How I would run endpoint, identity, compliance and AI-tool controls for a remote security firm, plus a working desk that audits Claude Code, Codex, Cursor and MCP configs and builds the managed policy.
About 140 people in 40+ countries on Google Workspace, Slack, GitHub and AWS, with MDM, SOC 2 Type II and ISO 27001-aligned controls in Vanta. Staff read client code before disclosure and run npm install all day.
Keep every laptop enrolled, every account provisioned and removed on time, every control evidenced, and the AI tools that read client code configured so a hostile repo cannot turn them against the laptop.
A desk that audits agent configs, shows fleet posture with a dated evidence CSV, builds the managed policy for Jamf, Intune and Linux, and tests the permission rules before rollout.
| Takeaway | Why it matters here |
|---|---|
| The laptop is the perimeter | The largest crypto heist on record started on one developer laptop. A security firm's laptops hold client code and sometimes deployer keys. |
| AI tools are sanctioned, so they need policy | Anthropic, OpenAI and Cursor are on the public subprocessor list. Approved tools need a managed policy that users and repos cannot override. |
| Evidence is part of the work | Each onboarding, offboarding, enrolment and access review is a SOC 2 artefact. Capturing it at the time costs minutes; rebuilding it at audit costs days. |
| Recruiting is an attack surface | Fake recruiters, fake take-home repos and fake applicants all target crypto firms. IT owns part of the check on both sides of hiring. |
A remote security firm that is now part of a listed ratings group. Each fact below changes something in the IT and security workload.
| Area | What is public | IT and security read |
|---|---|---|
| Ownership | S&P Global completed the acquisition on 26 October 2026. Its Q3 10-Q books it in the Ratings segment. OpenZeppelin keeps its name and runs as its own unit. | Expect parent-company questionnaires, vendor reviews and possibly identity federation over time. |
| Clients | DTCC, Fidelity, Coinbase, Uniswap, Aave, the Ethereum Foundation. Contracts libraries used by 9 of the top 10 stablecoins. | Inbound security questionnaires from banks grow with this client list. |
| Assurance | SOC 2 Type I and Type II reports on request; program aligned with ISO/IEC 27001; GDPR and CCPA listed. Trust center hosted on Vanta. | Evidence lives in Vanta. Every control below needs a named owner and a cadence. |
| Published controls | MDM in use, background checks, remote-access MFA, annual pentest, asset disposal with certificates, awareness training at hire and yearly, continuous phishing tests. | These are the analyst's weekly tasks, written as controls. |
| Stack (subprocessors) | Google Workspace, Slack, GitHub, AWS, Cloudflare, Notion, Zoom, Vanta, KnowBe4, Checkr, PagerDuty, and the AI vendors Anthropic, OpenAI and Cursor. | Seventeen vendors to onboard and offboard people from, and to review. |
| Team shape | About 140 people, 40+ countries, remote-first, USD 500 home-office stipend, co-working stipend. | Devices bought locally and shipped across borders. Zero-touch enrolment and remote wipe carry the load. |
The attacks that reached crypto teams in 2025 and 2026, the entry point each used, and the control that stops it at the analyst's level.
