When to Use
- Map security, privacy, or operational frameworks to technical controls
- Build audit evidence pipelines from infrastructure, CI/CD, IdP, or ticketing systems
- Design continuous control monitoring and exception workflows
- Prepare evidence packages and remediation tracking for SOC 2, ISO 27001, GDPR, HIPAA, PCI, or NIST CSF
- Translate policy requirements into testable engineering checks
When NOT to Use
- Contract negotiation, DPAs, or commercial redlines →
commercial-counsel - Corporate governance, board approvals, or entity matters →
corporate-counsel - Financial close controls, journal entries, or SOX accounting evidence →
senior-revenue-accountant - Broad security strategy without audit/control mapping →
cybersecurity - CI/CD scan configuration without compliance evidence requirements →
devsecops - Cloud-only framework evidence, residency, FedRAMP/PCI in AWS/GCP/Azure →
cloud-compliance-specialist - GRC program charter, gap plans, audit prep, vendor questionnaires (non-technical) →
compliance-specialist - Execute authorized penetration tests or write offensive findings →
penetration-tester
Related skills
| Need | Skill |
|---|---|
| GRC program, scope, gap plans, audit coordination | compliance-specialist |
| Cloud SOC/HIPAA/PCI evidence and CSPM mapping | cloud-compliance-specialist |
| Infrastructure capex SOX and asset controls | director-infrastructure-capex-accounting |
| Security program and IR strategy | cybersecurity |
| CI gates, SBOM, SSDF evidence from pipelines | devsecops |
| IAM, encryption, guardrail implementation | information-security-engineer |
| Access reviews, entitlement catalog, SoD evidence design | iam-specialist |
| Data governance and privacy architecture | data-architect |
| AI system risk tiers and model governance | ai-risk-governance |
| Enterprise cloud controls and residency design | enterprise-cloud-architect |
| Privacy research for safeguard pipelines | privacy-research-engineer-safeguards |
| Financial SOX control testing | senior-revenue-accountant |
| Commercial contract review and negotiation | commercial-counsel |
| Pentest reports (factual input to audits, not attestation) | penetration-tester |
| Corporate governance, entity, board packages | corporate-counsel |
| HRIS access reviews, training completion ops | people-operations-specialist |
| Physical DC design and commissioning evidence | data-center-design-execution-lead |
| Incident artifact analysis and forensic investigation reports (factual) | digital-forensics-analyst |
| Security risk registers, inherent/residual scoring, acceptances | security-risk-analyst |
Core Workflows
1. Framework scoping
- Identify in-scope systems, data classes, and subprocessors
- Select frameworks (e.g., SOC 2 Type II, ISO 27001, GDPR, HIPAA, PCI)
- Define trust service criteria / Annex A controls in scope
- Document exclusions with risk acceptance
- Align calendar: observation period, audit windows, evidence cutoffs
See references/framework_scoping.md for common scope boundaries.
2. Control design and mapping
Translate each control to testable technical implementation:
| Layer | Examples |
|---|---|
| Policy | Approved access policy |
| Process | Quarterly access review ticket |
| Technical | SSO enforced; IAM policy as code |
| Evidence | IdP export + review sign-off |
Avoid controls that cannot be evidenced automatically or manually on schedule.
See references/control_mapping.md for SOC 2 / ISO mapping patterns.
3. Evidence automation
control ID → evidence source (API, Git, SIEM) → collector → storage → reviewer attestation
Evidence quality rules:
- Timestamped, tamper-evident storage
- Named owner per control
- Sample size documented for population controls
- Redact customer PII in shared audit folders
See references/evidence_automation.md for source catalog and collection cadence.
4. Continuous control monitoring
- Detect drift from baseline (public buckets, open SGs, missing MFA)
- Alert owners before audit finding
- Integrate CSPM, Git policy checks, and HRIS for joiner/leaver
- Weekly dashboard: pass/fail per control, trend
See references/continuous_monitoring.md for CCM metrics and alert routing.
5. Gap assessment and remediation
- Run gap analysis against chosen framework
- Classify: missing control, partial, implemented
- Assign remediation with owner, due date, evidence plan
- Verify fix with re-test and attach proof
- Track exceptions with expiry and approver
See references/audit_readiness.md for pre-audit checklist.
6. Auditor engagement (engineering)
Prepare evidence packages per control family:
- Access (IdP, reviews, privileged accounts)
- Change management (PR approvals, deploy logs)
- Vulnerability management (scan reports, SLAs)
- Logging and monitoring (retention config, alert samples)
- Vendor risk (subprocessor list, reviews)
Provide narrative only where logs are insufficient; prefer primary artifacts.
See references/audit_readiness.md for walkthrough agenda and FAQ for auditors.
7. Privacy engineering hooks (GDPR-style)
Coordinate with data-architect for:
- Data inventory and lawful basis documentation
- DSR workflows (access/delete) with engineering tickets
- DPIA triggers for new processing
- Cross-border transfer mechanisms (SCCs, etc.) as documented requirements—not legal advice
When to load references
- Scope and frameworks →
references/framework_scoping.md - Control mapping →
references/control_mapping.md - Evidence collectors →
references/evidence_automation.md - Drift and CCM →
references/continuous_monitoring.md - Audit prep →
references/audit_readiness.md