IT / Security Engineer — First Week Onboarding

Overview

This guide is for a new IT or security engineer joining Cirius Group. It covers what access to get, what to install, what to read, and what to do in your first week to become operational. The goal is for you to be able to triage a SecOps alert, make a basic infrastructure change, and understand the environment well enough to work without hand-holding by the end of week one.

This is separate from the HR/security compliance checklist in Onboarding Security Checklist — that covers compliance requirements. This one covers operations.

Day 1 — Get Your Accounts and Tools

Accounts to Request (Rory does these)

Account	What It Gives You	Notes
Entra ID (`@ciriusgroup.com`)	Azure Portal, M365, Twingate, Conditional Access	Day 1 — provisioned by Rory
Keeper Security	Password vault	Day 1 — Rory assigns you to shared folders
GitHub — Cirius-Group-Inc org	Read access to all repos	Ask Rory for org invite
SecOps platform	`secops.bedrockcybersecurity.org` analyst access	Auto via Entra SSO once account is in the right group
AWS SSO	Access to all 7 AWS accounts	Rory adds you to the Identity Center permission set
Arctic Wolf portal	Read-only MDR view	Rory creates the Arctic Wolf sub-account
Panorama	Read-only first; write access after ramp	Rory creates the Panorama analyst account

Tools to Install (Day 1)

bash

# Twingate — required to reach any private infrastructure
# Download from: https://www.twingate.com/download
# Network name: cirius

# AWS CLI v2
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip && sudo ./aws/install

# Azure CLI
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# Terraform
# Download from: https://developer.hashicorp.com/terraform/install

# GitHub CLI
# https://cli.github.com/

# Keeper browser extension
# https://keepersecurity.com/download.html

Set Up AWS SSO

After Rory adds you to Identity Center:

bash

# Create ~/.aws/config — copy the profile block from runbooks/aws-account-access.md
# Then log in:
aws sso login --profile main
aws sts get-caller-identity --profile prod   # verify access

Full details: AWS Account Access Guide

Set Up Azure CLI

bash

az login
az account list --output table   # verify you see PROD subscriptions

Full details: Azure Daily Operations Guide

Day 1–2 — Read These Docs in Order

The docs below build on each other. Read them in this order — by the end you'll have a mental model of the entire environment.

1. Architecture — What Exists

Doc	Why Read It
Azure Infrastructure Overview	Subscriptions, resource groups, what lives where in Azure PROD
AWS DR Overview	The 7 AWS accounts, what's in each, DR relationship to Azure
Network Topology	VNet/VPC CIDRs, zone layout, how traffic flows
Two-Firewall Architecture	PublicFW and PrivateFW roles, the VPNLYR design
Security Monitoring Architecture	All 17 agents, how they're organized, what they detect

2. Access — How to Get Around

Doc	Why Read It
AWS Account Access Guide	AWS SSO, profiles, daily CLI workflow
Azure Daily Operations Guide	Azure CLI, subscription switching, Twingate + PROD access
Twingate Operations	Remote access system, resource tiers, how group sync works
Keeper Credential Guide	Where all credentials live, naming conventions

3. Security Operations — How Monitoring Works

Doc	Why Read It
SecOps Platform Guide	The platform at secops.bedrockcybersecurity.org, incident lifecycle, APIs
SecOps Findings Triage Guide	How to work the open queue — your primary daily task
Agent Development Guide	How agents are built, output contract, how to write a new one

4. Response — What to Do When Something Goes Wrong

Doc	Why Read It
Incident Response	P1–P4 procedures — ransomware, compromised accounts, outages
Break-Glass Procedure	Emergency access when normal auth is broken
Emergency Mode Operation Plan	What continues during an outage, who decides what

5. Compliance — Why Things Are the Way They Are

Doc	Why Read It
HIPAA Risk Assessment	The risk register — 7 risks and their controls
HIPAA Administrative Procedures	Core HIPAA policies
SOC2 PBC Guide	What the September 2026 audit will ask for

Day 2–3 — Explore the Live Systems

By now you have access. Spend time exploring before you change anything.

SecOps Platform

Log into secops.bedrockcybersecurity.org
Look at the Incidents list — understand what's currently OPEN and why
Find a CLOSED incident and read through it — see what an agent finding looks like
Find the Known-Good Rules list — understand what's being suppressed and why

AWS Console

bash

# Log in and explore
aws sso login --profile main
aws ec2 describe-instances --profile prod --output table   # DR workloads
aws s3 ls --profile backup                                  # backup buckets
aws cloudtrail lookup-events --profile logging \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --max-items 10                                            # recent console logins

Azure Portal

Log in at https://portal.azure.com
Navigate to rg-logging-logs (logging subscription) — this is where most of the security infrastructure lives (SecOps Container App, Log Analytics, archive storage)
Open Log Analytics workspace cirius-logging-law-central → Logs → run a simple query:
kql
```
SignInLogs | where TimeGenerated > ago(1h) | limit 10
```
Check Container Apps → ca-secops-prod — see the running revision and recent log output

GitHub Repos

bash

gh repo list Cirius-Group-Inc --limit 20   # all repos

Clone and skim (don't modify yet):

bash

git clone git@github.com:Cirius-Group-Inc/bedrock-soc.git
git clone git@github.com:Cirius-Group-Inc/bedrock-docs.git

Look at bedrock-soc/agents/ — see how agents are structured. Read cert_expiry_agent.py (the simplest complete agent) end-to-end.

