Compliance Engineer
When to Use
- Map security, privacy, or operational frameworks to technical controls
- Build audit evidence pipelines from infrastructure, CI/CD, IdP, or ticketing systems
- Design continuous control monitoring and exception workflows
- Prepare evidence packages and remediation tracking for SOC 2, ISO 27001, GDPR, HIPAA, PCI, or NIST CSF
- Translate policy requirements into testable engineering checks
When NOT to Use
- Contract negotiation, DPAs, or commercial redlines →
commercial-counsel
- Corporate governance, board approvals, or entity matters →
corporate-counsel
- Financial close controls, journal entries, or SOX accounting evidence →
senior-revenue-accountant
- Broad security strategy without audit/control mapping →
cybersecurity
- CI/CD scan configuration without compliance evidence requirements →
devsecops
- Cloud-only framework evidence, residency, FedRAMP/PCI in AWS/GCP/Azure →
cloud-compliance-specialist
- GRC program charter, gap plans, audit prep, vendor questionnaires (non-technical) →
compliance-specialist
- Execute authorized penetration tests or write offensive findings →
penetration-tester
Related skills
| Need |
Skill |
| GRC program, scope, gap plans, audit coordination |
compliance-specialist |
| Cloud SOC/HIPAA/PCI evidence and CSPM mapping |
cloud-compliance-specialist |
| Infrastructure capex SOX and asset controls |
director-infrastructure-capex-accounting |
| Security program and IR strategy |
cybersecurity |
| CI gates, SBOM, SSDF evidence from pipelines |
devsecops |
| IAM, encryption, guardrail implementation |
information-security-engineer |
| Access reviews, entitlement catalog, SoD evidence design |
iam-specialist |
| Data governance and privacy architecture |
data-architect |
| AI system risk tiers and model governance |
ai-risk-governance |
| Enterprise cloud controls and residency design |
enterprise-cloud-architect |
| Privacy research for safeguard pipelines |
privacy-research-engineer-safeguards |
| Financial SOX control testing |
senior-revenue-accountant |
| Commercial contract review and negotiation |
commercial-counsel |
| Pentest reports (factual input to audits, not attestation) |
penetration-tester |
| Corporate governance, entity, board packages |
corporate-counsel |
| HRIS access reviews, training completion ops |
people-operations-specialist |
| Physical DC design and commissioning evidence |
data-center-design-execution-lead |
| Incident artifact analysis and forensic investigation reports (factual) |
digital-forensics-analyst |
| Security risk registers, inherent/residual scoring, acceptances |
security-risk-analyst |
Core Workflows
1. Framework scoping
- Identify in-scope systems, data classes, and subprocessors
- Select frameworks (e.g., SOC 2 Type II, ISO 27001, GDPR, HIPAA, PCI)
- Define trust service criteria / Annex A controls in scope
- Document exclusions with risk acceptance
- Align calendar: observation period, audit windows, evidence cutoffs
See references/framework_scoping.md for common scope boundaries.
2. Control design and mapping
Translate each control to testable technical implementation:
| Layer |
Examples |
| Policy |
Approved access policy |
| Process |
Quarterly access review ticket |
| Technical |
SSO enforced; IAM policy as code |
| Evidence |
IdP export + review sign-off |
Avoid controls that cannot be evidenced automatically or manually on schedule.
See references/control_mapping.md for SOC 2 / ISO mapping patterns.
3. Evidence automation
control ID → evidence source (API, Git, SIEM) → collector → storage → reviewer attestation
Evidence quality rules:
- Timestamped, tamper-evident storage
- Named owner per control
- Sample size documented for population controls
- Redact customer PII in shared audit folders
See references/evidence_automation.md for source catalog and collection cadence.
4. Continuous control monitoring
- Detect drift from baseline (public buckets, open SGs, missing MFA)
- Alert owners before audit finding
- Integrate CSPM, Git policy checks, and HRIS for joiner/leaver
- Weekly dashboard: pass/fail per control, trend
See references/continuous_monitoring.md for CCM metrics and alert routing.
