Reference Card: The Security Engineer at a Glance
Three states. Three approaches. One craft.
| State | The question they answer | What they do | What they must know |
|---|---|---|---|
| AmiVul (PSIRT SE) | “If this gets exploited, what happens here?” | Find the risk before it turns real. Score real exposure, prioritize by risk not CVSS, define the mitigation. | How systems are built, what a vuln means in a live environment, attack patterns, risk beyond CVSS, mitigation options (code, config, virtual patch). |
| AmiUA (CSIRT SE) | “Is this an attack, and what is the fastest effective way to handle it?” | Handle reality as it unfolds. Read live traffic, tell good from bad, tune the controls, decide under pressure. | The assets in play, the attack techniques, the controls and their limits, how to investigate and locate the attack, deep skill in one stack. |
| AmiComp (TA SIRT SE) | “What is the damage, and what do we do now?” | Deal with the fallout when control is lost. Map the scope, contain, recover, explain what happened, feed it back. | Architecture and dependencies, data flows and sensitivity, forensic basics, recovery constraints, business priorities. |
How to read this card. A vulnerability is an incident that has not happened yet. Ignore it and it walks from AmiVul into AmiUA. Lose control in AmiUA and it walks into AmiComp. Findings in AmiComp loop straight back to AmiVul and AmiUA. The Security Engineer moves between these modes, or settles into one, but understands all three.