Security & Compliance Topics
Governance, compliance frameworks, regulatory requirements, compliance implementation, and compliance-driven risk management. Covers compliance frameworks (SOX, GDPR, HIPAA, FCPA, etc.), regulatory interpretation, compliance control design, audit and control effectiveness evaluation, and compliance process management. For operational security implementation and technical threat mitigation, see Security Engineering & Operations.
Compliance Governance and Audit
Assess design and operational controls to meet regulatory and corporate requirements. Topics include identifying relevant regulatory frameworks and controls, policy enforcement through policy as code, infrastructure inventory and configuration management, audit logging and evidence collection, configuration drift detection and remediation, access review and least privilege enforcement, data residency and localization controls, encryption and key management practices, automated compliance reporting, and working with auditors and legal teams to produce artifacts and remediation plans.
Compliance and Data Protection Regulations
Understanding of regulatory requirements (GDPR, HIPAA, SOX, CCPA, PCI-DSS), implementing controls to meet compliance obligations, data retention policies, audit requirements, and working with compliance and legal teams.
Security and Compliance Architecture
Architecting systems to meet security requirements and regulatory and compliance obligations. Candidates should understand how to embed data classification, data governance, encryption, least privilege access, audit trails and logging, secure design patterns, and threat modeling into architectures. Expect discussion of how architectural choices affect obligations under common regulations such as the General Data Protection Regulation, the Health Insurance Portability and Accountability Act, the Payment Card Industry Data Security Standard, and System and Organization Controls frameworks. Topics include documenting architecture for compliance reviewers, retention and data residency considerations, denial of service mitigation and web application firewall strategies, and balancing security controls with usability and operational cost. Candidates should be able to describe when to engage legal and compliance teams and how to design for auditability and evidence capture.
Compliance, Audit Logging, and Change Management
Understanding compliance requirements relevant to infrastructure (SOC 2, ISO 27001, HIPAA, PCI-DSS, etc.). Implementing audit logging for compliance purposes. Change management procedures and change approval workflows. Maintaining audit trails for all infrastructure changes and access. Regular compliance audits and remediation. Documentation of infrastructure changes and reasons. Version control for infrastructure configurations. Compliance reporting and audit readiness.