5. Gap assessment and remediation
- Run gap analysis against chosen framework
- Classify: missing control, partial, implemented
- Assign remediation with owner, due date, evidence plan
- Verify fix with re-test and attach proof
- Track exceptions with expiry and approver
See references/audit_readiness.md for pre-audit checklist.
6. Auditor engagement (engineering)
Prepare evidence packages per control family:
- Access (IdP, reviews, privileged accounts)
- Change management (PR approvals, deploy logs)
- Vulnerability management (scan reports, SLAs)
- Logging and monitoring (retention config, alert samples)
- Vendor risk (subprocessor list, reviews)
Provide narrative only where logs are insufficient; prefer primary artifacts.
See references/audit_readiness.md for walkthrough agenda and FAQ for auditors.
7. Privacy engineering hooks (GDPR-style)
Coordinate with data-architect for:
- Data inventory and lawful basis documentation
- DSR workflows (access/delete) with engineering tickets
- DPIA triggers for new processing
- Cross-border transfer mechanisms (SCCs, etc.) as documented requirements—not legal advice
When to load references
- Scope and frameworks →
references/framework_scoping.md
- Control mapping →
references/control_mapping.md
- Evidence collectors →
references/evidence_automation.md
- Drift and CCM →
references/continuous_monitoring.md
- Audit prep →
references/audit_readiness.md
1---2name: compliance-engineer3description: Guides compliance engineering—mapping regulatory and framework requirements to technical controls, automating audit evidence, continuous compliance monitoring, gap remediation tracking, and audit-ready documentation for security and privacy programs (SOC 2, ISO 27001, GDPR technical measures, HIPAA safeguards, PCI scope boundaries, NIST CSF). Use when implementing audit controls, evidence pipelines, continuous monitoring, auditor packages, testable policy checks, or pre-attestation remediation—not non-engineering GRC (compliance-specialist), contracts (commercial-counsel), DC commissioning (data-center-design-execution-lead), financial SOX journals (senior-revenue-accountant), security strategy without audit lens (cybersecurity), CI scans only (devsecops), or AI model classification (ai-risk-governance).4---56# Compliance Engineer78## When to Use910- Map security, privacy, or operational frameworks to technical controls11- Build audit evidence pipelines from infrastructure, CI/CD, IdP, or ticketing systems12- Design continuous control monitoring and exception workflows13- Prepare evidence packages and remediation tracking for SOC 2, ISO 27001, GDPR, HIPAA, PCI, or NIST CSF14- Translate policy requirements into testable engineering checks1516## When NOT to Use1718- Contract negotiation, DPAs, or commercial redlines → `commercial-counsel`19- Corporate governance, board approvals, or entity matters → `corporate-counsel`20- Financial close controls, journal entries, or SOX accounting evidence → `senior-revenue-accountant`21- Broad security strategy without audit/control mapping → `cybersecurity`22- CI/CD scan configuration without compliance evidence requirements → `devsecops`23- Cloud-only framework evidence, residency, FedRAMP/PCI in AWS/GCP/Azure → `cloud-compliance-specialist`24- GRC program charter, gap plans, audit prep, vendor questionnaires (non-technical) → `compliance-specialist`25- Execute authorized penetration tests or write offensive findings → `penetration-tester`2627## Related skills2829| Need | Skill |30|---|---|31| GRC program, scope, gap plans, audit coordination | `compliance-specialist` |32| Cloud SOC/HIPAA/PCI evidence and CSPM mapping | `cloud-compliance-specialist` |33| Infrastructure capex SOX and asset controls | `director-infrastructure-capex-accounting` |34| Security program and IR strategy | `cybersecurity` |35| CI gates, SBOM, SSDF evidence from pipelines | `devsecops` |36| IAM, encryption, guardrail implementation | `information-security-engineer` |37| Access reviews, entitlement catalog, SoD evidence design | `iam-specialist` |38| Data governance and privacy architecture | `data-architect` |39| AI system risk tiers and model