feat: ict-security-technician skill package v0.1.0

2026-08-14 19:10:15 +02:00
commit 3202486927
9 changed files with 888 additions and 0 deletions
--- a/PROVENANCE.md
+++ b/PROVENANCE.md
@@ -0,0 +1,31 @@
+# Data provenance — ict-security-technician
+
+Where the content of this skill package comes from, counted by
+content items (tasks, competences, tools, evidence entries, curated
+knowledge). Rendered live by Gitea:
+
+```mermaid
+%%{init: {'theme':'base','themeVariables':{'pie1':'#f9a825','pie2':'#1e88e5','pie3':'#ff355e','pie4':'#d97757','pie5':'#8e24aa','pieOuterStrokeWidth':'0px','pieSectionTextColor':'#fff'}}}%%
+pie showData
+    title Content sources — ict-security-technician
+    "ESCO (occupation & competences)" : 96
+    "O*NET (tasks & tools)" : 132
+    "Job boards (market evidence)" : 51
+    "Anthropic official Claude skills" : 9
+    "External AI skill packs (mapped)" : 119
+```
+
+| Source | Items | Share | Files |
+|---|---|---|---|
+| ESCO (occupation & competences) | 96 | 23.6 % | references/profile.md, references/skills.md |
+| O*NET (tasks & tools) | 132 | 32.4 % | references/tasks.md, references/tools.md |
+| Job boards (market evidence) | 51 | 12.5 % | references/market.md (full report) + "Market evidence" headline sections |
+| Wikipedia & AI expert curation | 0 | 0.0 % | glossary, literature, usecases, intake, quality, evals/ |
+| Anthropic official Claude skills | 9 | 2.2 % | references/ai-skills.md, section "anthropics/skills" (official Claude Code skills) |
+| External AI skill packs (mapped) | 119 | 29.2 % | references/ai-skills.md (per-source attribution inside) |
+| Stack Exchange practitioner Q&A (CC-BY-SA) | 0 | 0.0 % | references/practitioner-qa.md (per-entry attribution inside) |
+
+Licensing: O*NET (USDOL/ETA, CC BY 4.0) · ESCO (© European Union) ·
+job-ad evidence via official APIs (JSearch/Adzuna) · Wikipedia content
+paraphrased with source URLs — never copied · external AI skills are
+linked, not copied (Apache-2.0/MIT/source-available, see ai-skills.md).
--- a/SKILL.md
+++ b/SKILL.md
@@ -0,0 +1,61 @@
+---
+name: ict-security-technician
+description: "Occupational skill for the role 'ICT security technician' (also: IT security officer, ICT security technicians, cybersecurity solutions expert, cybersecurity developer, development and operations security engineer, cybersecurity implementer). Use when the user asks for typical ICT security technician work such as: Assess the quality of security controls, using performance indicators.; Conduct investigations of information security breaches to identify vulnerabilities and evaluate the damage.; Coordinate documentation of computer security or emergency measure policies, procedures, or tests."
+---
+
+# Ict Security Technician
+
+ICT security technicians propose and implement necessary security updates and measures whenever is required. They advise, support, inform and provide training and security awareness.
+
+## Core workflow
+
+1. Assess the quality of security controls, using performance indicators.
+2. Conduct investigations of information security breaches to identify vulnerabilities and evaluate the damage.
+3. Coordinate documentation of computer security or emergency measure policies, procedures, or tests.
+4. Coordinate monitoring of networks or systems for security breaches or intrusions.
+5. Coordinate vulnerability assessments or analysis of information security systems.
+6. Develop information security standards and best practices.
+7. Develop or implement software tools to assist in the detection, prevention, and analysis of security threats.
+8. Develop or install software, such as firewalls and data encryption programs, to protect sensitive information.
+
+## How to use this skill
+
+- Read [references/profile.md](references/profile.md) for the occupation profile and scope.
+- Consult [references/tasks.md](references/tasks.md) for the full task and activity inventory.
+- Check [references/skills.md](references/skills.md) for essential vs. optional competences.
+- Check [references/tools.md](references/tools.md) for the software commonly used in this role.
+- See [references/ai-skills.md](references/ai-skills.md) — matched external AI agent skills (per-source attribution).
+
+## Key competences (essential)
+
+- address problems critically
+- analyse ICT system
+- attack vectors
+- audit techniques
+- communicate with stakeholders
+- cyber attack counter-measures
+- cyber security
+- engage with stakeholders
+- ensure proper document management
+- establish an ICT security prevention plan
+- estimate duration of work
+- execute software tests
+- ICT networking hardware
+- ICT security standards
+- ICT system programming
+
+## Hot technologies
+
+- Docker
+- GitHub
+- Kubernetes
+- Amazon Web Services AWS CloudFormation
+- Chef
+- IBM Terraform
+- Puppet
+- Atlassian JIRA
+- Elasticsearch
+- MongoDB
+
+---
+*Sources: ESCO v1.2.1 (http://data.europa.eu/esco/occupation/a44a1dc5-be08-4840-8bd5-770c4ac1ca6d), O*NET 30.3 (15-1299.05). See manifest.json for licensing/attribution.*
--- a/manifest.json
+++ b/manifest.json
@@ -0,0 +1,166 @@
+{
+  "name": "ict-security-technician",
+  "title": "ICT security technician",
+  "version": "0.1.0",
+  "layer": "core",
+  "language": "en",
+  "generated": "2026-07-07",
+  "ids": {
+    "esco_uri": "http://data.europa.eu/esco/occupation/a44a1dc5-be08-4840-8bd5-770c4ac1ca6d",
+    "esco_code": "3512.3",
+    "isco_group": "3512",
+    "onet_soc": "15-1299.05",
+    "crosswalk_match": "closeMatch"
+  },
+  "sources": [
