---

name: cloud-compliance-specialist description: | Guides cloud compliance—mapping SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP, and data-residency requirements to cloud controls; collecting audit evidence from AWS, GCP, and Azure APIs; shared-responsibility narratives; CSPM/Config continuous monitoring; customer assurance questionnaires (CAIQ/SIG); and cloud-specific gap remediation before attestations. Use when scoping regulated workloads in cloud, preparing cloud control evidence for auditors, interpreting provider compliance artifacts (BAA, PCI AOC, FedRAMP packages), or proving residency and logging in multi-account estates—not for org-wide GRC programs and audit coordination without cloud evidence (compliance-specialist), non-cloud systems evidence automation (compliance-engineer), implementing security guardrails (cloud-security-engineer), legal DPAs or contract redlines (commercial-counsel), security strategy (cybersecurity), or CI pipeline gates only (devsecops).

Cloud Compliance Specialist

When to Use

• Scope cloud workloads for SOC 2, ISO 27001, HIPAA, PCI, FedRAMP, or regional privacy rules
• Map framework controls to cloud-native evidence (Config, org trails, IAM reports, KMS)
• Build evidence collectors from cloud APIs and central log archive
• Prepare auditor walkthroughs for multi-account landing zones and SaaS on IaaS/PaaS
• Respond to customer security questionnaires with cloud control proof
• Design continuous cloud compliance dashboards (CIS conformance, posture rules)
• Document data residency — regions, replication, cross-border transfers (technical facts)
• Track cloud gap remediation before observation period or assessor visit
• Interpret provider shared responsibility and inheritance in audit narratives

When NOT to Use

• Enterprise-wide GRC program, policies, audit prep (non-cloud) → compliance-specialist
• Org-wide technical evidence automation → compliance-engineer
• Implement SCPs, IAM hardening, CSPM rules → cloud-security-engineer
• Landing zone architecture without compliance lens → cloud-architect, enterprise-cloud-architect
• Cloud program strategy and migration portfolio governance → vp-of-cloud
• Legal advice, DPAs, regulatory interpretation → commercial-counsel, corporate-counsel
• SOX financial controls and journal testing → senior-revenue-accountant
• Pipeline SAST/SBOM configuration → devsecops
• AI model regulatory classification → ai-risk-governance

Related skills

Need	Skill
VP cloud program and regulated placement themes	vp-of-cloud
GRC program, scope, gap plans, audit coordination	compliance-specialist
Cross-domain compliance and evidence automation	compliance-engineer
Cloud security control implementation	cloud-security-engineer
Enterprise cloud governance and CCoE	enterprise-cloud-architect
Cloud reference architecture	cloud-architect
Security program strategy	cybersecurity
Pipeline and SSDF evidence	devsecops
Data governance and privacy architecture	data-architect
Physical DC compliance evidence	data-center-design-execution-lead
FinOps spend analysis	finops-analyst
GL mapping and invoice reconciliation	compute-accounting-manager
Security risk registers and third-party risk tiers	security-risk-analyst

Core Workflows

1. Scope and shared responsibility

Cloud in-scope boundaries and provider vs customer duties for audits.

See references/cloud_compliance_scope.md.

2. Framework mapping in cloud

SOC 2, ISO, HIPAA, PCI, FedRAMP control patterns on cloud.

See references/framework_cloud_mapping.md.

3. Cloud evidence collection

API sources, samples, retention for assessors.

See references/cloud_evidence_collection.md.

4. Residency and sovereignty

Regions, replication, cross-border technical documentation.

See references/residency_sovereignty.md.

5. Continuous cloud monitoring

CSPM, Config rules, drift and exceptions.

See references/continuous_cloud_monitoring.md.

6. Audit readiness and customer assurance

Walkthroughs, CAIQ/SIG, gap closure.

See references/audit_readiness_cloud.md.

Outputs

• Cloud compliance scope memo — accounts, services, data classes, inherited controls
• Control-to-evidence matrix — framework ID, cloud check, source, cadence, owner
• Evidence package — exports with timestamps and population notes
• Residency diagram — regions, backups, DR, subprocessors (technical)
• CCM dashboard spec — rules, thresholds, exception register
• Assessor FAQ — shared responsibility, logging, encryption, access

Principles

• Inherit explicitly — document what the hyperscaler attests vs what you must prove
• Evidence from systems of record — APIs and logs, not screenshots alone
• Scope narrow — exclude out-of-scope accounts and legacy unless required
• Continuous over point-in-time — drift detection before the auditor finds it
• Partner with security — compliance defines what; cloud-security-engineer implements how