How I would approach endpoint, identity, compliance and AI-tool controls for a remote security firm, plus a working desk that audits Claude Code, Codex, Cursor and MCP configs and builds example managed policies.
About 140 people in 40+ countries on Google Workspace, Slack, GitHub and AWS, with MDM, SOC 2 Type II and ISO 27001-aligned controls in Vanta. Reviewing client code and installing dependencies are everyday exposure paths.
Keep laptops enrolled, accounts provisioned and removed on time, controls evidenced, and the AI tools that read client code configured to limit what a hostile repo can make them do.
A desk that audits agent configs, shows posture for a synthetic fleet with a dated evidence CSV, generates example managed policies for Jamf, Intune and Linux, and approximates how permission rules resolve before rollout.
| Takeaway | Why it matters here |
|---|---|
| Endpoints carry most of the risk | Investigations of the roughly USD 1.5 billion Bybit theft (February 2025) traced it through a compromised Safe developer workstation. Developer laptops can hold client code and sensitive credentials. |
| AI tools in use need policy | Anthropic, OpenAI and Cursor are on the public subprocessor list. Whichever products and data uses are approved, each needs managed settings that users and repos cannot quietly widen. |
| Evidence is part of the work | Onboarding, offboarding, enrolment and access-review records support audit evidence. Capturing them during the workflow saves reconstruction later. |
| Recruiting is an attack surface | Fake recruiters, fake take-home repos and fake applicants all target crypto firms. IT owns part of the check on both sides of hiring. |
A remote security firm that is now part of a listed ratings group. Each fact below changes something in the IT and security workload.
| Area | What is public | IT and security read |
|---|---|---|
| Ownership | S&P Global completed the acquisition on 26 October 2026. Its Q3 10-Q identifies the acquisition as part of the Ratings segment. OpenZeppelin keeps its name and runs as its own unit. | Possible integration work over time, such as parent-company questionnaires or vendor reviews. No public integration timetable. |
| Clients | OpenZeppelin names DTCC, Fidelity, Coinbase, Uniswap, Aave and the Ethereum Foundation among the organisations it works with, and reports that 9 of the 10 largest stablecoins by market cap use its Contracts. | Inbound security questionnaires from banks grow with this client list. |
| Assurance | SOC 2 Type I and Type II reports on request; program aligned with ISO/IEC 27001; GDPR and CCPA listed. Trust center hosted on Vanta. | Each control needs a named owner and a cadence; I would confirm how Vanta fits the evidence workflow. |
| Published controls | The trust center lists controls including an MDM system, employee background checks, remote-access MFA, penetration testing, asset disposal and security awareness training. | Much of the analyst's routine work maps onto these controls. |
| Stack (subprocessors) | Google Workspace, Slack, GitHub, AWS, Cloudflare, Notion, Zoom, Vanta, KnowBe4, Checkr, PagerDuty, and the AI vendors Anthropic, OpenAI and Cursor. | Provisioning and periodic vendor review apply to the ones staff log in to. |
| Team shape | The careers page lists about 140 people in 40+ countries, remote-first, with one-time equipment support of up to USD 500. | A distributed team makes device logistics, remote enrolment and remote wipe central. |
Attacks reported against crypto teams and their tooling (external examples, dated), the entry point each used, and controls at the analyst's level that reduce the exposure.
