Security Engineering

Working out what an attacker would actually go for, early enough that the answer can still change the design.

Authentication, authorization, secrets and cryptography built in as the system is written — as in Mindora, where journals are encrypted at rest and access is gated by two-factor.

Reading a codebase and its configuration for the failures that automated scanning does not find, and reporting them with a fix.

Mapping a system against the controls a framework expects and closing the gaps. Alignment work — not certification, which only an accredited auditor can issue.