Compliance Engineer

Compliance Engineer

When to Use

• Map security, privacy, or operational frameworks to technical controls
• Build audit evidence pipelines from infrastructure, CI/CD, IdP, or ticketing systems
• Design continuous control monitoring and exception workflows
• Prepare evidence packages and remediation tracking for SOC 2, ISO 27001, GDPR, HIPAA, PCI, or NIST CSF
• Translate policy requirements into testable engineering checks

When NOT to Use

• Contract negotiation, DPAs, or commercial redlines → commercial-counsel
• Corporate governance, board approvals, or entity matters → corporate-counsel
• Financial close controls, journal entries, or SOX accounting evidence → senior-revenue-accountant
• Broad security strategy without audit/control mapping → cybersecurity
• CI/CD scan configuration without compliance evidence requirements → devsecops
• Cloud-only framework evidence, residency, FedRAMP/PCI in AWS/GCP/Azure → cloud-compliance-specialist
• GRC program charter, gap plans, audit prep, vendor questionnaires (non-technical) → compliance-specialist
• Execute authorized penetration tests or write offensive findings → penetration-tester

Related skills

Core Workflows

1. Framework scoping

1. Identify in-scope systems, data classes, and subprocessors 2. Select frameworks (e.g., SOC 2 Type II, ISO 27001, GDPR, HIPAA, PCI) 3. Define trust service criteria / Annex A controls in scope 4. Document exclusions with risk acceptance 5. Align calendar: observation period, audit windows, evidence cutoffs

See `references/framework_scoping.md` for common scope boundaries.

2. Control design and mapping

Translate each control to testable technical implementation:

Avoid controls that cannot be evidenced automatically or manually on schedule.

See `references/control_mapping.md` for SOC 2 / ISO mapping patterns.

3. Evidence automation

control ID → evidence source (API, Git, SIEM) → collector → storage → reviewer attestation

Evidence quality rules:

• Timestamped, tamper-evident storage
• Named owner per control
• Sample size documented for population controls
• Redact customer PII in shared audit folders

See `references/evidence_automation.md` for source catalog and collection cadence.

4. Continuous control monitoring

• Detect drift from baseline (public buckets, open SGs, missing MFA)
• Alert owners before audit finding
• Integrate CSPM, Git policy checks, and HRIS for joiner/leaver
• Weekly dashboard: pass/fail per control, trend

See `references/continuous_monitoring.md` for CCM metrics and alert routing.

5. Gap assessment and remediation

1. Run gap analysis against chosen framework 2. Classify: missing control, partial, implemented 3. Assign remediation with owner, due date, evidence plan 4. Verify fix with re-test and attach proof 5. Track exceptions with expiry and approver

See `references/audit_readiness.md` for pre-audit checklist.

6. Auditor engagement (engineering)

Prepare evidence packages per control family:

• Access (IdP, reviews, privileged accounts)
• Change management (PR approvals, deploy logs)
• Vulnerability management (scan reports, SLAs)
• Logging and monitoring (retention config, alert samples)
• Vendor risk (subprocessor list, reviews)

Provide narrative only where logs are insufficient; prefer primary artifacts.

See `references/audit_readiness.md` for walkthrough agenda and FAQ for auditors.

7. Privacy engineering hooks (GDPR-style)

Coordinate with data-architect for:

• Data inventory and lawful basis documentation
• DSR workflows (access/delete) with engineering tickets
• DPIA triggers for new processing
• Cross-border transfer mechanisms (SCCs, etc.) as documented requirements—not legal advice

When to load references

• Scope and frameworks → references/framework_scoping.md
• Control mapping → references/control_mapping.md
• Evidence collectors → references/evidence_automation.md
• Drift and CCM → references/continuous_monitoring.md
• Audit prep → references/audit_readiness.md

Audit readiness

Table of contents

1. Pre-audit checklist 2. Walkthrough agenda 3. Common auditor requests

Pre-audit checklist

• [ ] Control matrix current; owners confirmed
• [ ] Evidence complete for observation period
• [ ] Exceptions documented with approval
• [ ] Sample populations prepared (users, changes, tickets)
• [ ] Key personnel briefed on walkthrough
• [ ] Change freeze or comms plan for audit week

Walkthrough agenda

1. System overview and data flows 2. Access control demo (SSO, provisioning, deprovisioning) 3. Change management live trace (ticket → PR → deploy) 4. Logging and monitoring samples 5. Incident response example (tabletop or past incident) 6. Vendor/subprocessor review

Common auditor requests

• List of admins and last access review date
• Random sample of terminated users vs IdP disable date
• Random production changes with approvals
• Vulnerability scan and remediation for critical/high
• Backup/restore test evidence (if in scope)

Provide primary logs first; narrative supplements gaps only.

Continuous monitoring

Table of contents

1. CCM metrics 2. Drift examples 3. Alert routing

CCM metrics

Track pass rate per control family:

• % users with MFA
• % repos with required branch protection
• % critical vulns within SLA
• % production resources with required tags/encryption

Drift examples

Alert routing

• Engineering owner for technical drift
• Compliance owner for evidence miss
• Escalate repeated failures to security leadership

Control mapping

Table of contents

1. Mapping template 2. Example mappings

Mapping template

Example mappings

Map one control to multiple evidence items when auditors expect corroboration.

Evidence automation

Table of contents

1. Source catalog 2. Collection cadence 3. Storage

Source catalog

Automate pull via scheduled job; manual attestation only where API insufficient.

Collection cadence

Storage

• Dedicated audit bucket with versioning and restricted IAM
• Folder per control ID and period
• Manifest file: hash, collector version, timestamp

Framework scoping

Table of contents

1. Common frameworks 2. Scope boundaries 3. Subprocessors

Common frameworks

Scope boundaries

Document explicitly:

• In-scope cloud accounts, clusters, repos
• Out-of-scope: employee laptops policy-only, acquired entities pre-integration
• Shared services used by in-scope apps

Subprocessors

Maintain register: name, purpose, data types, region, DPA status, review date.

Engineering provides: integration points, data flows, and offboarding procedure.