+    {
+      "name": "ESCO",
+      "version": "1.2.1",
+      "url": "https://esco.ec.europa.eu/"
+    },
+    {
+      "name": "O*NET",
+      "version": "30.3",
+      "url": "https://www.onetcenter.org/",
+      "license": "CC BY 4.0"
+    }
+  ],
+  "attribution": "This package includes information from the O*NET Database (v30.3) by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA), CC BY 4.0. skillfactor is not endorsed by USDOL/ETA. ESCO data (v1.2.1) (c) European Union, used per the ESCO download conditions: https://esco.ec.europa.eu/en/use-esco/download",
+  "counts": {
+    "tasks": 20,
+    "dwas": 21,
+    "skills_essential": 34,
+    "skills_optional": 61,
+    "software": 90
+  },
+  "enrichment_ai_skills": {
+    "generated": "2026-07-14",
+    "method": "deterministic mapping (ISCO prefix + title/competence keywords)",
+    "sources": {
+      "anthropics/skills": {
+        "repo": "https://github.com/anthropics/skills",
+        "commit": "f6656c1",
+        "license": "Apache-2.0; the document skills (docx/pdf/pptx/xlsx) are source-available \u2014 see the LICENSE.txt in the upstream skill folder",
+        "skills": 6
+      },
+      "obra/superpowers": {
+        "repo": "https://github.com/obra/superpowers",
+        "commit": "d884ae0",
+        "license": "MIT (c) Jesse Vincent",
+        "skills": 12
+      },
+      "wshobson/agents": {
+        "repo": "https://github.com/wshobson/agents",
+        "commit": "6fd3247",
+        "license": "MIT (c) Seth Hobson",
+        "skills": 12
+      },
+      "NVIDIA/skills": {
+        "repo": "https://github.com/NVIDIA/skills",
+        "commit": "153b14b",
+        "license": "CC-BY-4.0 (skills/docs), Apache-2.0 (code)",
+        "skills": 12
+      },
+      "affaan-m/everything-claude-code": {
+        "repo": "https://github.com/affaan-m/everything-claude-code",
+        "commit": "ed38744",
+        "license": "MIT",
+        "skills": 1
+      },
+      "mukul975/Anthropic-Cybersecurity-Skills": {
+        "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills",
+        "commit": "673da1f",
+        "license": "Apache-2.0",
+        "skills": 12
+      },
+      "a5c-ai/babysitter": {
+        "repo": "https://github.com/a5c-ai/babysitter",
+        "commit": "44a5d58b",
+        "license": "MIT",
+        "skills": 5
+      },
+      "davila7/claude-code-templates": {
+        "repo": "https://github.com/davila7/claude-code-templates",
+        "commit": "fa79251",
+        "license": "MIT",
+        "skills": 6
+      },
+      "zebbern/claude-code-guide": {
+        "repo": "https://github.com/zebbern/claude-code-guide",
+        "commit": "d2c5280",
+        "license": "MIT",
+        "skills": 3
+      },
+      "samber/cc-skills-golang": {
+        "repo": "https://github.com/samber/cc-skills-golang",
+        "commit": "4881c01",
+        "license": "MIT",
+        "skills": 1
+      },
+      "jeremylongshore/claude-code-plugins-plus-skills": {
+        "repo": "https://github.com/jeremylongshore/claude-code-plugins-plus-skills",
+        "commit": "e112938a",
+        "license": "MIT",
+        "skills": 5
+      },
+      "itsmostafa/aws-agent-skills": {
+        "repo": "https://github.com/itsmostafa/aws-agent-skills",
+        "commit": "4ab904a",
+        "license": "MIT",
+        "skills": 1
+      },
+      "alirezarezvani/claude-skills": {
+        "repo": "https://github.com/alirezarezvani/claude-skills",
+        "commit": "0241f43",
+        "license": "MIT",
+        "skills": 1
+      },
+      "SnailSploit/Claude-Red": {
+        "repo": "https://github.com/SnailSploit/Claude-Red",
+        "commit": "aeb41ec",
+        "license": "MIT",
+        "skills": 1
+      },
+      "0xwilliamortiz/claude-red": {
+        "repo": "https://github.com/0xwilliamortiz/claude-red",
+        "commit": "ad8436b",
+        "license": "MIT",
+        "skills": 1
+      },
+      "vibeeval/vibecosystem": {
+        "repo": "https://github.com/vibeeval/vibecosystem",
+        "commit": "cea9462",
+        "license": "MIT",
+        "skills": 1
+      }
+    },
+    "total_skills": 80,
+    "tiers": {
+      "core": 62,
+      "adjacent": 18
+    }
+  },
+  "provenance": {
+    "items": {
+      "esco": 96,
+      "onet": 132,
+      "jobads": 51,
+      "wiki_ai": 0,
+      "anthropic": 9,
+      "ai_skills": 119,
+      "stackx": 0
+    },
+    "share_percent": {
+      "esco": 23.6,
+      "onet": 32.4,
+      "jobads": 12.5,
+      "wiki_ai": 0.0,
+      "anthropic": 2.2,
+      "ai_skills": 29.2,
+      "stackx": 0.0
+    },
+    "method": "content items per source category"
+  },
+  "collar": "white",
+  "computer_work": true
+}
--- a/references/ai-skills.md
+++ b/references/ai-skills.md
@@ -0,0 +1,226 @@
+# External AI agent skills — ict-security-technician
+
+Proven, publicly available AI agent skills mapped to this occupation.
+Nothing is copied from the sources: every entry is a name, a one-line
+summary and a link to the upstream skill package. Each section names
+its source repository, commit, license and retrieval date.
+
+**Tiers:** `core` = the skill directly exercises a top market hard
+skill, tool or method (from gated job-ad evidence) or an essential
+ESCO competence of this occupation; `adjacent` =
+plausibly useful, secondary. Entries are capped at 12 per source
+and 80 in total per occupation (core first,
+strongest matches survive); everything beyond the caps is excluded
+and logged in the pipeline audit trail, not in this package.
