Cloud Compliance Specialist

Cloud Compliance Specialist

When to Use

• Scope cloud workloads for SOC 2, ISO 27001, HIPAA, PCI, FedRAMP, or regional privacy rules
• Map framework controls to cloud-native evidence (Config, org trails, IAM reports, KMS)
• Build evidence collectors from cloud APIs and central log archive
• Prepare auditor walkthroughs for multi-account landing zones and SaaS on IaaS/PaaS
• Respond to customer security questionnaires with cloud control proof
• Design continuous cloud compliance dashboards (CIS conformance, posture rules)
• Document data residency — regions, replication, cross-border transfers (technical facts)
• Track cloud gap remediation before observation period or assessor visit
• Interpret provider shared responsibility and inheritance in audit narratives

When NOT to Use

• Enterprise-wide GRC program, policies, audit prep (non-cloud) → compliance-specialist
• Org-wide technical evidence automation → compliance-engineer
• Implement SCPs, IAM hardening, CSPM rules → cloud-security-engineer
• Landing zone architecture without compliance lens → cloud-architect, enterprise-cloud-architect
• Cloud program strategy and migration portfolio governance → vp-of-cloud
• Legal advice, DPAs, regulatory interpretation → commercial-counsel, corporate-counsel
• SOX financial controls and journal testing → senior-revenue-accountant
• Pipeline SAST/SBOM configuration → devsecops
• AI model regulatory classification → ai-risk-governance

Related skills

| Need | Skill | |---|---| | VP cloud program and regulated placement themes | vp-of-cloud | | GRC program, scope, gap plans, audit coordination | compliance-specialist | | Cross-domain compliance and evidence automation | compliance-engineer | | Cloud security control implementation | cloud-security-engineer | | Enterprise cloud governance and CCoE | enterprise-cloud-architect | | Cloud reference architecture | cloud-architect | | Security program strategy | cybersecurity | | Pipeline and SSDF evidence | devsecops | | Data governance and privacy architecture | data-architect | | Physical DC compliance evidence | data-center-design-execution-lead | | FinOps spend analysis | finops-analyst | | GL mapping and invoice reconciliation | compute-accounting-manager | | Security risk registers and third-party risk tiers | security-risk-analyst |

Core Workflows

1. Scope and shared responsibility

Cloud in-scope boundaries and provider vs customer duties for audits.

See references/cloud_compliance_scope.md.

2. Framework mapping in cloud

SOC 2, ISO, HIPAA, PCI, FedRAMP control patterns on cloud.

See references/framework_cloud_mapping.md.

3. Cloud evidence collection

API sources, samples, retention for assessors.

See references/cloud_evidence_collection.md.

4. Residency and sovereignty

Regions, replication, cross-border technical documentation.

See references/residency_sovereignty.md.

5. Continuous cloud monitoring

CSPM, Config rules, drift and exceptions.

See references/continuous_cloud_monitoring.md.

6. Audit readiness and customer assurance

Walkthroughs, CAIQ/SIG, gap closure.

See references/audit_readiness_cloud.md.

Outputs

• Cloud compliance scope memo — accounts, services, data classes, inherited controls
• Control-to-evidence matrix — framework ID, cloud check, source, cadence, owner
• Evidence package — exports with timestamps and population notes
• Residency diagram — regions, backups, DR, subprocessors (technical)
• CCM dashboard spec — rules, thresholds, exception register
• Assessor FAQ — shared responsibility, logging, encryption, access

Principles

• Inherit explicitly — document what the hyperscaler attests vs what you must prove
• Evidence from systems of record — APIs and logs, not screenshots alone
• Scope narrow — exclude out-of-scope accounts and legacy unless required
• Continuous over point-in-time — drift detection before the auditor finds it
• Partner with security — compliance defines what; cloud-security-engineer implements how

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: daemon-blockint-tech
• Source: daemon-blockint-tech/Agentic-Enteprises-Skill
• License: MIT

Install and usage instructions live in the source repository linked above.