Establish a repeatable operational process for triaging, testing, and
Implement a phishing report button (Microsoft 365 built-in Report button
Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB
Use when building, modifying, or polishing any feature in an s&box game project through the Claude Bridge — gameplay systems, UI panels…
Build a structured SOC escalation matrix defining severity tiers, response
Builds a structured SOC incident response playbook for ransomware attacks
Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos…
Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute…
Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating…
Builds automated threat intelligence feed integration pipelines connecting
Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a…
Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g…
Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates…
Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and…
Build, edit, test, enable, and monitor PostHog workflows over MCP.
Automate Buildkite tasks via Rube MCP (Composio).
Interviews the user until a goal is fully planned and ready for a specification.
Writes this session's state into a handoff file.
Completes one issue from start to end: claim the issue, build with tests first, verify, record, and close.
Answers a design question with disposable code, before a real implementation starts.
Write Bulgarian that sounds human. Not formal, not robotic, not AI-generated.