| Threat | Entry point | Controls that reduce it | In the demo |
|---|---|---|---|
| Fake take-home repos ("Contagious Interview", 2025 to 2026) | A fake recruiter sends a repo; npm install or a project config runs the payload. | Awareness for anyone hiring or job-hunting, no standing admin rights, EDR, project MCP servers off by default, managed hooks only. | CC-30, CC-50, CC-52 |
| npm package compromise (debug and chalk 2025, Shai-Hulud 2025, axios 2026) | A trusted dependency or an npx -y MCP server pulls a new malicious version. | Pinned versions, an MCP allowlist, secret-named variables stripped from agent commands. | MC-10, CX-20, CC-31 |
| Third-party packages impersonating the OpenZeppelin library | @openzeppelin-4/contracts, @openzeppelin-5/contracts and @opezneppelin/contracts, flagged malicious in OSV advisories of 11 and 13 August 2026. The official packages were not affected. | Registry allowlist or proxy, OSV checks in CI, a staff warning in the security newsletter, credentials kept out of developer environments. | MC-10 (unpinned packages) |
| Developer workstation to cloud (Safe and Bybit, February 2025) | A compromised developer workstation; stolen AWS access, then frontend manipulation. | Short sessions, hardware keys, session revocation on any incident, keystores unreadable by agents. | CC-20, Foundry and Solana keystore denies |
| Fake applicants (DPRK IT workers, FBI PSA of 13 Oct 2026) | Remote hire with a borrowed identity, laptop farm, remote-control tools. | Layered identity checks at offer, device shipped only to a verified address, review of remote-control tools such as AnyDesk and KVM-over-IP. The FBI notes no single indicator is enough. | Fleet tab: unenrolled laptop (EP-01) |
| Prompt injection through code under review | A comment or README in client code tells the agent to read keys or call a URL. | No bypass mode, scoped shell and fetch approvals, sandbox with a network allowlist. | CC-01, CC-10, CC-12, tab 4 |
| Staff and brand impersonation | Telegram accounts posing as staff (forum notice, 2020); the lookalike domain openzeppelin.digital reported on the forum in 2024. | Lookalike-domain monitoring, DMARC at reject when reports are clean, a reporting button in mail. | Out of scope |
The JD asks for "security and configuration controls of AI tools". Each client offers different enterprise controls: some are enforced, some are managed defaults, and some are additive allowlists. Where each lives, and what goes in it:
| Tool | Where the policy lives | Controls that matter most | Sign-in lock |
|---|---|---|---|
| Claude Code | macOS profile for com.anthropic.claudecode, Windows HKLM\SOFTWARE\Policies\ClaudeCode (Settings value), or managed-settings.json in the system folder. Enforced over user and project settings. | disableBypassPermissionsMode, secret-path denies, sandbox with failIfUnavailable, allowManagedHooksOnly, MCP allowlist | forceLoginMethod and forceLoginOrgUUID |
| Codex | requirements.toml (enforced) and managed defaults (users may change within the requirements); macOS domain com.openai.codex | Allowed approval and sandbox modes limited so unrestricted runs are refused; ignore_default_excludes = false as a default | allowed_login_methods, allowed_chatgpt_workspaces |
| Cursor | MDM policy (team id, extensions) plus permissions.json run-mode allowlists | No wildcard terminal or MCP auto-run; MCP tools run outside Cursor's sandbox | AllowedTeamId |
| MCP servers | Claude Code's managed-mcp.json or allowedMcpServers; each other client has its own MCP allowlist | Pinned versions, reviewed servers only, no tokens in config files | Per server OAuth where offered |
| Trap | What happens, and the fix |
|---|---|
Read(/Users/me/.ssh/**) in a deny list | One leading slash anchors the path at the settings file's folder, so the rule does not protect the intended file. Use //Users/... or ~/.ssh/**. |
| Read denies and scripts | Read denies also cover file commands Claude Code recognises in Bash (cat, head, tail, sed, tee, redirects). A Python or Node script that opens the file itself is outside them; the OS sandbox covers that path. |
Sandbox on, failIfUnavailable off | If the sandbox cannot start, commands fall back to running unsandboxed. failIfUnavailable: true makes that a hard stop. |
Bash(curl:*) as an egress control | The rule matches the command text, so /usr/bin/curl is not caught by it and falls to the other rules. Egress control belongs in the sandbox network allowlist. |
| Codex shell environment defaults | ignore_default_excludes defaults to true, so variables named KEY, SECRET and TOKEN are not filtered out automatically; set it to false or use filters. |
| A managed policy that still loses | Managed denies win, but users can add allow rules for anything the policy does not deny. allowManagedPermissionRulesOnly ignores non-managed rules; pilot it with one team first. |
Extension attribute reports which tools and config files exist on each laptop.
Bypass lock, secret denies, sign-in lock, MCP allowlist. Pilot on a few laptops first.
Push by team. A policy hash check marks devices current, stale or missing.
Sandbox, managed rules only for high-risk groups, quarterly review of the allowlists.