governance | `ai-risk-governance` |40| Enterprise cloud controls and residency design | `enterprise-cloud-architect` |41| Privacy research for safeguard pipelines | `privacy-research-engineer-safeguards` |42| Financial SOX control testing | `senior-revenue-accountant` |43| Commercial contract review and negotiation | `commercial-counsel` |44| Pentest reports (factual input to audits, not attestation) | `penetration-tester` |45| Corporate governance, entity, board packages | `corporate-counsel` |46| HRIS access reviews, training completion ops | `people-operations-specialist` |47| Physical DC design and commissioning evidence | `data-center-design-execution-lead` |48| Incident artifact analysis and forensic investigation reports (factual) | `digital-forensics-analyst` |49| Security risk registers, inherent/residual scoring, acceptances | `security-risk-analyst` |5051## Core Workflows5253### 1. Framework scoping54551. Identify in-scope systems, data classes, and subprocessors562. Select frameworks (e.g., SOC 2 Type II, ISO 27001, GDPR, HIPAA, PCI)573. Define trust service criteria / Annex A controls in scope584. Document exclusions with risk acceptance595. Align calendar: observation period, audit windows, evidence cutoffs6061**See `references/framework_scoping.md` for common scope boundaries.**6263### 2. Control design and mapping6465Translate each control to **testable** technical implementation:6667| Layer | Examples |68|---|---|69| Policy | Approved access policy |70| Process | Quarterly access review ticket |71| Technical | SSO enforced; IAM policy as code |72| Evidence | IdP export + review sign-off |7374Avoid controls that cannot be evidenced automatically or manually on schedule.7576**See `references/control_mapping.md` for SOC 2 / ISO mapping patterns.**7778### 3. Evidence automation7980```81control ID → evidence source (API, Git, SIEM) → collector → storage → reviewer attestation82```8384**Evidence quality rules:**8586- Timestamped, tamper-evident storage87- Named owner per control88- Sample size documented for population controls89- Redact customer PII in shared audit folders9091**See `references/evidence_automation.md` for source catalog and collection cadence.**9293### 4. Continuous control monitoring9495- Detect drift from baseline (public buckets, open SGs, missing MFA)96- Alert owners before audit finding97- Integrate CSPM, Git policy checks, and HRIS for joiner/leaver98- Weekly dashboard: pass/fail per control, trend99100**See `references/continuous_monitoring.md` for CCM metrics and alert routing.**101102### 5. Gap assessment and remediation1031041. Run gap analysis against chosen framework1052. Classify: missing control, partial, implemented1063. Assign remediation with owner, due date, evidence plan1074. Verify fix with re-test and attach proof1085. Track exceptions with expiry and approver109110**See `references/audit_readiness.md` for pre-audit checklist.**111112### 6. Auditor engagement (engineering)113114Prepare **evidence packages** per control family:115116- Access (IdP, reviews, privileged accounts)117- Change management (PR approvals, deploy logs)118- Vulnerability management (scan reports, SLAs)119- Logging and monitoring (retention config, alert samples)120- Vendor risk (subprocessor list, reviews)121122Provide narrative only where logs are insufficient; prefer primary artifacts.123124**See `references/audit_readiness.md` for walkthrough agenda and FAQ for auditors.**125126### 7. Privacy engineering hooks (GDPR-style)127128Coordinate with `data-architect` for:129130- Data inventory and lawful basis documentation131- DSR workflows (access/delete) with engineering tickets132- DPIA triggers for new processing133- Cross-border transfer mechanisms (SCCs, etc.) as **documented** requirements—not legal advice134135## When to load references136137- **Scope and frameworks** → `references/framework_scoping.md`138- **Control mapping** → `references/control_mapping.md`139- **Evidence collectors** → `references/evidence_automation.md`140- **Drift and CCM** → `references/continuous_monitoring.md`141- **Audit prep** → `references/audit_readiness.md`
daemon-blockint-tech