address came from before anything else

Cisco IOS/IOS-XE · Cisco NX-OS · Juniper

KQL for Microsoft Sentinel

Skill · cybersecurity

KQL where operator order is the cost model -- has against contains and the term index, the join kind=innerunique that deduplicates the left side without saying so, ASIM and what normalisation costs, and the rule window shorter than the rule frequency that leaves a gap nothing evaluates.

Kubernetes Networking

Skill · networking

K8s networking expert -- Services and EndpointSlices, CoreDNS and ndots, kube-proxy modes, CNI differences, MTU, Ingress and Gateway API

Kubernetes Security

Skill · cybersecurity

K8s security expert -- RBAC, Pod Security Standards, NetworkPolicy, secrets, supply chain, runtime detection

Log Analysis and Correlation

Skill · cybersecurity

A log records what something chose to write. The three timestamps a SIEM conflates, entity resolution as the actual work, parsers that fail silently and stop detections with no error, and correlation by absence.

Malware Analysis for Defenders

Skill · cybersecurity

Triage, not research: why uploading to a public scanner can tell the attacker you found them, a lab that does not announce itself, entropy and imports as the packing tell, and ranking indicators by how long they keep working.

Memory Forensics

Skill · cybersecurity

A memory image is a photograph of a moving object. Page smear, symbol tables as the real Linux blocker, pslist against psscan, malfind's false positives on JIT runtimes, and what memory can never tell you.

MPLS L3VPN

Skill · networking

Service provider MPLS expert -- LDP, RD/RT, VPNv4, PE-CE routing, label stack troubleshooting

Cisco IOS XR · Cisco IOS/IOS-XE · Juniper

Network AAA & Command Authorization

Skill · networking

Designing command authorisation profiles that work -- and why `permit show *` leaves a tool blind exactly where it matters

Cisco IOS/IOS-XE · Cisco IOS XR · Cisco NX-OS

Network Automation with Python

Skill · networking

Python network automation expert -- Netmiko, NAPALM, Nornir, pyATS, REST APIs, idempotent change workflows

Cisco IOS/IOS-XE · Cisco IOS XR · Cisco NX-OS

Network Monitoring & Observability

Skill · networking

Observability expert -- SNMP vs streaming telemetry, flow analysis, Prometheus/Grafana, SLI/SLO, alert design

Cisco IOS/IOS-XE · Cisco IOS XR · Cisco NX-OS

OSPF Troubleshooting

Skill · networking

CCIE-level OSPF fault isolation across IOS/IOS-XE, IOS XR, NX-OS, JunOS, Arista EOS, and FortiOS.

Cisco IOS/IOS-XE · Cisco IOS XR · Cisco NX-OS

Packet Capture Analysis

Skill · networking

Start from who stopped talking first, not from the protocol tree

Palo Alto NGFW

Skill · cybersecurity

PAN-OS expert -- App-ID, Content-ID, security policy order, NAT, test commands, HA, Panorama

Palo Alto

Pentest Scoping & Reporting

Skill · cybersecurity

Engagement governance expert -- authorization, scope definition, rules of engagement, risk rating, report writing, retest

PostgreSQL Performance

Skill · databases

Instance-level PostgreSQL: memory that is not what its name suggests, pooling, autovacuum and wraparound, WAL and checkpoints, slots, and lock queues

Post-Quantum Cryptography Fundamentals

Skill · cybersecurity

PQC is classical maths, not QKD -- key exchange migrates first because signatures cannot be broken retroactively

Post-Quantum Migration Engineering

Skill · cybersecurity

The parts of a PQC migration that hurt -- the inventory you cannot finish, the chain that no longer fits, and the rollback nobody wrote

SD-WAN

Skill · networking

SD-WAN expert -- Cisco Catalyst SD-WAN (Viptela) and Fortinet SD-WAN, OMP, TLOCs, SLA policy, path selection

Cisco IOS/IOS-XE · Fortinet

SOAR Playbook Design

Skill · cybersecurity

SOAR rarely fails because the automation breaks, it fails because nobody trusts it. The automation ladder, the half-run playbook, the alert storm where your own automation becomes the incident, and approvals that are decisions.

SOC Analyst Workflow

Skill · cybersecurity

A SOC's product is decisions, not closed alerts. The four dispositions and why calling an authorised admin action a false positive quietly tunes away working detections, triage as a time-boxed decision, and the metrics that make analysts close alerts instead of understanding them.

Splunk for Security

Skill · cybersecurity

SPL that distributes -- tstats against accelerated data models, the summariesonly flag that returns nothing and succeeds, the stats rewrites for join and transaction, and CIM as the reason a search works in more than one company.

Threat Hunting

Skill · cybersecurity

Hypothesis-driven hunting that produces a result either way — a finding, a detection, or a documented absence worth trusting.

Zero Trust Architecture

Skill · cybersecurity

NIST SP 800-207 expert -- policy engine design, microsegmentation, identity-centric access, ZTNA migration

Palo Alto · Fortinet · Cisco ASA