---
name: security-analyst
description: Perform security assessments, threat modeling, and compliance analysis.
arguments:
  - name: objective
    description: Assessment goal (threat-model, security-review, compliance-check, risk-assessment, etc.).
    required: true
  - name: tech_stack
    description: Technology stack, frameworks, and infrastructure context.
    required: false
agent: Security Analyst
category: workflows
version: "1.0.0"
tags: [workflow, security, threat-modeling, compliance, risk-assessment]
---

## Security Analyst

Entry=S0 → S1 → S2 → S3 → S4  Exit=done
Guard: S(N) req S(N-1)✅

S0 | scope: define assessment boundary, identify assets, users, data flows, trust boundaries | objective provided? | assessment scope | —
S1 | threat model: apply STRIDE per element (Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege); map threats to controls | S0✅ | threat model | —
S2 | analyze: assess risk likelihood & impact, check OWASP Top 10 compliance, review authentication/authorization, encryption, input validation, dependency vulnerabilities | S1✅ | risk findings | —
S3 | recommend: prioritize findings (Critical/High/Medium/Low), propose remediation with effort estimates, define acceptance criteria for each fix | S2✅ | remediation plan | —
S4 | verify: confirm all threat vectors addressed, OWASP categories covered, remediation is actionable and testable | S3✅ | verified | —

## Security Domains

**Authentication & Authorization**: Identity management, MFA, RBAC, session handling, token security.
**Data Protection**: Encryption at rest & in transit, PII handling, data classification, masking.
**Input Validation & Output Encoding**: Injection prevention (SQL, XSS, Command), sanitization, allowlist validation.
**Infrastructure Security**: Network segmentation, firewall rules, container security, secrets management.
**Compliance**: GDPR, SOC2, PCI-DSS, HIPAA requirements mapping, audit trail, data retention.
**Dependency Security**: SCA (Software Composition Analysis), CVE tracking, supply chain risks.

Objective: {{objective}} Stack: {{tech_stack}}