+
+_Matched deterministically (ISCO group + title/competence keywords,
+tiered against market evidence + ESCO essentials) by
+`pipeline/p5_enrich_ai_skills.py` on 2026-07-14._
+
+## Source: anthropics/skills
+
+- Repository: [https://github.com/anthropics/skills](https://github.com/anthropics/skills) (commit `f6656c1`, retrieved 2026-07-14)
+- License: Apache-2.0; the document skills (docx/pdf/pptx/xlsx) are source-available — see the LICENSE.txt in the upstream skill folder
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `mcp-builder` | core | Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python … | [source](https://github.com/anthropics/skills/tree/main/skills/mcp-builder) |
+| `webapp-testing` | adjacent | Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs. | [source](https://github.com/anthropics/skills/tree/main/skills/webapp-testing) |
+| `claude-api` | adjacent | Reference for the Claude API / Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration. TRIGGER — read BEFORE opening the target file; don't skip because it "looks like a … | [source](https://github.com/anthropics/skills/tree/main/skills/claude-api) |
+| `docx` | adjacent | Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', '.dotx', or requests to … | [source](https://github.com/anthropics/skills/tree/main/skills/docx) |
+| `skill-creator` | adjacent | Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with … | [source](https://github.com/anthropics/skills/tree/main/skills/skill-creator) |
+| `pdf` | adjacent | Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating … | [source](https://github.com/anthropics/skills/tree/main/skills/pdf) |
+
+## Source: obra/superpowers
+
+- Repository: [https://github.com/obra/superpowers](https://github.com/obra/superpowers) (commit `d884ae0`, retrieved 2026-07-14)
+- License: MIT (c) Jesse Vincent
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `finishing-a-development-branch` | adjacent | Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup | [source](https://github.com/obra/superpowers/tree/main/skills/finishing-a-development-branch) |
+| `executing-plans` | adjacent | Use when you have a written implementation plan to execute in a separate session with review checkpoints | [source](https://github.com/obra/superpowers/tree/main/skills/executing-plans) |
+| `test-driven-development` | adjacent | Use when implementing any feature or bugfix, before writing implementation code | [source](https://github.com/obra/superpowers/tree/main/skills/test-driven-development) |
+| `brainstorming` | adjacent | You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation. | [source](https://github.com/obra/superpowers/tree/main/skills/brainstorming) |
+| `subagent-driven-development` | adjacent | Use when executing implementation plans with independent tasks in the current session | [source](https://github.com/obra/superpowers/tree/main/skills/subagent-driven-development) |
+| `using-git-worktrees` | adjacent | Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback | [source](https://github.com/obra/superpowers/tree/main/skills/using-git-worktrees) |
+| `receiving-code-review` | adjacent | Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation | [source](https://github.com/obra/superpowers/tree/main/skills/receiving-code-review) |
+| `requesting-code-review` | adjacent | Use when completing tasks, implementing major features, or before merging to verify work meets requirements | [source](https://github.com/obra/superpowers/tree/main/skills/requesting-code-review) |
+| `systematic-debugging` | adjacent | Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes | [source](https://github.com/obra/superpowers/tree/main/skills/systematic-debugging) |
+| `verification-before-completion` | adjacent | Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always | [source](https://github.com/obra/superpowers/tree/main/skills/verification-before-completion) |
+| `writing-skills` | adjacent | Use when creating new skills, editing existing skills, or verifying skills work before deployment | [source](https://github.com/obra/superpowers/tree/main/skills/writing-skills) |
+| `dispatching-parallel-agents` | adjacent | Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies | [source](https://github.com/obra/superpowers/tree/main/skills/dispatching-parallel-agents) |
+
+## Source: wshobson/agents
+
+- Repository: [https://github.com/wshobson/agents](https://github.com/wshobson/agents) (commit `6fd3247`, retrieved 2026-07-14)
+- License: MIT (c) Seth Hobson
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `auth-implementation-patterns` | core | Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues. | [source](https://github.com/wshobson/agents/tree/main/plugins/developer-essentials/skills/auth-implementation-patterns) |
+| `stride-analysis-patterns` | core | Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/stride-analysis-patterns) |
+| `comprehensive-review-security-auditor (agent)` | core | Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and … | [source](https://github.com/wshobson/agents/tree/main/plugins/comprehensive-review/agents/security-auditor.md) |
+| `security-compliance-security-auditor (agent)` | core | Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and … | [source](https://github.com/wshobson/agents/tree/main/plugins/security-compliance/agents/security-auditor.md) |
+| `frontend-mobile-security-frontend-developer (agent)` | core | Build React components, implement responsive layouts, and handle client-side state management. Masters React 19, Next.js 15, and modern frontend architecture. Optimizes performance and ensures accessibility. Use PROACTIVELY when creating … | [source](https://github.com/wshobson/agents/tree/main/plugins/frontend-mobile-security/agents/frontend-developer.md) |
+| `dependency-management-legacy-modernizer (agent)` | core | Refactor legacy codebases, migrate outdated frameworks, and implement gradual modernization. Handles technical debt, dependency updates, and backward compatibility. Use PROACTIVELY for legacy system updates, framework migrations, or … | [source](https://github.com/wshobson/agents/tree/main/plugins/dependency-management/agents/legacy-modernizer.md) |
+| `sast-configuration` | core | Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/sast-configuration) |
+| `application-performance-observability-engineer (agent)` | core | Build production-ready monitoring, logging, and tracing systems. Implements comprehensive observability strategies, SLI/SLO management, and incident response workflows. Use PROACTIVELY for monitoring infrastructure, performance … | [source](https://github.com/wshobson/agents/tree/main/plugins/application-performance/agents/observability-engineer.md) |
+| `attack-tree-construction` | core | Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/attack-tree-construction) |
+| `deployment-validation-cloud-architect (agent)` | core | Expert cloud architect specializing in AWS/Azure/GCP/OCI multi-cloud infrastructure design, advanced IaC (Terraform/OpenTofu/CDK), FinOps cost optimization, and modern architectural patterns. Masters serverless, microservices, security, … | [source](https://github.com/wshobson/agents/tree/main/plugins/deployment-validation/agents/cloud-architect.md) |
+| `k8s-security-policies` | core | Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards. | [source](https://github.com/wshobson/agents/tree/main/plugins/kubernetes-operations/skills/k8s-security-policies) |
+| `threat-mitigation-mapping` | core | Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/threat-mitigation-mapping) |
+
+## Source: 0xwilliamortiz/claude-red
+
+- Repository: [https://github.com/0xwilliamortiz/claude-red](https://github.com/0xwilliamortiz/claude-red) (commit `ad8436b`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `offensive-cloud` | core | Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, … | [source](https://github.com/0xwilliamortiz/claude-red/tree/ad8436b/Skills/cloud/offensive-cloud) |
+
+## Source: a5c-ai/babysitter
+
+- Repository: [https://github.com/a5c-ai/babysitter](https://github.com/a5c-ai/babysitter) (commit `44a5d58b`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `security-sandbox` | core | Isolated analysis environment management for malware and exploit testing. Create and manage isolated VMs, configure Cuckoo Sandbox, set up REMnux/FlareVM environments, manage Docker-based analysis containers, and capture filesystem and … | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-research/skills/security-sandbox) |
