As an experienced software developer I feel like I have decent understanding of how to harden my code both line-by-line and through sound architectural decisions, avoiding mistakes from memory safety to injection to permissions to race conditions to what-have-you. But I will gladly acknowledge that I'm not an expert system administrator and generally need to rely on others who have the necessary skills to set up servers and avoid misconfigurations to the standard I feel like can uphold in my own code.

Seeing a formulaic approach to pen-testing is inspiring. I feel as though if I were to practice, I would eventually be able to develop routines and understanding of how to test for and detect common errors. It would be nice to build additional competence and collaborate more effectively with expert sysadmins, even if I don't plan to masquerade as one.

What sort of basic checks should one perform after provisioning a server or making a service available? (Perform a port scan, validate that an internal server is inaccessible from the wider net, etc.)