| Threat | Entry point | Control at the endpoint | In the demo |
|---|---|---|---|
| Fake take-home repos ("Contagious Interview") | A recruiter sends a repo; npm install or a project config runs the payload. | Project MCP servers off by default, managed hooks only, no admin rights, EDR on install scripts. | CC-30, CC-50, CC-52 |
| npm package compromise (axios, debug and chalk, Shai-Hulud) | A trusted dependency or an npx -y MCP server pulls a new malicious version. | Pinned versions, an MCP allowlist, secret-named variables stripped from agent commands. | MC-10, CX-20, CC-31 |
| Typosquats of the OpenZeppelin library | @openzeppelin-5/contracts and two others, flagged malicious in August 2026 (OSV MAL-2026-13737, 13738, 13940). | Registry allowlist or proxy, OSV checks in CI, a staff warning in the security newsletter. | Secret-path denies (CC-20) |
| Developer laptop to wallet or cloud (Safe and Bybit, 2025) | A malicious project on a privileged laptop; live cloud session tokens reused. | Short sessions, hardware keys, session revocation on any incident, keystores unreadable by agents. | CC-20, Foundry and Solana keystore denies |
| Fake applicants (DPRK IT workers, FBI PSA of 13 Oct 2026) | Remote hire with a borrowed identity, laptop farm, remote-control tools. | Identity checks at offer, device shipped only to a verified address, alerts on AnyDesk and KVM-over-IP. | Fleet tab: unenrolled laptop (EP-01) |
| Prompt injection through code under review | A comment or README in client code tells the agent to read keys or call a URL. | No bypass mode, scoped shell and fetch approvals, sandbox with a network allowlist. | CC-01, CC-10, CC-12, tab 4 |
| Staff and brand impersonation | Telegram accounts posing as staff; the lookalike domain openzeppelin.digital reported in 2024. | Lookalike-domain monitoring, DMARC at reject when reports are clean, a reporting button in mail. | Out of scope |
The JD asks for "security and configuration controls of AI tools". Each tool has a system-level file that users cannot override. Which one to use, and what goes in it:
| Tool | Where the policy lives | Controls that matter most | Sign-in lock |
|---|---|---|---|
| Claude Code | macOS profile for com.anthropic.claudecode, Windows HKLM\SOFTWARE\Policies\ClaudeCode, or managed-settings.json in the system folder | disableBypassPermissionsMode, secret-path denies, sandbox with failIfUnavailable, allowManagedHooksOnly, MCP allowlist | forceLoginMethod and forceLoginOrgUUID |
| Codex | requirements.toml (enforced) and managed defaults; macOS domain com.openai.codex | Approval and sandbox modes limited so --yolo is refused; ignore_default_excludes = false | allowed_login_methods, allowed_chatgpt_workspaces |
| Cursor | MDM policy (team id, extensions) plus permissions.json run-mode allowlists | No wildcard terminal or MCP auto-run; MCP tools run outside Cursor's sandbox | AllowedTeamId |
| MCP servers | managed-mcp.json or allowlists in each tool | Pinned versions, reviewed servers only, no tokens in config files | Per server OAuth where offered |
| Trap | What happens, and the fix |
|---|---|
Read(/Users/me/.ssh/**) in a deny list | One leading slash anchors the path at the settings file's folder, so the deny protects nothing. Use //Users/... or ~/.ssh/**. |
| Read denies with an approved shell | Read rules govern the Read tool. cat ~/.ssh/id_ed25519 through an approved shell prefix is a separate path; the sandbox closes it. |
Sandbox on, failIfUnavailable off | If the sandbox cannot start, commands run unsandboxed without warning. |
Bash(curl:*) as an egress control | Matches the command text, so /usr/bin/curl passes. Egress belongs in the sandbox network allowlist. |
| Codex shell environment defaults | ignore_default_excludes defaults to true, which keeps variables named KEY, SECRET and TOKEN in every command the agent runs. |
| A managed policy that still loses | Managed denies win, but users can pre-approve anything the policy does not deny. allowManagedPermissionRulesOnly closes that; pilot it with the audit and IR teams first. |
Extension attribute reports which tools and config files exist on each laptop.
Bypass lock, secret denies, sign-in lock, MCP allowlist. Pilot on five laptops for a week.
Push by team. A policy hash check marks devices current, stale or missing.
Sandbox, managed rules only for high-risk groups, quarterly review of the allowlists.
Spotted while researching, checked on 10 November 2026. Both may be deliberate.