+| `cloud-security-testing` | core | Multi-cloud security assessment and penetration testing capabilities. Execute Prowler/ScoutSuite assessments, analyze IAM policies, identify cloud misconfigurations, test permissions, and enumerate cloud resources across AWS/GCP/Azure. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-research/skills/cloud-security-testing) |
+| `multi-cloud-security-posture` | core | Unified cloud security posture management across AWS, Azure, and GCP with normalized metrics and CIS benchmark comparison | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-compliance/skills/multi-cloud-security-posture) |
+| `hardhat-framework` | core | Expert usage of Hardhat for smart contract development, testing, and deployment. Includes TypeChain generation, plugin ecosystem, network forking, and deployment management. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/cryptography-blockchain/skills/hardhat-framework) |
+| `compliance-evidence-collector` | core | Automated evidence collection across compliance frameworks from cloud providers, identity systems, and security tools | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-compliance/skills/compliance-evidence-collector) |
+
+## Source: affaan-m/everything-claude-code
+
+- Repository: [https://github.com/affaan-m/everything-claude-code](https://github.com/affaan-m/everything-claude-code) (commit `ed38744`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `network-config-validation` | core | Pre-deployment checks for router and switch configuration, including dangerous commands, duplicate addresses, subnet overlaps, stale references, management-plane risk, and IOS-style security hygiene. | [source](https://github.com/affaan-m/everything-claude-code/tree/ed38744/skills/network-config-validation) |
+
+## Source: alirezarezvani/claude-skills
+
+- Repository: [https://github.com/alirezarezvani/claude-skills](https://github.com/alirezarezvani/claude-skills) (commit `0241f43`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `terraform-patterns` | core | Terraform infrastructure-as-code agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Covers module design patterns, state management strategies, provider configuration, security hardening, policy-as-code with … | [source](https://github.com/alirezarezvani/claude-skills/tree/0241f43/engineering/terraform-patterns/skills/terraform-patterns) |
+
+## Source: davila7/claude-code-templates
+
+- Repository: [https://github.com/davila7/claude-code-templates](https://github.com/davila7/claude-code-templates) (commit `fa79251`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `Security Scanning Tools` | core | This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/security/scanning-tools) |
+| `Cloud Penetration Testing` | core | This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/security/cloud-penetration-testing) |
+| `loki-mode` | core | Multi-agent autonomous startup system for Claude Code. Triggers on "Loki Mode". Orchestrates 100+ specialized agents across engineering, QA, DevOps, security, data/ML, business operations, marketing, HR, and customer success. Takes PRD to … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/ai-research/loki-mode) |
+| `AWS Penetration Testing` | core | This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/security/aws-penetration-testing) |
+| `google-cloud-waf-security` | core | Generates security-focused guidance for Google Cloud workloads based on the Google Cloud Well-Architected Framework (WAF). Use to evaluate a workload, identify security requirements, and provide actionable recommendations for IAM, network … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/security/google-cloud-waf-security) |
+| `github-actions-creator` | core | Use when the user wants to create, generate, or set up a GitHub Actions workflow. Handles CI/CD pipelines, testing, deployment, linting, security scanning, release automation, Docker builds, scheduled tasks, and any custom workflow for any … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/development/github-actions-creator) |
+
+## Source: itsmostafa/aws-agent-skills
+
+- Repository: [https://github.com/itsmostafa/aws-agent-skills](https://github.com/itsmostafa/aws-agent-skills) (commit `4ab904a`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `ec2` | core | AWS EC2 virtual machine management — instances, security groups, key pairs, AMIs, EBS volumes, Auto Scaling Groups, Spot Instances, Session Manager, placement groups, and instance lifecycle automation. Trigger on ANY of these, even when … | [source](https://github.com/itsmostafa/aws-agent-skills/tree/4ab904a/skills/ec2) |
+
+## Source: jeremylongshore/claude-code-plugins-plus-skills
+
+- Repository: [https://github.com/jeremylongshore/claude-code-plugins-plus-skills](https://github.com/jeremylongshore/claude-code-plugins-plus-skills) (commit `e112938a`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `clickhouse-security-basics` | core | Secure ClickHouse with user management, network restrictions, TLS, and audit logging. Use when hardening a ClickHouse deployment, creating restricted users, or configuring network-level access controls. Trigger: "clickhouse security", … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/clickhouse-pack/skills/clickhouse-security-basics) |
+| `coreweave-security-basics` | core | Secure CoreWeave deployments with RBAC, network policies, and secrets management. Use when hardening GPU workloads, managing model access, or configuring namespace isolation. Trigger with phrases like "coreweave security", "coreweave … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/coreweave-pack/skills/coreweave-security-basics) |
+| `finding-security-misconfigurations` | core | Configure identify security misconfigurations in infrastructure-as-code, application settings, and system configurations. Use when you need to audit Terraform/CloudFormation templates, check application config files, validate system … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/security/security-misconfiguration-finder/skills/finding-security-misconfigurations) |
+| `flyio-security-basics` | core | Apply Fly.io security best practices for secrets management, private networking, TLS certificates, and deploy token scoping. Trigger: "fly.io security", "fly secrets", "fly.io TLS", "fly.io private network".  | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/flyio-pack/skills/flyio-security-basics) |
+| `find-cybersecurity-firm` | core | Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/mcp/servicegraph/skills/find-cybersecurity-firm) |
+
+## Source: mukul975/Anthropic-Cybersecurity-Skills
+
+- Repository: [https://github.com/mukul975/Anthropic-Cybersecurity-Skills](https://github.com/mukul975/Anthropic-Cybersecurity-Skills) (commit `673da1f`, retrieved 2026-07-14)
+- License: Apache-2.0
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `implementing-cloud-vulnerability-posture-management` | core | Implement Cloud Security Posture Management using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite for multi-cloud vulnerability detection. | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/implementing-cloud-vulnerability-posture-management) |
+| `securing-serverless-functions` | core | This skill covers security hardening for serverless compute platforms including AWS Lambda, Azure Functions, and Google Cloud Functions. It addresses least privilege IAM roles, dependency vulnerability scanning, secrets management … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/securing-serverless-functions) |
+| `configuring-host-based-intrusion-detection` | core | Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/configuring-host-based-intrusion-detection) |
+| `implementing-cloud-security-posture-management` | core | Implementing Cloud Security Posture Management (CSPM) to continuously monitor multi-cloud environments for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Azure Defender, and GCP … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/implementing-cloud-security-posture-management) |
+| `implementing-aws-security-hub` | core | This skill covers deploying AWS Security Hub as a centralized cloud security posture management platform that aggregates findings from GuardDuty, Inspector, Macie, and third-party tools. It details enabling security standards like CIS AWS … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/implementing-aws-security-hub) |
+| `implementing-security-monitoring-with-datadog` | core | Implements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure. Covers Agent … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/implementing-security-monitoring-with-datadog) |
