| name | compliance-engineer |
| description | Guides compliance engineering—mapping regulatory and framework requirements to technical controls,
automating audit evidence, continuous compliance monitoring, gap remediation tracking, and
audit-ready documentation for security and privacy programs (SOC 2, ISO 27001, GDPR technical
measures, HIPAA safeguards, PCI scope boundaries, NIST CSF).
Use when implementing audit controls, evidence pipelines, continuous monitoring, auditor packages,
testable policy checks, or pre-attestation remediation—not non-engineering GRC (compliance-specialist),
contracts (commercial-counsel), DC commissioning (data-center-design-execution-lead), financial SOX
journals (senior-revenue-accountant), security strategy without audit lens (cybersecurity), CI scans
only (devsecops), or AI model classification (ai-risk-governance).
|
Compliance Engineer
When to Use
- Map security, privacy, or operational frameworks to technical controls
- Build audit evidence pipelines from infrastructure, CI/CD, IdP, or ticketing systems
- Design continuous control monitoring and exception workflows
- Prepare evidence packages and remediation tracking for SOC 2, ISO 27001, GDPR, HIPAA, PCI, or NIST CSF
- Translate policy requirements into testable engineering checks
When NOT to Use
- Contract negotiation, DPAs, or commercial redlines →
commercial-counsel
- Corporate governance, board approvals, or entity matters →
corporate-counsel
- Financial close controls, journal entries, or SOX accounting evidence →
senior-revenue-accountant
- Broad security strategy without audit/control mapping →
cybersecurity
- CI/CD scan configuration without compliance evidence requirements →
devsecops
- Cloud-only framework evidence, residency, FedRAMP/PCI in AWS/GCP/Azure →
cloud-compliance-specialist
- GRC program charter, gap plans, audit prep, vendor questionnaires (non-technical) →
compliance-specialist
- Execute authorized penetration tests or write offensive findings →
penetration-tester
Related skills
| Need | Skill |
|---|
| GRC program, scope, gap plans, audit coordination | compliance-specialist |
| Cloud SOC/HIPAA/PCI evidence and CSPM mapping | cloud-compliance-specialist |
| Infrastructure capex SOX and asset controls | director-infrastructure-capex-accounting |
| Security program and IR strategy | cybersecurity |
| CI gates, SBOM, SSDF evidence from pipelines | devsecops |
| IAM, encryption, guardrail implementation | information-security-engineer |
| Access reviews, entitlement catalog, SoD evidence design | iam-specialist |
| Data governance and privacy architecture | data-architect |
| AI system risk tiers and model governance | ai-risk-governance |
| Enterprise cloud controls and residency design | enterprise-cloud-architect |
| Privacy research for safeguard pipelines | privacy-research-engineer-safeguards |
| Financial SOX control testing | senior-revenue-accountant |
| Commercial contract review and negotiation | commercial-counsel |
| Pentest reports (factual input to audits, not attestation) | penetration-tester |
| Corporate governance, entity, board packages | corporate-counsel |
| HRIS access reviews, training completion ops | people-operations-specialist |
| Physical DC design and commissioning evidence | data-center-design-execution-lead |
| Incident artifact analysis and forensic investigation reports (factual) | digital-forensics-analyst |
| Security risk registers, inherent/residual scoring, acceptances | security-risk-analyst |
Core Workflows
1. Framework scoping
- Identify in-scope systems, data classes, and subprocessors
- Select frameworks (e.g., SOC 2 Type II, ISO 27001, GDPR, HIPAA, PCI)
- Define trust service criteria / Annex A controls in scope
- Document exclusions with risk acceptance
- Align calendar: observation period, audit windows, evidence cutoffs
See references/framework_scoping.md for common scope boundaries.
2. Control design and mapping
Translate each control to testable technical implementation:
| Layer | Examples |
|---|
| Policy | Approved access policy |
| Process | Quarterly access review ticket |
| Technical | SSO enforced; IAM policy as code |
| Evidence | IdP export + review sign-off |
Avoid controls that cannot be evidenced automatically or manually on schedule.
See references/control_mapping.md for SOC 2 / ISO mapping patterns.
3. Evidence automation
control ID → evidence source (API, Git, SIEM) → collector → storage → reviewer attestation
Evidence quality rules:
- Timestamped, tamper-evident storage
- Named owner per control
- Sample size documented for population controls
- Redact customer PII in shared audit folders
See references/evidence_automation.md for source catalog and collection cadence.
4. Continuous control monitoring
- Detect drift from baseline (public buckets, open SGs, missing MFA)
- Alert owners before audit finding
- Integrate CSPM, Git policy checks, and HRIS for joiner/leaver
- Weekly dashboard: pass/fail per control, trend
See references/continuous_monitoring.md for CCM metrics and alert routing.
5. Gap assessment and remediation
- Run gap analysis against chosen framework
- Classify: missing control, partial, implemented
- Assign remediation with owner, due date, evidence plan
- Verify fix with re-test and attach proof
- Track exceptions with expiry and approver
See references/audit_readiness.md for pre-audit checklist.
6. Auditor engagement (engineering)
Prepare evidence packages per control family:
- Access (IdP, reviews, privileged accounts)
- Change management (PR approvals, deploy logs)
- Vulnerability management (scan reports, SLAs)
- Logging and monitoring (retention config, alert samples)
- Vendor risk (subprocessor list, reviews)
Provide narrative only where logs are insufficient; prefer primary artifacts.
See references/audit_readiness.md for walkthrough agenda and FAQ for auditors.
7. Privacy engineering hooks (GDPR-style)
Coordinate with data-architect for:
- Data inventory and lawful basis documentation
- DSR workflows (access/delete) with engineering tickets
- DPIA triggers for new processing
- Cross-border transfer mechanisms (SCCs, etc.) as documented requirements—not legal advice
When to load references
- Scope and frameworks →
references/framework_scoping.md
- Control mapping →
references/control_mapping.md
- Evidence collectors →
references/evidence_automation.md
- Drift and CCM →
references/continuous_monitoring.md
- Audit prep →
references/audit_readiness.md
