I am just graduating AUB, and i got a job offer secured for 2000$/month, cs major.
is that considered a high salary in Lebanon? whats the average? is that top 10%?
Would like to get some insights
thank you
Putting together a detection engineering + cloud security program from scratch on AWS. Would love feedback from people who've actually done this especially on gaps I'm not seeing.
NOTE: we are just starting with cybersecurity, we are a startup
My Stack
- S3 buckets (application data + artifacts)
- Elastic Beanstalk (web app hosting)
- CI/CD pipeline
- Small team, not a dedicated security org
The Plan
Phase 1 — Visibility (Week 1)
- CloudTrail enabled, logs → central S3 security bucket
- S3 server access logging enabled on all buckets
- Beanstalk logs → CloudWatch → Kinesis Firehose → S3
- GuardDuty, Security Hub, Macie, IAM Access Analyzer all turned on
Phase 2 — Detection (Week 2)
- Athena on top of central log bucket
- Scheduled detections via EventBridge → Lambda → Athena
- Initial rule set covering:
- S3 anonymous access + mass downloads
- Bucket policy / ACL modifications
- IAM user/key creation (persistence)
- Beanstalk environment variable changes
- CI/CD pipeline source tampering
- Manual approval bypass in pipeline
- Findings → SNS → Slack + Security Hub
Phase 3 — Hardening (Week 3)
- S3: block public access account-wide, versioning + MFA delete, KMS encryption
- Beanstalk: IMDSv2 enforced, secrets moved to Secrets Manager, WAF on ALB, least privilege EC2 role
- CI/CD: separate IAM roles per stage, SAST (Semgrep) + dependency scanning (Trivy) in pipeline, artifact signing, manual approval gate before prod
Phase 4 — Response (Week 4)
- IR runbooks written per scenario (S3 exfil, Beanstalk compromise, CI/CD tampering)
- Automated response for high confidence findings (isolate instance, revoke key)
- Detection rules stored in Git, deployed via CI/CD (detection-as-code)
Known Gaps I'm Aware Of
- No runtime/agent-based visibility inside Beanstalk instances yet
- No app-level security (DAST, pen test) — only infrastructure layer
- Alert tuning will take time, expect noise early
- No threat intel integration
- Behavioral baselining not built yet
Questions
what do yout think generally about the plan
For a small team on this stack, what would YOU prioritize first that I'm missing?
Is Athena + Lambda a reasonable detection engine at this scale or should I just go straight to OpenSearch?
What's the one thing that would actually get us breached that isn't on this list?
Happy to share more details on any part. Looking for honest feedback, not validation.
Putting together a detection engineering + cloud security program from scratch on AWS. Would love feedback from people who've actually done this especially on gaps I'm not seeing.
NOTE: we are just starting with cybersecurity, we are a startup
My Stack
- S3 buckets (application data + artifacts)
- Elastic Beanstalk (web app hosting)
- CI/CD pipeline
- Small team, not a dedicated security org
The Plan
Phase 1 — Visibility (Week 1)
- CloudTrail enabled, logs → central S3 security bucket
- S3 server access logging enabled on all buckets
- Beanstalk logs → CloudWatch → Kinesis Firehose → S3
- GuardDuty, Security Hub, Macie, IAM Access Analyzer all turned on
Phase 2 — Detection (Week 2)
- Athena on top of central log bucket
- Scheduled detections via EventBridge → Lambda → Athena
- Initial rule set covering:
- S3 anonymous access + mass downloads
- Bucket policy / ACL modifications
- IAM user/key creation (persistence)
- Beanstalk environment variable changes
- CI/CD pipeline source tampering
- Manual approval bypass in pipeline
- Findings → SNS → Slack + Security Hub
Phase 3 — Hardening (Week 3)
- S3: block public access account-wide, versioning + MFA delete, KMS encryption
- Beanstalk: IMDSv2 enforced, secrets moved to Secrets Manager, WAF on ALB, least privilege EC2 role
- CI/CD: separate IAM roles per stage, SAST (Semgrep) + dependency scanning (Trivy) in pipeline, artifact signing, manual approval gate before prod
Phase 4 — Response (Week 4)
- IR runbooks written per scenario (S3 exfil, Beanstalk compromise, CI/CD tampering)
- Automated response for high confidence findings (isolate instance, revoke key)
- Detection rules stored in Git, deployed via CI/CD (detection-as-code)
Known Gaps I'm Aware Of
- No runtime/agent-based visibility inside Beanstalk instances yet
- No app-level security (DAST, pen test) — only infrastructure layer
- Alert tuning will take time, expect noise early
- No threat intel integration
- Behavioral baselining not built yet
Questions
what do yout think generally about the plan
For a small team on this stack, what would YOU prioritize first that I'm missing?
Is Athena + Lambda a reasonable detection engine at this scale or should I just go straight to OpenSearch?
What's the one thing that would actually get us breached that isn't on this list?
Happy to share more details on any part. Looking for honest feedback, not validation.