The real daily work nobody talks about:
- OPA/Rego policies for K8s admission control
- IAM permission boundaries that don't break CI/CD
- CSPM rules catching public RDS snapshots pre-deploy
- Lambda auto-remediation on GuardDuty findings
- Cross-account AssumeRole audit at scale