Hire an AI security operations engineer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A security scan result, run first, every time code is given: findings by severity (Critical, High) with the line and the rule it breaks.
• A fuller review against the standard: authentication, tokens, cookies, CORS, rate limiting, input validation and logging.
• For implement mode, code that follows the standard, not just a description of what it should do.
• For checklist mode, a pass or fail per item for the phase you named.

How it does the job well

• The scan runs first, always, before the requested mode, and its findings are never dropped even if the user's request was about something else.
• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Treating "no findings" as proof the code is fully secure. Say what was checked, not that everything is safe.
• Copying the profile's sample vulnerable code as if it were found in the user's own paste.
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: You're about to merge a pull request and want it scanned for hardcoded secrets and injection risks before it ships.

• Security scan. Hardcoded secrets, insecure fallbacks, bad JWT handling and SQL injection findings, with line numbers and the rule broken.
• Review findings. Each issue against the auth, token, CORS, rate-limiting and logging rules, with its fix.
• Checklist result. A pass or fail for each item in the named build phase, with the reason.
• Assumptions and checks. What the agent assumed and which facts you still need to confirm.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Run the automatic scan. Before anything else, it scans the pasted code for hardcoded secrets, insecure fallbacks, bad JWT handling and SQL injection patterns, and reports them even if you asked for something else.
• Pick the mode. Review (audit existing code), Implement (build a control to the standard) or Checklist (pass or fail a named phase).
• Check against the standard. It walks authentication, token storage, CORS, rate limiting, input validation and logging against the rule set, citing which rule each finding breaks.
• Classify and fix. Each finding gets a severity and, where the mode calls for it, a corrected code example that fixes it without changing what the code is meant to do.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id security-senior-secops only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/security-senior-secops/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• The code to review: a file, a diff, or a pull request's changed lines, pasted or attached.
• What mode you want: review existing code, implement a control, or check a specific phase against a checklist.
• Your own security standard or rules, if you have one that differs from the defaults listed here (optional).

Helpful context (optional)

• Your team's own written security standard, if one exists.
• The PR description or ticket, so the review knows what the change is meant to do.

Tools and access

• Claude Code or any AI that reads a full repo: It can scan more than the pasted snippet and catch where a secret or token check lives elsewhere in the same file.

Functions and deliverables

• Security operations engineer: Paste code. Get a scan for hardcoded secrets, bad JWT checks and SQL injection, then a review against your login, CORS and logging rules.
  • A security scan result, run first, every time code is given: findings by severity (Critical, High) with the line and the rule it breaks.
  • A fuller review against the standard: authentication, tokens, cookies, CORS, rate limiting, input validation and logging.
  • For implement mode, code that follows the standard, not just a description of what it should do.
  • For checklist mode, a pass or fail per item for the phase you named.
  Source: Michael Sitarzewski and Agency Agents contributors.
• Code change security reviewer: Check a code diff for security risks. Paste your pull request and get ranked findings on only the changed lines, each with a fix.
  • A verdict: safe, fix first or look closer
  • Findings with the line, the abuse and the level
  • The smallest fix for each
  • What was not checked
• Bug and security code reviewer: Check code or pull request changes for bugs and security risks, with fixes tied to lines.
  • A review report with line-linked findings
  • Bugs and error paths
  • Security issues
  • Speed and readability notes
  • Suggested fixes
  Source: Burhan Sebin.
• Live app security tester: Run a safe security scan on your own staging web app or API. You get a list of weaknesses, the request behind each one, and how to fix them.
  • Findings by type and severity
  • The request that triggered each issue
  • Fix advice for each finding
  • A report you can share
  • A schedule for repeat scans
  Source: Burhan Sebin.
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• You're about to merge a pull request and want it scanned for hardcoded secrets and injection risks before it ships.
• You're building a login, token or session feature and want it built to a defined standard the first time.
• You inherited a codebase and want a first-pass security scan of the files that handle auth, tokens or user input.
• You want a checklist to confirm a security-relevant phase (adding auth, adding an API) is actually done, not just "looks done."

Limits to check before starting

• You want a cloud account or network architecture reviewed, not application code. Use the Cloud security designer.
• You need a full application security program with CI gates and dependency scanning set up. Use the Application security reviewer.
• You have an active incident, not a pre-merge review. Use the Security incident responder.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.
• Paste the code, diff or PR you want checked.
• Say which mode you want: review this, implement this control, or check this phase against the checklist.
• Read the automatic scan result first. Fix any Critical finding (hardcoded secret, SQL injection, JWT with no algorithm check) before anything else.
• Then work through the fuller review findings in severity order.
• If your team has its own standard that differs from the defaults, say so and it will check against yours instead.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/security-senior-secops for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.