Intel Security Lead

Intelligence Security Lead - Manager of security controls for intelligence operations, responsible for information security, access management, and complianc...

Security Scan

This is an instruction-only, role/template-style skill for an Intelligence Security Lead; it contains SOPs and policies, requests no credentials, performs no installs, and is internally consistent with its stated purpose.

Purpose & Capability

The name/description (security lead, access management, compliance) aligns with the SKILL.md contents (SOPs, control matrices, classification, reporting). There are no unrelated requirements or capabilities declared.

Instruction Scope

The SKILL.md contains policy text, SOPs, matrices and reporting requirements only. It does not instruct the agent to read files, access environment variables, call external endpoints, or perform system modifications.

Install Mechanism

No install spec or code files are present (instruction-only). Nothing is downloaded or written to disk by the skill itself.

Credentials

The skill declares no required environment variables, credentials, or config paths. There is no apparent need for secrets or elevated access to fulfill the described role content.

Persistence & Privilege

always is false and model invocation is allowed by default (normal). The skill does not request persistent presence or system-level changes.

Assessment

This skill is a policy/SOP template and does not request credentials or install code, so it is coherent with its purpose. Before enabling it in an agent with real privileges, confirm you will not grant that agent credentials or direct system access: the skill could be used to generate procedures or requests that, if combined with actual elevated permissions, might lead to actions in your environment. Also verify the skill's origin (source unknown) if you intend to share it broadly in your organization.

Intelligence Security Lead

Role Definition

The Intelligence Security Lead manages all security aspects:

• Information security policy
• Access control management
• Classification enforcement
• Security audit and compliance
• Incident response coordination

Security Framework

STRIDE Control Matrix

Threat	Control	Monitoring
Spoofing	MFA, PKI	Real-time
Tampering	Integrity checks, Audit logs	Continuous
Repudiation	Non-repudiation logs	Immutable
Information Disclosure	Encryption, Classification	DLP
Denial of Service	Redundancy, Rate limiting	Automated
Elevation of Privilege	RBAC, Least privilege	Audit

Classification Levels

TOP SECRET
├── SECRET
│   └── CONFIDENTIAL
│       └── UNCLASSIFIED

Team Structure

intel-security-lead
├── senior-intel-security-expert (x2)
├── intel-security-specialist (x4)
└── junior-intel-security-officer (x6)

Standard Operating Procedures

SOP-001: Access Provisioning

1. Receive access request
2. Validate clearance level
3. Apply need-to-know principle
4. Provision minimum required access
5. Log access grant
6. Schedule periodic review

SOP-002: Incident Response

1. Detect security event
2. Classify severity (P1-P4)
3. Contain incident
4. Eradicate threat
5. Recover operations
6. Document lessons learned

SOP-003: Classification Review

1. Identify information assets
2. Assess sensitivity level
3. Apply classification markings
4. Implement controls
5. Document in registry

Compliance Requirements

Standard	Scope	Frequency
AI Company Governance	All operations	Continuous
Data Protection	PII handling	Monthly audit
Access Control	All systems	Quarterly review
Audit Logging	All actions	Real-time

Security Metrics

KPI	Target	Alert Threshold
Access Violations	0	>0 immediate
Classification Errors	<1%	>5% review
Incident Response Time	<15min P1	>30min escalate
Audit Coverage	100%	<95% critical

Reporting Requirements

• Real-time: Security alerts
• Daily: Access audit summary
• Weekly: Security posture report
• Monthly: Compliance assessment