Arctic Wolf Portal

Log in and check the current alert state. Note any open cases. Familiarize yourself with the Concierge Security Team contact method — you'll need it during an incident.

Day 3–5 — Understand the Rules

Hard Rules You Must Know Before Making Any Change

Before you touch anything in production, internalize these:

Never terraform apply locally. All applies go through GitHub Actions after a PR merge. Local Terraform is plan-only.
Never push to main. Branch → PR → CI → merge. Always.
Never suppress break-glass account activity. These fire as CRITICAL in SecOps and have a hard API block preventing suppression.
Never auto-approve known-good rules. Rory is final authority on all suppressions.
Never store secrets in code. Key Vault (Azure) or Secrets Manager (AWS). Never in environment variables or committed files.

These are in CLAUDE.md (the operating instructions for the Kobe AI agent) and apply to humans too.

Change Process

Every infrastructure change follows the same pattern:

Branch off main in the relevant repo
Make changes
Open a PR — CI runs Checkov and terraform plan, plan output posted as comment
Rory reviews the diff and plan
Merge triggers terraform apply via OIDC

The SecOps CM ticket is auto-created on merge. SecurityAgent checks for the CM ticket before alerting on infrastructure changes — so skipping the PR process will cause false alerts.

Week 1 Goal — First Contribution

By the end of week 1, make one real contribution. Good first tasks:

Populate the training completion log after completing your KnowBe4 training: compliance/training-completion-log.md — add your row to the 2026 table
Triage the SecOps queue on your own after reading the triage guide — then review with Rory to see if your calls were right
Run terraform plan on a non-prod workspace — pick aws-infra/dev or azure-infra/dev, authenticate, init, plan, and read the output
Write a doc for something you figured out during onboarding that wasn't documented — the best contributions often come from someone experiencing the gaps for the first time

Key Contacts

Person	Role	When to Contact
Rory	Security Officer, IT Lead, final authority on all changes	Anything you're unsure about, all PR reviews, all known-good rule approvals
Kevin	T1 Domain Admin	Domain-level escalation (AD, GPO, DNS)
Greg	T1 Domain Admin	Domain-level escalation, DR co-ordination
Adriana	Compliance coordination	HIPAA/SOC2 docs, vendor BAAs, SharePoint uploads
Arctic Wolf MDR	24/7 incident response	Active incidents, second-opinion on CRITICAL findings

Contact methods for Kevin, Greg, and Adriana are in Keeper → Emergency Contacts.

What "Done" Looks Like at End of Week 1

[ ] All accounts provisioned and tested (AWS SSO, Azure, SecOps, GitHub, Arctic Wolf)
[ ] Twingate, Keeper, AWS CLI, Azure CLI all working from your machine
[ ] Have read all 14 docs in the reading list above
[ ] Have explored live systems (SecOps, AWS console, Azure portal, GitHub repos)
[ ] Understand the 5 hard rules and the PR/merge/CM workflow
[ ] Made one real contribution
[ ] Know how to find any credential you need in Keeper
[ ] Know how to reach Arctic Wolf in an emergency

Onboarding Security Checklist — HR/security compliance checklist
CLAUDE.md — Operating instructions and hard rules for this environment
SecOps Findings Triage Guide — Your primary daily task explained

Document History

Date	Change	Author
May 2026	Initial draft — week 1 account setup, reading list, live system exploration, hard rules, first contribution ideas, done criteria.	Rory

IT / Security Engineer — First Week Onboarding ​

Overview ​

Day 1 — Get Your Accounts and Tools ​

Accounts to Request (Rory does these) ​

Tools to Install (Day 1) ​

Set Up AWS SSO ​

Set Up Azure CLI ​

Day 1–2 — Read These Docs in Order ​

1. Architecture — What Exists ​

2. Access — How to Get Around ​

3. Security Operations — How Monitoring Works ​

4. Response — What to Do When Something Goes Wrong ​

5. Compliance — Why Things Are the Way They Are ​

Day 2–3 — Explore the Live Systems ​

SecOps Platform ​

AWS Console ​

Azure Portal ​

GitHub Repos ​

Arctic Wolf Portal ​

Day 3–5 — Understand the Rules ​

Hard Rules You Must Know Before Making Any Change ​

Change Process ​

Week 1 Goal — First Contribution ​

Key Contacts ​

What "Done" Looks Like at End of Week 1 ​

Related Documents ​

Document History ​

IT / Security Engineer — First Week Onboarding

Overview

Day 1 — Get Your Accounts and Tools

Accounts to Request (Rory does these)

Tools to Install (Day 1)

Set Up AWS SSO

Set Up Azure CLI

Day 1–2 — Read These Docs in Order

1. Architecture — What Exists

2. Access — How to Get Around

3. Security Operations — How Monitoring Works

4. Response — What to Do When Something Goes Wrong

5. Compliance — Why Things Are the Way They Are

Day 2–3 — Explore the Live Systems

SecOps Platform

AWS Console

Azure Portal

GitHub Repos

Arctic Wolf Portal

Day 3–5 — Understand the Rules

Hard Rules You Must Know Before Making Any Change

Change Process

Week 1 Goal — First Contribution

Key Contacts

What "Done" Looks Like at End of Week 1

Related Documents

Document History