Compliance Specialist
When to Use
- Select and scope frameworks (SOC 2 Type I/II, ISO 27001, HIPAA, PCI, GDPR-style privacy program)
- Build control mapping and gap assessments with remediation plans and owners
- Draft policy and procedure outlines aligned to in-scope controls (not legal advice)
- Prepare audit and assessor coordination — calendars, walkthrough agendas, request lists
- Support vendor security questionnaires (SIG, CAIQ, custom) with consistent answers and evidence pointers
- Design continuous compliance — control inventory, review cadence, exception register, metrics
- Align GRC program roles, RACI, and executive reporting before engineering evidence work
When NOT to Use
- Automate evidence from IdP, CI/CD, CSPM, or build CCM pipelines →
compliance-engineer
- Cloud API evidence, shared responsibility, FedRAMP/PCI in AWS/GCP/Azure →
cloud-compliance-specialist
- Implement IAM, encryption, SCPs, or CSPM rules →
information-security-engineer, cloud-security-engineer
- Interpret law, negotiate DPAs, or redline contracts →
commercial-counsel
- Enterprise security strategy without audit/program lens →
cybersecurity
- Inherent/residual risk scoring and risk register →
security-risk-analyst
- Execute penetration tests →
penetration-tester
Related skills
| Need |
Skill |
| Technical control mapping and evidence automation |
compliance-engineer |
| Cloud framework evidence and residency packages |
cloud-compliance-specialist |
| Security program strategy and IR |
cybersecurity |
| Security risk register and treatment framing |
security-risk-analyst |
| Contract, DPA, and legal terms |
commercial-counsel |
| Cloud guardrails and misconfiguration remediation |
cloud-security-engineer |
| Corp IdP, SIEM, EDR implementation |
information-security-engineer |
| BCM/DRP artifacts, exercise records, high-level continuity mapping |
bcm-disaster-recovery-specialist |
Core Workflows
1. Program charter and framework selection
- Document business drivers (customer contracts, sector, geography)
- Inventory systems, data classes, and subprocessors
- Select frameworks and trust criteria / Annex A scope
- Define observation period, audit windows, and exclusions with risk acceptance
- Assign program owner, control owners, and executive sponsor
See references/compliance_specialist_scope.md.
2. Control mapping and gap assessment
Map each in-scope requirement to policy, procedure, technical control, and evidence type. Classify gaps: missing, partial, implemented. Prioritize by audit date and customer impact.
See references/framework_scoping_and_mapping.md and references/gap_assessment_and_remediation_planning.md.
3. Policies, procedures, and evidence design
Draft outlines stakeholders can approve; define evidence requirements (what, who, cadence)—hand implementation collectors to compliance-engineer.
See references/policies_procedures_evidence.md.
4. Audit and assessor coordination
Prepare request lists, walkthrough scripts, point-of-contact roster, and exception register. Coordinate with engineering for live demos only when narratives need validation.
See references/audit_and_assessor_coordination.md.
5. Vendor and continuous compliance
Standardize questionnaire responses, tier vendors, and run periodic control reviews—not one-time audit cramming.
See references/vendor_and_continuous_compliance.md.
Outputs
- Compliance scope memo — frameworks, systems, data, exclusions, calendar
- Control matrix — requirement ID, owner, policy/procedure, evidence type, status
- Gap and remediation plan — priority, due date, dependency on engineering/legal
- Policy/procedure outlines — sections ready for approval workflow
- Audit prep pack — agenda, FAQ, request tracker, exception log
- Questionnaire response library — approved answers with evidence links
Principles
- Program before tooling — scope and owners before collectors
- Separate GRC from build — this skill defines what to prove;
compliance-engineer automates how
- No legal advice — cite requirements; escalate interpretation to counsel
- Evidence pointers, not screenshots hoards — name systems of record and owners
- Continuous cadence — quarterly reviews beat pre-audit fire drills
When to load references
| Topic |
Reference |
| Role boundaries and program charter |
references/compliance_specialist_scope.md |
| Framework selection and mapping |
references/framework_scoping_and_mapping.md |
| Gap assessment and remediation |
references/gap_assessment_and_remediation_planning.md |
| Policies, procedures, evidence |
references/policies_procedures_evidence.md |
| Audit and assessor prep |
references/audit_and_assessor_coordination.md |
| Vendor questionnaires and CCM |
references/vendor_and_continuous_compliance.md |