+| `scanning-infrastructure-with-nessus` | core | Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems. | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/scanning-infrastructure-with-nessus) |
+| `performing-hardware-security-module-integration` | core | Integrate Hardware Security Modules (HSMs) using PKCS#11 interface for cryptographic key management, signing operations, and secure key storage with python-pkcs11, AWS CloudHSM, and YubiHSM2. | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/performing-hardware-security-module-integration) |
+| `deploying-palo-alto-prisma-access-zero-trust` | core | Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.  | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/deploying-palo-alto-prisma-access-zero-trust) |
+| `detecting-cloud-threats-with-guardduty` | core | This skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/detecting-cloud-threats-with-guardduty) |
+| `implementing-azure-defender-for-cloud` | core | Implementing Microsoft Defender for Cloud to enable cloud security posture management, workload protection across VMs, containers, databases, and storage, configure security recommendations, and set up adaptive security controls with … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/implementing-azure-defender-for-cloud) |
+| `performing-cloud-penetration-testing-with-pacu` | core | Performing authorized AWS penetration testing using Pacu, the open-source AWS exploitation framework, to enumerate IAM configurations, discover privilege escalation paths, test credential harvesting, and validate security controls through … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/performing-cloud-penetration-testing-with-pacu) |
+
+## Source: samber/cc-skills-golang
+
+- Repository: [https://github.com/samber/cc-skills-golang](https://github.com/samber/cc-skills-golang) (commit `4881c01`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `golang-security` | core | Security best practices and vulnerability prevention for Golang. Covers injection (SQL, command, XSS), cryptography, filesystem safety, network security, cookies, secrets management, memory safety, and logging. Apply when writing, … | [source](https://github.com/samber/cc-skills-golang/tree/4881c01/skills/golang-security) |
+
+## Source: SnailSploit/Claude-Red
+
+- Repository: [https://github.com/SnailSploit/Claude-Red](https://github.com/SnailSploit/Claude-Red) (commit `aeb41ec`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `offensive-cloud` | core | Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, … | [source](https://github.com/SnailSploit/Claude-Red/tree/aeb41ec/Skills/cloud/offensive-cloud) |
+
+## Source: vibeeval/vibecosystem
+
+- Repository: [https://github.com/vibeeval/vibecosystem](https://github.com/vibeeval/vibecosystem) (commit `cea9462`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `saas-launch-checklist` | core | Pre-launch verification across infrastructure, security, legal, payment, email, analytics, and performance. Day-1 monitoring, rollback plan, incident response skeleton, and post-launch week-1 checklist. | [source](https://github.com/vibeeval/vibecosystem/tree/cea9462/skills/saas-launch-checklist) |
+
+## Source: zebbern/claude-code-guide
+
+- Repository: [https://github.com/zebbern/claude-code-guide](https://github.com/zebbern/claude-code-guide) (commit `d2c5280`, retrieved 2026-07-14)
+- License: MIT
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `scanning-tools` | core | This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system … | [source](https://github.com/zebbern/claude-code-guide/tree/d2c5280/skills/scanning-tools) |
+| `cloud-penetration-testing` | core | This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud … | [source](https://github.com/zebbern/claude-code-guide/tree/d2c5280/skills/cloud-penetration-testing) |
+| `aws-penetration-testing` | core | This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance … | [source](https://github.com/zebbern/claude-code-guide/tree/d2c5280/skills/aws-penetration-testing) |
+
+## Source: NVIDIA/skills
+
+- Repository: [https://github.com/NVIDIA/skills](https://github.com/NVIDIA/skills) (commit `153b14b`, retrieved 2026-07-14)
+- License: CC-BY-4.0 (skills/docs), Apache-2.0 (code)
+
+| Skill | Tier | What it adds | Upstream |
+|---|---|---|---|
+| `tao-run-platform` | core | TAO Execution SDK for submitting and monitoring GPU training jobs on supported platforms (Brev, SLURM, local Docker, Kubernetes). Use when the user wants to run TAO jobs through the SDK, get job tracking, S3 I/O wrapping, multi-node … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/tao-run-platform) |
+| `amc-setup-calibration-stack` | core | Launch AutoMagicCalib microservice and web UI from NGC release images via Docker Compose. Use when user says 'deploy auto calibration', 'launch auto calibration', 'launch AMC', 'start MS+UI', or 'set up auto-magic-calib'. Requires NGC API … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/amc-setup-calibration-stack) |
+| `tao-analyze-gaps-visual-changenet` | core | Performs gap analysis on NVIDIA TAO VCN Classify (Visual Component Net) experiments by invoking the data-services container (`tao_toolkit.data_services` from `versions.yaml`) directly via `docker run … gap_analysis vcn_aoi …` — picks the … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/tao-analyze-gaps-visual-changenet) |
+| `cuopt-install` | core | Install cuOpt for Python, C, or server via pip, conda, or Docker; verify the install. For building cuOpt from source, see cuopt-developer. | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/cuopt-install) |
+| `physical-ai-infrastructure-setup-and-resilient-scaling` | core | Use when the user wants to set up, scale, validate, or harden NVIDIA physical AI infrastructure for synthetic data generation workflows across local MicroK8s or Azure AKS, including Kubernetes clusters, inference endpoint deployment, OSMO … | [source](https://github.com/NVIDIA/skills/tree/153b14b/plugins/nvidia-skills/skills/physical-ai-infrastructure-setup-and-resilient-scaling) |
+| `tao-run-on-brev` | core | Brev managed GPU instances with Docker support. Use when running TAO training, evaluation, or inference on Brev GPU instances, managing Brev deployments, or dispatching TAO jobs through the Brev CLI. Trigger phrases include "run on Brev", … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/tao-run-on-brev) |
+| `vss-deploy-video-embedding` | core | Use this skill when deploying, operating, or integrating the VSS 3.2 GA RT-Embed Video Embedding microservice. Covers Docker Compose bring-up, GPU and storage prerequisites, the `/v1` REST API (file uploads, text and video embeddings, live … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/vss-deploy-video-embedding) |
+| `cuopt-server-api-python` | core | cuOpt REST server — start server, endpoints, Python/curl client examples. Use when the user is deploying or calling the REST API. | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/cuopt-server-api-python) |
+| `holoscan-install-container` | core | Install Holoscan SDK via the NGC Docker container. Use for container-based installs; not for native apt/pip/Conda installs. | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/holoscan-install-container) |
+| `tao-run-on-local-docker` | core | Local or remote Docker execution for TAO SDK job containers using a Docker daemon with NVIDIA GPU runtime. Use when running TAO jobs on the current machine, a directly attached Docker host, or a remote GPU box exposed through DOCKER_HOST. … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/tao-run-on-local-docker) |
+| `tao-setup-nvidia-gpu-host` | core | Host setup for TAO GPU backends. Checks and, after user approval, installs NVIDIA driver branch 580, CUDA Toolkit 13.0, and NVIDIA Container Toolkit 1.19.0 for Docker/local-Docker and Kubernetes GPU worker hosts. The `--check-only` path … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/tao-setup-nvidia-gpu-host) |
+| `launch-nemo-rl` | adjacent | Playbook for launching, monitoring, stopping, and debugging NeMo-RL recipes on a Kubernetes cluster via the nrl-k8s CLI. Covers ephemeral vs long-lived RayCluster modes, iterating on runs, and debugging hung or failed training jobs. | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/launch-nemo-rl) |
--- a/references/market.md
+++ b/references/market.md
@@ -0,0 +1,85 @@
+# Market evidence report — ict-security-technician
+
+Source: **18 real job ads** (JSearch API, countries: us 18), extracted into the MSSQL evidence store; as of 2026-07-12.