| Note | What I saw (10 Nov 2026) | Optional follow-up |
|---|---|---|
No security.txt | /.well-known/security.txt returned 404 on openzeppelin.com and www. Reporting channels are published: security@openzeppelin.com on the trust center, and Immunefi for the Contracts library. | An RFC 9116 file pointing to those same channels would make them easier for scanners and researchers to find. |
| JD line | How I would do it | Detailed in |
|---|---|---|
| Manage endpoint security tools (MDM such as Jamf or Intune) | Zero-touch enrolment, FileVault or BitLocker with escrowed keys, OS update deadlines, EDR on every device, admin rights only on request with an expiry. Weekly drift report from the MDM. | §04, demo tab 2 |
| Support security policies and procedures | Turn each policy into a setting MDM can enforce and an attribute it can report, so the policy and its evidence come from one place. | §★ AI tools |
| Internal audits and compliance documentation | Keep Vanta tests green between audits; collect evidence at the event (ticket, screenshot, export) and file it the same day. | §05 |
| Monitor system access, enforce controls | Periodic access reviews for Workspace, GitHub, AWS, Slack and the AI admin consoles, with owners signing off; alerts on new admin grants and OAuth apps. | §05 |
| Incident response | Support first response on endpoint and account cases under the team's process: contain (revoke sessions, lock device), preserve, timeline, hand over. Confirm the on-call expectations. | §02 |
| Onboarding and offboarding | One checklist per role, run from the HR trigger. Offboarding removes access in every system within the same business day and is logged as evidence. | §04 |
| Remote technical support | Async first: a short form that captures device, OS and error before the first reply; a known-issues page for the top ten requests. | §04 |
| IT assets and configuration docs | Asset register tied to MDM serials; disposal with a certificate of destruction; configuration as versioned files with a changelog. | §05 |
| Integrations, automations, scripting | Google Apps Script and Python for Workspace reports, MDM scripts for policy and drift checks, Slack alerts for the exceptions. | Demo tab 3 |
| Security awareness | Monthly newsletter item tied to a live threat (typosquats, fake recruiters, wallet drainers); KnowBe4 campaigns themed on the same. | §02 |
| AI tool security and configuration | Managed settings per tool, an approved MCP list, sign-in limited to company accounts, and a register of which products and data uses are approved. | §★ AI tools, demo |
An illustrative flow to adapt to existing controls: one run per person, triggered from HR, with evidence captured as each step completes. Targets are proposals.
| Stage | Steps | Evidence | Target |
|---|---|---|---|
| Before day 1 | Background check cleared; identity verified on video against the document; device shipped to the verified address; accounts created from the role template. | Check result, shipping record, account list | Ready 2 working days before start |
| Day 1 | Device enrolled, encryption on, phishing-resistant MFA registered, password manager set up, AI tools signed in to company accounts, policy acknowledgements signed. | MDM record, MFA method report, signed policies | Same day |
| Mover | Remove old role groups before adding new ones; re-run the AI tool allowlist for the new team. | Before and after group lists | Within 2 working days |
| Leaver | Suspend Workspace and revoke sessions; remove from GitHub, AWS, Slack and AI admin consoles; transfer files; rotate any shared secret they held; lock and wipe the device; arrange return. | Ticket with timestamps per system | Same business day |
| Device return | Track the return; wipe or certified destruction; update the register. | Certificate of destruction or wipe log | 30 days |
Recurring work behind a SOC 2 Type II period and ISO 27001 alignment. Control references are suggested; cadences are proposals, subject to policy, risk and audit scope.
| Control area | Cadence | Evidence | SOC 2 · ISO 27001 |
|---|---|---|---|
| Device compliance | Weekly | MDM export: enrolment, encryption, OS version, EDR, AI policy hash | CC6.8, CC7.1 · A.8.1, A.8.7, A.8.8, A.8.9 |
| Joiners and leavers | Per event | Ticket with per-system timestamps | CC6.2 · A.5.16, A.5.18 |
| Access reviews | Quarterly | Signed reviews for Workspace, GitHub, AWS, Slack, AI admin consoles | CC6.1, CC6.3 · A.5.18 |
| Awareness and phishing | Monthly | KnowBe4 completion and click rates; newsletter archive | CC2.2 · A.6.3 |
| Vendor review | Yearly per vendor | SOC 2 reports and questionnaires for the subprocessors, AI vendors included | CC9.2 · A.5.19, A.5.21, A.5.22 |
| AI tool configuration | Per change | Policy in version control, change ticket, fleet hash check | CC8.1 · A.8.9, A.8.32 |
| Asset disposal | Per event | Certificates of destruction tied to serials | CC6.5 · A.7.14 |
Built from the public job posting (2026), OpenZeppelin's trust center, S&P Global's filings and releases, vendor documentation and public threat reporting, read on 10 November 2026. The demo is my own tool built for this application: its fleet is synthetic and every token in it is fake. Setting names were checked against the linked vendor docs on that date, and an independent review re-tested the demo; client versions and behaviour still need validation on a test machine. The plan sections are an illustrative approach, to adapt to existing controls and priorities. Unsolicited interview homework; happy to walk through any section.
Company: trust center · S&P Q3 10-Q · careers
Claude Code: settings · permissions · managed settings
Codex: config reference · managed configuration · Cursor: deployment
Threats: AWS on npm attacks (medium-confidence attribution) · FBI PSA · OSV MAL-2026-13738
Disclosure: RFC 9116 · Contracts SECURITY.md · Bybit: Sygnia investigation
Demo: oz-itsec.pages.dev
Independent homework for the OpenZeppelin IT & Security Support Analyst role · 2026 · edwardtay.com