HACKING PROJECT · cloud · Intermediate
Compliance Automation with Policy-as-Code
Replace manual audit prep with continuous, machine-verifiable compliance evaluation mapped to recognized control frameworks.
Compliance is still largely manual: teams screenshot configurations, fill spreadsheets, and chase evidence before audits, producing point-in-time snapshots that are stale the moment they are captured. This is slow, error-prone, and cannot keep pace with ephemeral cloud infrastructure. Auditors and security teams lack continuous, machine-verifiable assurance that controls (CIS, NIST, PCI, SOC 2, HIPAA) are actually met.
**What you'll build**
Encode compliance controls as executable policy-as-code (OPA/Rego, Cloud Custodian, Conftest) that continuously evaluates live cloud state and IaC against control baselines, producing auditor-ready evidence automatically. Map each policy to specific control IDs across frameworks, generate compliance scorecards and drift reports, and integrate checks into CI/CD and runtime so violations are caught continuously rather than annually.
**Objective** — Replace manual audit prep with continuous, machine-verifiable compliance evaluation mapped to recognized control frameworks.
**Expected outcome** — A policy-as-code repository that evaluates cloud/IaC state against CIS/NIST-mapped controls and auto-generates a compliance report with pass/fail evidence per control ID.
**Difficulty** — Intermediate — conceptually approachable but requires real framework knowledge plus Rego/policy-engine fluency to be enterprise-credible.
**Primary category** — GRC / Compliance Automation; Secondary = Cloud Security, Policy-as-Code, DevSecOps
**Security domains** — Primary = GRC; Secondary = Cloud Security, DevSecOps, Blue Team, Compliance Engineering
**Technical focus** — Policy-as-code (Rego/OPA), compliance-as-code, control mapping, continuous control monitoring (CCM), evidence automation, CSPM, audit reporting, drift detection, framework crosswalks
**Core technologies** — Languages: Rego, Python, YAML, SQL; Frameworks/Libraries: OPA/Conftest, Cloud Custodian, Checkov, OSCAL; Security Tools: Prowler, ScoutSuite, Steampipe/Powerpipe, AWS Config/Azure Policy/GCP Org Policy; Cloud/Infra: AWS, Azure, GCP, Terraform; AI/Data: NLP mapping of control text to policies; Databases: PostgreSQL for evidence/findings store
**Where it's valued** — Regulated industries (finance, healthcare, government), SaaS pursuing SOC 2/ISO 27001, MSSPs, auditors, any cloud enterprise
**Careers it builds toward** — GRC Analyst/Engineer, Compliance Automation Engineer, Cloud Security Engineer, Security Auditor, DevSecOps Engineer, vCISO support
**Framework alignment**
• MITRE ATT&CK: Primarily preventive/governance; indirectly counters Valid Accounts: Cloud Accounts T1078.004 and Modify Cloud Compute Infrastructure T1578 via configuration hardening (detection-agnostic)
• NIST CSF 2.0: Govern (primary), Identify, Protect
• OWASP: A05 Security Misconfiguration (infrastructure); otherwise N/A
• CIS Controls v8: Broadly applicable — 3 Data Protection, 4 Secure Configuration, 5/6 Account & Access Control, 8 Audit Log Management (control coverage is the core deliverable)
**Innovation** — Improved Existing Solution — continuous-compliance is a booming market (Vanta, Drata, Wiz); a framework-mapped OSCAL-aware policy engine is strong portfolio and has startup adjacency. Scores: Innovation 6/10, Startup 8/10, Enterprise-Readiness 8/10, Patent = No.