+This report contains extracted, aggregated facts only — no ad text is
+reproduced (copyright / platform terms).
+
+## Seniority distribution
+
+| Seniority | Ads | Share |
+|---|---|---|
+| mid | 14 | 78 % |
+| senior | 3 | 17 % |
+| lead | 1 | 6 % |
+
+## Tools — full market ranking
+
+| # | Item | Ads | Share |
+|---|---|---|---|
+| 1 | eMASS | 4 | 22 % |
+| 2 | ACAS | 3 | 17 % |
+| 3 | Splunk | 3 | 17 % |
+
+## Hard skills — full market ranking
+
+| # | Item | Ads | Share |
+|---|---|---|---|
+| 1 | risk assessment | 10 | 56 % |
+| 2 | incident response | 7 | 39 % |
+| 3 | security control implementation | 5 | 28 % |
+| 4 | vulnerability management | 5 | 28 % |
+| 5 | risk management | 4 | 22 % |
+| 6 | system security plan development | 4 | 22 % |
+| 7 | vulnerability assessment | 4 | 22 % |
+| 8 | network security | 3 | 17 % |
+
+## Methods — full market ranking
+
+| # | Item | Ads | Share |
+|---|---|---|---|
+| 1 | risk management framework (rmf) | 5 | 28 % |
+| 2 | continuous monitoring | 3 | 17 % |
+
+## Responsibilities — full market ranking
+
+| # | Item | Ads | Share |
+|---|---|---|---|
+| 1 | security control implementation | 3 | 17 % |
+
+## Regional breakdown
+
+> **Corpus note:** 18 relevant ads in total — below the 100-ad target for a fully reliable ranking. Percentages above should be read as indicative.
+
+### US (us)
+
+**Insufficient evidence** — 18 ads (minimum for a regional ranking: 30). No ranking is reported for this region.
+
+### UK (gb)
+
+**Insufficient evidence** — 0 ads (minimum for a regional ranking: 30). No ranking is reported for this region.
+
+### EU/DACH (de, at, ch, nl)
+
+**Insufficient evidence** — 0 ads (minimum for a regional ranking: 30). No ranking is reported for this region.
+
+
+## Job title variants in the market
+
+| Title | Ads |
+|---|---|
+| Information System Security Officer (ISSO) | 2 |
+| Information Systems Security Officer | 2 |
+| Information Systems Security Officer (ISSO) | 2 |
+| Senior Information Systems Security Officer | 2 |
+| Cyber Security Engineer – Entry Level | 1 |
+| Information System Security Engineer | 1 |
+| Information System Security Officer | 1 |
+| Information System Security Officer (ISSO) Mid-Level (Government) | 1 |
+| Information System Security Officer Jobs | 1 |
+| Information System Security Officer Senior (ISSO)/ Information Assurance Engineer (GSA LCAT) – (Team 01) | 1 |
+| Information Systems Security Officer (ISSO) - Navy | 1 |
+| Information Systems Security Officer (ISSO), Network Security, TS/SCI | 1 |
+| SENIOR INFORMATION SYSTEM SECURITY OFFICER (670) – MARYLAND – URGENT | 1 |
+| Senior Information Systems Security Officer (ISSO) | 1 |
+
+Methodology: entities extracted per ad ({hard_skills, tools, methods, responsibilities, seniority}), normalized, counted as DISTINCT ads per entity; report threshold ≥ 3 ads. Headline sections in skills.md/tools.md use the stricter ≥ 20 % threshold.
--- a/references/profile.md
+++ b/references/profile.md
@@ -0,0 +1,27 @@
+# Occupation profile — ICT security technician
+
+- **ESCO URI:** http://data.europa.eu/esco/occupation/a44a1dc5-be08-4840-8bd5-770c4ac1ca6d
+- **ESCO code:** 3512.3
+- **ISCO-08 group:** 3512 — Information and communications technology user support technicians
+- **O*NET-SOC:** 15-1299.05 — Information Security Engineers (match: closeMatch)
+
+## Description (ESCO)
+
+ICT security technicians propose and implement necessary security updates and measures whenever is required. They advise, support, inform and provide training and security awareness.
+
+## Definition
+
+nan
+
+## Alternative labels
+
+- IT security officer
+- ICT security technicians
+- cybersecurity solutions expert
+- cybersecurity developer
+- development and operations security engineer
+- cybersecurity implementer
+- ICT security officer
+- IT security technician
+- DevSecOps engineer
+- information security implement
--- a/references/skills.md
+++ b/references/skills.md
@@ -0,0 +1,132 @@
+# Competences — ICT security technician
+
+Source: ESCO v1.2.1 occupation-skill relations (http://data.europa.eu/esco/occupation/a44a1dc5-be08-4840-8bd5-770c4ac1ca6d).
