cspm-engineer - SKILL.md Agent Skill

name: cspm-engineer description: > Cloud Security Posture Management engineer for CyberRadar. Builds the unified posture assessment engine across 4 clouds (AWS, Azure, GCP, OCI) in 3 modes: standalone (direct API scanning), connector-fed (from customer tools like Qualys/Tenable/Prisma), and hybrid (both, with deduplication). Covers CIS benchmark evaluation, cloud misconfiguration detection, IAM posture analysis, encryption gap detection, and network exposure assessment. Produces normalized posture findings that wire into risk register, control effectiveness, compliance scoring, evidence generation, and Cyber Score computation. Triggers on: CSPM, cloud posture, cloud scanning, CIS benchmarks, misconfiguration, cloud security, asset discovery, posture assessment, security posture management.

Act as CSPM Lead Engineer for CyberRadar's security-posture-svc.

Mission

Build a production-grade CSPM engine that discovers cloud assets, evaluates them against security benchmarks, detects misconfigurations, and normalizes findings into CyberRadar's unified posture data model — regardless of whether data comes from direct cloud API scanning, customer security tool connectors, or both.

Three Operating Modes

Mode A — Standalone Scanner

CyberRadar directly calls cloud provider APIs using customer-provided credentials.

AWS: IAM Role assumption (cross-account), STS temporary credentials, AWS Config rules, SecurityHub findings, GuardDuty integration, S3 bucket policies, EC2 security groups, RDS encryption status, CloudTrail logging status, KMS key rotation
Azure: Service Principal with Reader + Security Reader roles, Azure Policy compliance, Microsoft Defender for Cloud findings, NSG rules, Storage account encryption, Key Vault configuration, Azure AD conditional access
GCP: Service Account with Security Reviewer role, Security Command Center findings, Cloud Asset Inventory, IAM policy analysis, VPC firewall rules, Cloud KMS, Cloud Logging
OCI: API Key or Instance Principal, Cloud Guard findings, Vulnerability Scanning, Security Zone policies, Network Security Groups, Vault secrets, Audit logging

Mode B — Connector-Fed

Customer's existing security tools push data via CyberRadar's 256+ connectors:

Vulnerability scanners: Qualys, Tenable, Rapid7
CSPM tools: Prisma Cloud, Wiz, Orca, Lacework
EDR/XDR: CrowdStrike Falcon, Microsoft Defender, SentinelOne
SIEM: Splunk, Sentinel, Datadog
Normalize all ingested data into the same posture_findings schema

Mode C — Hybrid (Default for Enterprise)

Both standalone scanning AND connector data feed the same model. Deduplication engine matches assets by: cloud_resource_id, IP address, hostname, MAC address, FQDN. Findings merge with source attribution. Most complete picture wins.

Unified Posture Data Model

posture_assets — discovered/imported assets (RLS: tenant-scoped)
  id, tenant_id, cloud_provider, cloud_account_id, resource_type, resource_id,
  region, name, tags jsonb, criticality, owner_id, first_seen_at, last_seen_at,
  source ('standalone','connector','hybrid'), connector_id, status ('active','stale','removed')

posture_findings — security findings (RLS: tenant-scoped)
  id, tenant_id, asset_id FK→posture_assets, finding_type ('misconfiguration','vulnerability',
  'exposure','policy_violation','benchmark_fail'),
  severity ('critical','high','medium','low','informational'),
  title, description, remediation_guidance, benchmark_id, benchmark_rule_id,
  cvss_score, cve_ids text[], exploitability_score, epss_score,
  source ('standalone','connector','hybrid'), connector_id, source_finding_id,
  status ('open','acknowledged','remediated','false_positive','risk_accepted'),
  first_detected_at, last_detected_at, remediated_at,
  risk_id FK→risks, control_id FK→controls, evidence_id FK→evidence

posture_benchmarks — CIS/cloud benchmark definitions (platform-level)
  id, cloud_provider, benchmark_name, benchmark_version, category,
  rules jsonb, total_rules int, enabled boolean

posture_scan_configs — per-tenant scan configurations (RLS)
  id, tenant_id, cloud_provider, credentials_vault_ref, regions text[],
  scan_schedule text (cron), scan_mode ('standalone','connector','hybrid'),
  enabled boolean, last_scan_at, next_scan_at

posture_scan_runs — scan execution history (RLS)
  id, tenant_id, config_id, started_at, completed_at, status,
  assets_discovered int, findings_created int, findings_remediated int

Discovery Commands (run to understand existing state)

# Check existing asset/finding schemas
find packages/db-schema/src/schema -name "*asset*" -o -name "*finding*" -o -name "*posture*"
# Check existing connectors that feed security data
ls infra/connectors/ | grep -iE "qualys|tenable|crowdstrike|prisma|wiz|orca|aws|azure|gcp|oci"
# Check existing services that could host CSPM
ls services/ | grep -iE "security|posture|asset|scan"
# Check existing Kafka topics related to assets/findings
grep -rh "asset\.\|finding\.\|posture\.\|scan\." services/*/events/schema/ 2>/dev/null

CIS Benchmark Implementation

Implement checks as pure functions: (cloudConfig) => { pass: boolean, evidence: string }
Store check definitions in posture_benchmarks.rules JSONB
Support CIS AWS Foundations v3.0, CIS Azure v2.1, CIS GCP v2.0, CIS OCI v2.0
Each check maps to SCF controls via scf_control_id
On pass → auto-generate evidence for mapped control
On fail → create posture_finding → auto-create risk entry if severity ≥ high

Credential Management

NEVER store cloud credentials in database
Use HashiCorp Vault or AWS Secrets Manager references
Store only vault reference path in posture_scan_configs.credentials_vault_ref
Rotate credentials automatically
Audit all credential access

Deduplication Strategy (Hybrid Mode)

1. Match by cloud_resource_id (strongest — exact match)
2. Match by IP + cloud_account_id (strong)
3. Match by hostname + region (moderate)
4. Match by MAC address (weak — only for on-premise)
5. No match → create new asset with source='hybrid'
6. On match → merge: keep richest metadata, attribute both sources

Downstream Wiring (CRITICAL)

Every CSPM event MUST propagate through the platform:

posture.asset.discovered → asset-svc consumer enriches asset catalog
posture.finding.created → risk-svc auto-creates/links risk entry
posture.finding.remediated → control-svc recalculates effectiveness → compliance-svc recalculates score
posture.benchmark.passed → evidence-svc auto-generates evidence for mapped controls
posture.scan.completed → analytics-svc updates Cyber Score CSPM dimension
posture.finding.created (severity ≥ high) → workflow-svc creates task → notification-svc alerts

Anti-Patterns (NEVER)

NEVER store cloud credentials in plaintext
NEVER scan without customer-configured credentials (no default scanning)
NEVER bypass RLS for cross-tenant posture data
NEVER call cloud APIs without rate limiting and exponential backoff
NEVER skip deduplication in hybrid mode
NEVER create findings without remediation_guidance
NEVER hardcode CIS benchmark rules — they must be configurable/updatable

Validation

# Schema compiles
cd packages/db-schema && pnpm tsc --noEmit
# Service compiles
cd services/security-posture-svc && pnpm tsc --noEmit
# CIS checks have test coverage
find services/security-posture-svc/tests -name "*cis*" -o -name "*benchmark*" | wc -l
# All 4 cloud providers have scanner implementations
ls services/security-posture-svc/src/infra/cloud-scanners/
# Kafka events defined
ls services/security-posture-svc/events/schema/posture.*.json | wc -l