| Note | What I saw | Possible follow-up |
|---|---|---|
npm latest tag behind the GitHub release | GitHub marks v5.7.0 (29 Jul 2026) as Latest. On npm, @openzeppelin/contracts and -upgradeable have latest = 5.6.1 and 5.7.0 on dev, so a plain npm install gets 5.6.1. | Confirm the tag policy, or move latest. |
No security.txt | /.well-known/security.txt returns 404 on openzeppelin.com. The security contact is on the trust center FAQ and in each repo's SECURITY.md. | Publish an RFC 9116 file pointing to the same contacts. |
| JD line | How I would do it | Detailed in |
|---|---|---|
| Manage endpoint security tools (Jamf, Intune) | Zero-touch enrolment, FileVault or BitLocker with escrowed keys, OS update deadlines, EDR on every device, admin rights only on request with an expiry. Weekly drift report from the MDM. | §04, demo tab 2 |
| Support security policies and procedures | Turn each policy into a setting MDM can enforce and an attribute it can report, so the policy and its evidence come from one place. | §★ AI tools |
| Internal audits and compliance documentation | Keep Vanta tests green between audits; collect evidence at the event (ticket, screenshot, export) and file it the same day. | §05 |
| Monitor system access, enforce controls | Quarterly access reviews for Workspace, GitHub, AWS, Slack and the AI admin consoles, with owners signing off; alerts on new admin grants and OAuth apps. | §05 |
| Incident response | Own the first hour for endpoint and account cases: contain (revoke sessions, lock device), preserve, timeline, hand over. Join the PagerDuty rota. | §02 |
| Onboarding and offboarding | One checklist per role, run from the HR trigger. Offboarding removes access in every system within the same business day and is logged as evidence. | §04 |
| Remote technical support | Async first: a short form that captures device, OS and error before the first reply; a known-issues page for the top ten requests. | §04 |
| IT assets and configuration docs | Asset register tied to MDM serials; disposal with a certificate of destruction; configuration as versioned files with a changelog. | §05 |
| Integrations, automations, scripting | Google Apps Script and Python for Workspace reports, MDM scripts for policy and drift checks, Slack alerts for the exceptions. | Demo tab 3 |
| Security awareness | Monthly newsletter item tied to a live threat (typosquats, fake recruiters, wallet drainers); KnowBe4 campaigns themed on the same. | §02 |
| AI tool security and configuration | Managed policy per tool, an approved MCP list, sign-in locked to company accounts, a register of what each tool may read. | §★ AI tools, demo |
One run per person, triggered from HR, with the evidence captured as each step completes.
| Stage | Steps | Evidence | Target |
|---|---|---|---|
| Before day 1 | Background check cleared; identity verified on video against the document; device shipped to the verified address; accounts created from the role template. | Check result, shipping record, account list | Ready 2 working days before start |
| Day 1 | Device enrolled, encryption on, hardware key registered, password manager set up, AI tools signed in to company accounts only, policy acknowledgements signed. | MDM record, MFA method report, signed policies | Same day |
| Mover | Remove old role groups before adding new ones; re-run the AI tool allowlist for the new team. | Before and after group lists | Within 2 working days |
| Leaver | Suspend Workspace and revoke sessions; remove from GitHub, AWS, Slack and AI admin consoles; transfer files; rotate any shared secret they held; lock and wipe the device; arrange return. | Ticket with timestamps per system | Same business day |
| Device return | Track the return; wipe or certified destruction; update the register. | Certificate of destruction or wipe log | 30 days |
The recurring work behind a SOC 2 Type II period and ISO 27001 alignment, with suggested control references.
| Control area | Cadence | Evidence | SOC 2 · ISO 27001 |
|---|---|---|---|
| Device compliance | Weekly | MDM export: enrolment, encryption, OS version, EDR, AI policy hash | CC6.8 · A.8.1, A.8.9 |
| Joiners and leavers | Per event | Ticket with per-system timestamps | CC6.2 · A.5.16, A.5.18 |
| Access reviews | Quarterly | Signed reviews for Workspace, GitHub, AWS, Slack, AI admin consoles | CC6.1, CC6.3 · A.5.18 |
| Awareness and phishing | Monthly | KnowBe4 completion and click rates; newsletter archive | CC2.2 · A.6.3 |
| Vendor review | Yearly per vendor | SOC 2 reports and questionnaires for the subprocessors, AI vendors included | CC9.2 · A.5.19, A.5.21 |
| AI tool configuration | Per change | Policy in version control, change ticket, fleet hash check | CC8.1 · A.8.9 |
| Asset disposal | Per event | Certificates of destruction tied to serials | CC6.5 · A.7.14 |
Built from the public job posting (2026), OpenZeppelin's trust center, S&P Global's filings and releases, vendor documentation and public threat reporting, read on 10 November 2026. The demo is my own tool built for this application: its fleet is synthetic and every token in it is fake. Setting names follow the vendor docs on that date. Unsolicited interview homework; happy to walk through any section.
Company: trust center · S&P Q3 10-Q · careers
Claude Code: settings · permissions · managed settings
Codex: config reference · managed configuration · Cursor: deployment
Threats: AWS on npm attacks · FBI PSA · OSV MAL-2026-13738
npm: @openzeppelin/contracts · releases · RFC 9116
Demo: oz-itsec.pages.dev
Independent homework for the OpenZeppelin IT & Security Support Analyst role · 2026 · edwardtay.com