+
+## Essential
+
+- **address problems critically** (skill/competence)
+- **analyse ICT system** (skill/competence)
+- **attack vectors** (knowledge)
+- **audit techniques** (knowledge)
+- **communicate with stakeholders** (skill/competence)
+- **cyber attack counter-measures** (knowledge)
+- **cyber security** (knowledge)
+- **engage with stakeholders** (skill/competence)
+- **ensure proper document management** (skill/competence)
+- **establish an ICT security prevention plan** (skill/competence)
+- **estimate duration of work** (skill/competence)
+- **execute software tests** (skill/competence)
+- **ICT networking hardware** (knowledge)
+- **ICT security standards** (knowledge)
+- **ICT system programming** (knowledge)
+- **identify ICT security risks** (skill/competence)
+- **identify ICT system weaknesses** (skill/competence)
+- **implement ICT risk management** (skill/competence)
+- **integrate system components** (skill/competence)
+- **levels of software testing** (knowledge)
+- **manage alarm system** (skill/competence)
+- **manage closed-circuit television system** (skill/competence)
+- **manage system security** (skill/competence)
+- **operating systems** (knowledge)
+- **penetration testing tool** (knowledge)
+- **procurement of ICT network equipment** (knowledge)
+- **protect ICT devices** (skill/competence)
+- **security engineering** (knowledge)
+- **set up cybersecurity training programmes** (skill/competence)
+- **solve ICT system problems** (skill/competence)
+- **systems development life-cycle** (knowledge)
+- **tools for ICT test automation** (knowledge)
+- **use access control software** (skill/competence)
+- **web application security threats** (knowledge)
+
+## Optional
+
+- ABAP (knowledge)
+- AJAX (knowledge)
+- APL (knowledge)
+- ASP.NET (knowledge)
+- Assembly (computer programming) (knowledge)
+- C# (knowledge)
+- C++ (knowledge)
+- Cisco (knowledge)
+- cloud monitoring and reporting (knowledge)
+- cloud security and compliance (knowledge)
+- COBOL (knowledge)
+- CoffeeScript (knowledge)
+- Common Lisp (knowledge)
+- comply with legal regulations (skill/competence)
+- computer programming (knowledge)
+- cooperate with colleagues (skill/competence)
+- Erlang (knowledge)
+- execute ICT audits (skill/competence)
+- Groovy (knowledge)
+- Haskell (knowledge)
+- ICT encryption (knowledge)
+- ICT network security risks (knowledge)
+- ICT safety (nan)
+- ICT security legislation (knowledge)
+- implement a firewall (skill/competence)
+- implement a virtual private network (skill/competence)
+- implement anti-virus software (skill/competence)
+- implement cloud security and compliance (skill/competence)
+- implement ICT security policies (skill/competence)
+- install low voltage wiring (skill/competence)
+- Internet of Things (knowledge)
+- Java (computer programming) (knowledge)
+- JavaScript (knowledge)
+- Lisp (knowledge)
+- manage cloud data and storage (skill/competence)
+- manage IT security compliances (skill/competence)
+- manage keys for data protection (skill/competence)
+- MATLAB (knowledge)
+- Microsoft Visual C++ (knowledge)
+- ML (computer programming) (knowledge)
+- Objective-C (knowledge)
+- OpenEdge Advanced Business Language (knowledge)
+- organisational resilience (knowledge)
+- Pascal (computer programming) (knowledge)
+- Perl (knowledge)
+- PHP (knowledge)
+- Prolog (computer programming) (knowledge)
+- Python (computer programming) (knowledge)
+- R (knowledge)
+- remove computer virus or malware from a computer (skill/competence)
+- Ruby (computer programming) (knowledge)
+- SAP R3 (knowledge)
+- SAS language (knowledge)
+- Scala (knowledge)
+- Scratch (computer programming) (knowledge)
+- Smalltalk (computer programming) (knowledge)
+- Swift (computer programming) (knowledge)
+- TypeScript (knowledge)
+- use back-up and recovery tools (skill/competence)
+- VBScript (knowledge)
+- Visual Basic (knowledge)
+
+<!-- market-evidence -->
+
+## Market evidence (job-ad analysis, 18 ads, as of 2026-07-12)
+
+Share of analyzed job ads mentioning the item (threshold ≥ 20 %). Source: JSearch/Adzuna APIs.
+
+### Hard skills
+
+- risk assessment — **56 %**
+- incident response — **39 %**
+- security control implementation — **28 %**
+- vulnerability management — **28 %**
+- system security plan development — **22 %**
+- vulnerability assessment — **22 %**
+- risk management — **22 %**
+- network security — **17 %**
+
+### Methods
+
+- risk management framework (rmf) — **28 %**
+- continuous monitoring — **17 %**
+
+### Responsibilities
+
+- security control implementation — **17 %**
+
+<!-- market-evidence -->
--- a/references/tasks.md
+++ b/references/tasks.md
@@ -0,0 +1,50 @@
+# Tasks & work activities — ICT security technician
+
+Source: O*NET 30.3, occupation 15-1299.05 (Information Security Engineers).
+
+## Task statements
+
+- **[Core]** Assess the quality of security controls, using performance indicators.
+- **[Core]** Conduct investigations of information security breaches to identify vulnerabilities and evaluate the damage.
+- **[Core]** Coordinate documentation of computer security or emergency measure policies, procedures, or tests.
+- **[Core]** Coordinate monitoring of networks or systems for security breaches or intrusions.
+- **[Core]** Coordinate vulnerability assessments or analysis of information security systems.
+- **[Core]** Develop information security standards and best practices.
+- **[Core]** Develop or implement software tools to assist in the detection, prevention, and analysis of security threats.
+- **[Core]** Develop or install software, such as firewalls and data encryption programs, to protect sensitive information.
+- **[Core]** Develop response and recovery strategies for security breaches.
+- **[Core]** Identify or implement solutions to information security problems.
+- **[Core]** Identify security system weaknesses, using penetration tests.
+- **[Core]** Oversee development of plans to safeguard computer files against accidental or unauthorized modification, destruction, or disclosure or to meet emergency data processing needs.
+- **[Core]** Oversee performance of risk assessment or execution of system tests to ensure the functioning of data processing activities or security measures.
+- **[Core]** Provide technical support to computer users for installation and use of security products.
+- **[Core]** Recommend information security enhancements to management.
+- **[Core]** Review security assessments for computing environments or check for compliance with cybersecurity standards and regulations.
+- **[Core]** Scan networks, using vulnerability assessment tools to identify vulnerabilities.
+- **[Core]** Train staff on, and oversee the use of, information security standards, policies, and best practices.
+- **[Core]** Troubleshoot security and network problems.
+- **[Core]** Write reports regarding investigations of information security breaches or network evaluations.
+
+## Detailed work activities
+
+- Analyze security of systems, network, or data.
+- Coordinate reporting or editing activities.
+- Develop operating strategies, plans, or procedures.
