Hire an AI cloud security designer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A posture checklist across five areas: identity, network, data, logging and compute, each marked Pass, Gap or Unknown.
• A ranked gap list: the issue, the breach pattern it matches, and the fix.
• A guardrail list: preventive policies (SCPs, Azure Policies, Organization Policies) that stop the mistake from recurring.
• The assumptions it made and what you should confirm before you trust a "Pass."

How it does the job well

• Check only what the user describes or attaches. Mark anything you can't confirm as Unknown, never Pass.
• Tie every gap to a real, named breach pattern (a public bucket, a wildcard IAM policy, a long-lived key, an exposed management port), not a vague "could be more secure."
• This is a posture review from a description, not a penetration test, a live scan or a certified compliance audit.
• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Reviewing every environment (prod, staging, dev) in one pass. Ask the user to pick one.
• Copying the profile's sample Terraform or checklist items as if they described the user's actual account.
• Recommending a control the user's stated provider doesn't support (don't propose an AWS SCP for an Azure-only setup).
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: You're setting up a new AWS, Azure or GCP account and want a security baseline before you go live.

• Posture checklist. Identity, network, data, logging and compute, each marked Pass, Gap or Unknown with the reason.
• Ranked gaps. Each gap, the breach pattern it matches, its impact and the fix.
• Guardrails to add. Preventive policies that stop the mistake from recurring, sized small, medium or large.
• Assumptions and checks. What the agent assumed and which facts you still need to confirm.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Set the scope. It confirms your provider, account structure, identity setup and network layout, and asks once for gaps.
• Check identity. It looks for long-lived credentials, missing MFA, and IAM policies that grant more than the task needs.
• Check network, data and logging. It looks for public management ports, unencrypted storage, and whether you'd actually see an incident in your logs.
• Match to known breach patterns. Each gap is tied to a real class of cloud breach, such as a public bucket or a leaked long-lived key, not a generic warning.
• Rank and propose guardrails. Gaps are ranked by how exposed they leave you, each with a preventive policy that stops the mistake class, not just this instance.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id security-cloud-security-architect only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/security-cloud-security-architect/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• Your cloud provider (AWS, Azure, GCP, or more than one) and how your accounts or projects are organized.
• How identity works today: who has admin access, whether MFA is enforced, how services authenticate to each other.
• Your network layout: what's public, what's private, what's reachable from the internet.
• What data you store and how sensitive it is (optional, sharpens the data-protection checks).
• A security posture export (AWS Security Hub, Azure Defender, GCP Security Command Center), if you have one (optional).

Helpful context (optional)

• Your IAM policy exports or role list.
• Past findings from AWS Security Hub, Azure Defender or GCP Security Command Center.
• Your Terraform or CloudFormation source, if your infrastructure is code.

Tools and access

• Claude, ChatGPT or Gemini with file upload: It can read a posture export or Terraform/CloudFormation files next to your description.

Functions and deliverables

• Cloud security designer: Describe your AWS, Azure or GCP setup. Get a posture checklist by area, each gap ranked, and the guardrail to add so it can't happen again.
  • A posture checklist across five areas: identity, network, data, logging and compute, each marked Pass, Gap or Unknown.
  • A ranked gap list: the issue, the breach pattern it matches, and the fix.
  • A guardrail list: preventive policies (SCPs, Azure Policies, Organization Policies) that stop the mistake from recurring.
  • The assumptions it made and what you should confirm before you trust a "Pass."
  Source: Michael Sitarzewski and Agency Agents contributors.
• AWS security checker: Check your AWS account with read-only commands. Get a ranked list of security gaps in access, network, data and logs, each with a fix.
  • A ranked list of findings with the resource and the proof
  • One fix for each finding that you can review first
  • A count of findings by severity
  • A list of checks that did not run, and why
  • A short fix order for the top five actions
  Source: sickn33.
• Security posture auditor: Get a security audit of your web app, API or cloud setup. Each issue is rated, tied to OWASP or CWE, and paired with a fix you can act on.
  • A scoped audit checklist
  • Findings with severity and CWE labels
  • Business impact notes
  • A ranked fix plan
  Source: Burhan Sebin.
• App security threat planner: Describe your app, users and sensitive data. Get a first threat list, entry points, practical safeguards and assumptions to check.
  • A list of parts and entry points
  • The top threats, ranked, with likelihood and damage
  • One practical fix for each
  • What was assumed and what to confirm
• AI project context organiser: Share your project and next task. Get a short rules file, a focused file list and a clear handoff for later sessions.
  • A ready rules file for your project
  • A list of which files to load for each task
  • Rules for when to reset or trim the session
  • A checklist for spotting drifting answers
  Source: Addy Osmani.

Tasks you can use it for

• You're setting up a new AWS, Azure or GCP account and want a security baseline before you go live.
• You want a second look at your IAM policies, security groups or storage buckets before a launch or an audit.
• You're moving from a single account to multiple accounts or environments and want the guardrails planned first.
• A customer or auditor asks how your cloud environment is secured and you want a written answer.

Limits to check before starting

• You want your application code reviewed for bugs. Use the Application security reviewer.
• You have an active breach or suspicious activity right now. Use the Security incident responder and act immediately.
• You need a formal SOC 2, ISO 27001 or HIPAA gap assessment signed off by a certified assessor. Use the Compliance Auditor agent as a starting point, then bring in a certified assessor.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.
• Describe your cloud provider, account structure, identity setup and network layout.
• Attach a posture export if you have one (Security Hub, Defender for Cloud, Security Command Center).
• Say "Run the posture check. Mark anything you can't verify as Unknown, not Pass."
• Fix every item marked Gap on identity and network first. Those are where breaches start.
• Turn the guardrail list into policy (SCPs, Org Policies) so the fix survives the next change, not just this one.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/security-cloud-security-architect for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.