1---2name: compliance-specialist3description: Guides cross-functional GRC and compliance programs—framework selection and scope (SOC 2, ISO 27001, HIPAA, PCI, GDPR concepts), control mapping and gap assessments, policy and procedure outlines, audit and assessor coordination prep, vendor security questionnaire support, and continuous compliance program design with ownership and cadence. Use when standing up or maturing a compliance program, scoping attestations, running readiness gap analyses, drafting control matrices, preparing audit walkthroughs, responding to SIG/CAIQ-style questionnaires, or designing continuous compliance—not technical control implementation or evidence automation (compliance-engineer), cloud-only API evidence and residency packages (cloud-compliance-specialist), IAM/terraform guardrails (cloud-security-engineer, information-security-engineer), legal interpretation or contract redlines (commercial-counsel), security risk registers (security-risk-analyst), or pentest execution (penetration-tester).4---56# Compliance Specialist78## When to Use910- Select and **scope** frameworks (SOC 2 Type I/II, ISO 27001, HIPAA, PCI, GDPR-style privacy program)11- Build **control mapping** and gap assessments with remediation plans and owners12- Draft **policy and procedure outlines** aligned to in-scope controls (not legal advice)13- Prepare **audit and assessor coordination** — calendars, walkthrough agendas, request lists14- Support **vendor security questionnaires** (SIG, CAIQ, custom) with consistent answers and evidence pointers15- Design **continuous compliance** — control inventory, review cadence, exception register, metrics16- Align **GRC program** roles, RACI, and executive reporting before engineering evidence work1718## When NOT to Use1920- Automate evidence from IdP, CI/CD, CSPM, or build CCM pipelines → `compliance-engineer`21- Cloud API evidence, shared responsibility, FedRAMP/PCI in AWS/GCP/Azure → `cloud-compliance-specialist`22- Implement IAM, encryption, SCPs, or CSPM rules → `information-security-engineer`, `cloud-security-engineer`23- Interpret law, negotiate DPAs, or redline contracts → `commercial-counsel`24- Enterprise security strategy without audit/program lens → `cybersecurity`25- Inherent/residual risk scoring and risk register → `security-risk-analyst`26- Execute penetration tests → `penetration-tester`2728## Related skills2930| Need | Skill |31|---|---|32| Technical control mapping and evidence automation | `compliance-engineer` |33| Cloud framework evidence and residency packages | `cloud-compliance-specialist` |34| Security program strategy and IR | `cybersecurity` |35| Security risk register and treatment framing | `security-risk-analyst` |36| Contract, DPA, and legal terms | `commercial-counsel` |37| Cloud guardrails and misconfiguration remediation | `cloud-security-engineer` |38| Corp IdP, SIEM, EDR implementation | `information-security-engineer` |39| BCM/DRP artifacts, exercise records, high-level continuity mapping | `bcm-disaster-recovery-specialist` |4041## Core Workflows4243### 1. Program charter and framework selection44451. Document business drivers (customer contracts, sector, geography)462. Inventory systems, data classes, and subprocessors473. Select frameworks and trust criteria / Annex A scope484. Define observation period, audit windows, and exclusions with risk acceptance495. Assign program owner, control owners, and executive sponsor5051**See `references/compliance_specialist_scope.md`.**5253### 2. Control mapping and gap assessment5455Map each in-scope requirement to policy, procedure, technical control, and evidence type. Classify gaps: missing, partial, implemented. Prioritize by audit date and customer impact.5657**See `references/framework_scoping_and_mapping.md` and `references/gap_assessment_and_remediation_planning.md`.**5859### 3. Policies, procedures, and evidence design6061Draft outlines stakeholders can approve; define evidence **requirements** (what, who, cadence)—hand implementation collectors to `compliance-engineer`.6263**See `references/policies_procedures_evidence.md`.**6465### 4. Audit and assessor coordination6667Prepare request lists, walkthrough scripts, point-of-contact roster, and exception register. Coordinate with engineering for live demos only when narratives need validation.6869**See `references/audit_and_assessor_coordination.md`.**7071### 5. Vendor and continuous compliance7273Standardize questionnaire responses, tier vendors, and run periodic control reviews—not one-time audit cramming.7475**See `references/vendor_and_continuous_compliance.md`.**7677## Outputs7879- **Compliance scope memo** — frameworks, systems, data, exclusions, calendar80- **Control matrix** — requirement ID, owner, policy/procedure, evidence type, status81- **Gap and remediation plan** — priority, due date, dependency on engineering/legal82- **Policy/procedure outlines** — sections ready for approval workflow83- **Audit prep pack** — agenda, FAQ, request tracker, exception log84- **Questionnaire response library** — approved answers with evidence links8586## Principles8788- **Program before tooling** — scope and owners before collectors89- **Separate GRC from build** — this skill defines *what* to prove; `compliance-engineer` automates *how*90- **No legal advice** — cite requirements; escalate interpretation to counsel91- **Evidence pointers, not screenshots hoards** — name systems of record and owners92- **Continuous cadence** — quarterly reviews beat pre-audit fire drills9394## When to load references9596| Topic | Reference |97|---|---|98| Role boundaries and program charter | `references/compliance_specialist_scope.md` |99| Framework selection and mapping | `references/framework_scoping_and_mapping.md` |100| Gap assessment and remediation | `references/gap_assessment_and_remediation_planning.md` |101| Policies, procedures, evidence | `references/policies_procedures_evidence.md` |102| Audit and assessor prep | `references/audit_and_assessor_coordination.md` |103| Vendor questionnaires and CCM | `references/vendor_and_continuous_compliance.md` |
daemon-blockint-tech