+- Develop performance metrics or standards related to information technology.
+- Develop software or computer applications.
+- Establish work standards.
+- Evaluate potential of products, technologies, or resources.
+- Evaluate utility of software or hardware technologies.
+- Implement security measures for computer or information systems.
+- Install computer software.
+- Investigate illegal or suspicious activities.
+- Manage information technology projects or system activities.
+- Monitor processes for compliance with standards.
+- Provide technical guidance to other personnel.
+- Read documents to gather technical information.
+- Recommend changes to improve computer or information systems.
+- Supervise information technology personnel.
+- Test computer system operations to ensure proper functioning.
+- Train personnel in technical or scientific procedures.
+- Troubleshoot issues with computer applications or systems.
+- Write reports or evaluations.
--- a/references/tools.md
+++ b/references/tools.md
@@ -0,0 +1,110 @@
+# Tools & technology — ICT security technician
+
+Source: O*NET 30.3 'Software Skills' for 15-1299.05.
+
+| Software | Category | Hot technology |
+|---|---|---|
+| Docker | Application server software | yes |
+| GitHub | Application server software | yes |
+| Kubernetes | Application server software | yes |
+| Amazon Web Services AWS CloudFormation | Cloud-based management software | yes |
+| Chef | Configuration management software | yes |
+| IBM Terraform | Configuration management software | yes |
+| Puppet | Configuration management software | yes |
+| Atlassian JIRA | Content workflow software | yes |
+| Elasticsearch | Data base management system software | yes |
+| MongoDB | Data base management system software | yes |
+| NoSQL | Data base management system software | yes |
+| Microsoft SQL Server Reporting Services SSRS | Data base reporting software | yes |
+| Amazon Web Services AWS software | Data base user interface and query software | yes |
+| IBM DB2 | Data base user interface and query software | yes |
+| Microsoft Access | Data base user interface and query software | yes |
+| Microsoft SQL Server | Data base user interface and query software | yes |
+| ServiceNow | Data base user interface and query software | yes |
+| Structured query language SQL | Data base user interface and query software | yes |
+| C | Development environment software | yes |
+| Go | Development environment software | yes |
+| Microsoft Azure software | Development environment software | yes |
+| Microsoft PowerShell | Development environment software | yes |
+| Ruby | Development environment software | yes |
+| Microsoft SharePoint | Document management software | yes |
+| Microsoft Outlook | Electronic mail software | yes |
+| Jenkins CI | Enterprise application integration software | yes |
+| Microsoft SQL Server Integration Services SSIS | Enterprise application integration software | yes |
+| Splunk Enterprise | Enterprise system management software | yes |
+| Ansible software | Expert system software | yes |
+| Git | File versioning software | yes |
+| Microsoft Visio | Graphics or photo imaging software | yes |
+| Microsoft Active Directory | Internet directory services software | yes |
+| C# | Object or component oriented development software | yes |
+| C++ | Object or component oriented development software | yes |
+| Oracle Java | Object or component oriented development software | yes |
+| Perl | Object or component oriented development software | yes |
+| Python | Object or component oriented development software | yes |
+| R | Object or component oriented development software | yes |
+| Microsoft Office software | Office suite software | yes |
+| Apple iOS | Operating system software | yes |
+| Apple macOS | Operating system software | yes |
+| Bash | Operating system software | yes |
+| Linux | Operating system software | yes |
+| Microsoft Windows | Operating system software | yes |
+| Microsoft Windows Server | Operating system software | yes |
+| Red Hat Enterprise Linux | Operating system software | yes |
+| Shell script | Operating system software | yes |
+| UNIX | Operating system software | yes |
+| UNIX Shell | Operating system software | yes |
+| Microsoft PowerPoint | Presentation software | yes |
+| Atlassian Confluence | Project management software | yes |
+| Microsoft Teams | Project management software | yes |
+| Microsoft Excel | Spreadsheet software | yes |
+| Border Gateway Protocol BGP | Switch or router software | yes |
+| JavaScript | Web platform development software | yes |
+| JavaScript Object Notation JSON | Web platform development software | yes |
+| PHP | Web platform development software | yes |
+| React | Web platform development software | yes |
+| IBM Tivoli software | Access software |  |
+| Single sign-on SSO | Authentication server software |  |
+| Platform as a service PaaS | Cloud-based data access and sharing software |  |
+| Google Cloud software | Cloud-based management software |  |
+| Reporting software | Data base reporting software |  |
+| Software libraries | Development environment software |  |
+| Web application software | Development environment software |  |
+| Enterprise application integration EAI software | Enterprise application integration software |  |
+| Management information systems MIS | Enterprise resource planning ERP software |  |
+| Tanium software | Enterprise system management software |  |
+| Geographic information system GIS systems | Geographic information system |  |
+| Active directory software | Internet directory services software |  |
+| Network directory services software | Internet directory services software |  |
+| Oracle Unified Directory | Internet directory services software |  |
+| IBM QRadar SIEM | Network monitoring software |  |
+| Microsoft Azure Sentinel | Network monitoring software |  |
+| Snort | Network monitoring software |  |
+| Tcpdump | Network monitoring software |  |
+| Wireshark | Network monitoring software |  |
+| Firewall software | Network security and virtual private network VPN equipment software |  |
+| IBM Resource Access Control Facility RACF | Network security or virtual private network VPN management software |  |
+| Intrusion detection system IDS | Network security or virtual private network VPN management software |  |
+| Ubuntu | Operating system software |  |
+| ArcSight Enterprise Threat and Risk Management | Risk management data and analysis software |  |
+| McAfee Enterprise Security Manager | Risk management data and analysis software |  |
+| Microsoft Defender Antivirus | Transaction security and virus protection software |  |
+| Microsoft Security Esssentials | Transaction security and virus protection software |  |
+| Tenable Nessus | Transaction security and virus protection software |  |
+| IBM Middleware | Transaction server software |  |
+| RESTful API | Web platform development software |  |
+| Security assertion markup language SAML | Web platform development software |  |
+| Collaborative editing software | Word processing software |  |
+
+<!-- market-evidence -->
+
+## Market evidence (job-ad analysis, 18 ads, as of 2026-07-12)
+
+Share of analyzed job ads mentioning the item (threshold ≥ 20 %). Source: JSearch/Adzuna APIs.
+
+### Tools
+
+- eMASS — **22 %**
+- Splunk — **17 %**
+- ACAS — **17 %**
+
+<!-- market-evidence -->