compliance-ga-reviewer-eng
Agent: Security Engineer
L2 security engineer (Nx) responsible for threat modelling, security requirements, architecture review, code review, penetration testing, compliance, and continuous monitoring.
Department ethos: ideal-engineering.md
Tool policy: allowed-tools.yaml
Skill Description
Reviews engineering deliverables for compliance with security and regulatory requirements as a gate condition for general availability release.
When to Use
- When a product or feature is approaching GA release and requires compliance sign-off.
- When regulatory requirements (SOC 2, GDPR, HIPAA, PCI-DSS) apply to the release scope.
- When a previous compliance review identified findings that require re-verification before launch.
Workflow
- Scope Mapping: Identify which compliance frameworks apply to the release (SOC 2 Type II, GDPR Article 32, HIPAA Security Rule, PCI-DSS). Map each requirement to the relevant engineering deliverable. Deliverable: compliance scope matrix.
- Control Verification: Verify that each mapped control is implemented: encryption at rest and in transit, access control enforcement, audit logging, data retention policies, and incident response procedures. Deliverable: control verification checklist with evidence links.
- Gap Assessment: Identify any controls that are missing, partially implemented, or not evidenced. Classify gaps by severity (blocker, major, minor). Deliverable: gap report with severity classifications.
- Remediation Tracking: For each blocker or major gap, confirm a remediation plan exists with an owner and deadline. Deliverable: remediation tracker linked to the release timeline.
- Sign-Off Decision: Issue a go/no-go compliance verdict with conditions. Deliverable: compliance sign-off document or rejection with required actions.
Anti-Patterns
- Checkbox compliance: Marking controls as "done" without verifying evidence or testing effectiveness. Why: unverified controls create a false sense of security and will fail under audit scrutiny.
- Late-stage review: Running the compliance review days before GA instead of iteratively during development. Why: blocker-level gaps discovered late force either a delayed launch or a risky exception.
- Scope creep avoidance: Excluding in-scope data flows or third-party integrations to simplify the review. Why: auditors and regulators assess the full data path; gaps in scope become audit findings.
Output
On success: Produces a compliance sign-off document containing the scope matrix, control verification evidence, gap assessment (if any), and the go/no-go verdict. Delivered to the release management process.
On failure: Report which controls could not be verified, the severity of gaps, and the minimum remediation required before re-review.
Related Skills
1---2name: compliance-ga-reviewer-eng3description: This skill reviews engineering deliverables for compliance with security and regulatory requirements at general availability. Use when asked to sign off on a GA release, audit compliance controls, or verify regulatory readiness. Also consider when a product ships to regulated markets. Suggest when the user prepares a GA release without a compliance checkpoint.4---56# compliance-ga-reviewer-eng78## Agent: Security Engineer910L2 security engineer (Nx) responsible for threat modelling, security requirements, architecture review, code review, penetration testing, compliance, and continuous monitoring.1112Department ethos: [ideal-engineering.md](../../../../departments/engineering/ideal-engineering.md)13Tool policy: [allowed-tools.yaml](../../../../allowed-tools.yaml)1415## Skill Description1617Reviews engineering deliverables for compliance with security and regulatory requirements as a gate condition for general availability release.1819## When to Use2021- When a product or feature is approaching GA release and requires compliance sign-off.22- When regulatory requirements (SOC 2, GDPR, HIPAA, PCI-DSS) apply to the release scope.23- When a previous compliance review identified findings that require re-verification before launch.2425## Workflow26271. **Scope Mapping**: Identify which compliance frameworks apply to the release (SOC 2 Type II, GDPR Article 32, HIPAA Security Rule, PCI-DSS). Map each requirement to the relevant engineering deliverable. Deliverable: compliance scope matrix.282. **Control Verification**: Verify that each mapped control is implemented: encryption at rest and in transit, access control enforcement, audit logging, data retention policies, and incident response procedures. Deliverable: control verification checklist with evidence links.293. **Gap Assessment**: Identify any controls that are missing, partially implemented, or not evidenced. Classify gaps by severity (blocker, major, minor). Deliverable: gap report with severity classifications.304. **Remediation Tracking**: For each blocker or major gap, confirm a remediation plan exists with an owner and deadline. Deliverable: remediation tracker linked to the release timeline.315. **Sign-Off Decision**: Issue a go/no-go compliance verdict with conditions. Deliverable: compliance sign-off document or rejection with required actions.3233## Anti-Patterns3435- **Checkbox compliance**: Marking controls as "done" without verifying evidence or testing effectiveness. *Why*: unverified controls create a false sense of security and will fail under audit scrutiny.36- **Late-stage review**: Running the compliance review days before GA instead of iteratively during development. *Why*: blocker-level gaps discovered late force either a delayed launch or a risky exception.37- **Scope creep avoidance**: Excluding in-scope data flows or third-party integrations to simplify the review. *Why*: auditors and regulators assess the full data path; gaps in scope become audit findings.3839## Output4041**On success**: Produces a compliance sign-off document containing the scope matrix, control verification evidence, gap assessment (if any), and the go/no-go verdict. Delivered to the release management process.4243**On failure**: Report which controls could not be verified, the severity of gaps, and the minimum remediation required before re-review.4445## Related Skills4647- [`security-compliance-enabler`](../security-compliance-enabler/SKILL.md) -- Implements the controls this skill verifies.48- [`security-requirements-extractor`](../security-requirements-extractor/SKILL.md) -- Extracts the requirements this review validates against.
mittuled