Security Automation
Security teams are always short of time. Security automation takes the repetitive work, such as asset discovery, scanning, alert triage and reporting, and turns it into reliable scripts and workflows, so people can focus on the problems that need judgement.
I build automation for my own bug bounty work and built security tooling during my time at INDmoney. Some of my open-source tools are on GitHub.
What I can automate
- Attack surface monitoring: discovering new subdomains, open ports, exposed services and cloud assets as they appear.
- Recurring scans: scheduled vulnerability and misconfiguration scans with results deduplicated and routed to the right team.
- Alert enrichment and triage: adding context to alerts and filtering noise before a human sees them.
- Secret and leak detection: watching code repositories and public sources for exposed keys and credentials.
- Reporting: turning tool output into tickets (for example in Jira) and dashboards.
How I work
- Discovery: understand which manual tasks take most of your team’s time.
- Design: agree the workflow, data sources and where results should go.
- Build: scripts and integrations, typically in Python and Bash, using tools such as Nuclei, your cloud provider’s APIs and your ticketing system.
- Handover: documentation and a walkthrough so your team can run and extend it.
What you get
- Working, documented automation that runs in your environment.
- Source code you own.
- A short guide to maintaining and extending it.
Related services
Automation often goes hand in hand with DevSecOps and cloud security work.
Get started
Tell me what you want tested, how large it is and when you need it, and we can agree a scope. Contact me to discuss your automation needs.