GRC Engineering - Bringing GRC to a repository near you
summary
Argues that embedding engineering into GRC removes repeated context switches by shipping either quick scripts or a full audit engine backend service; easy mode is a 15-line Python script to auto-check SLAs, hard mode is a system that stores controls and scopes, serializes GitHub/K8s/access logs, chains multiple vulnerability scanners via an integration middleware, and exposes an API, web UI and report worker. Notes Kubernetes audit logs and chained scanners as concrete examples, vendor SaaS works for small cloud-first shops but fails for large heterogeneous enterprises, and continuous compliance runs as cron jobs.
AI-written summary · about
chapters (6)
- 0:00Introduction and background
- 3:16Defining GRC challenges
- 7:56The audit cycle frustration
- 12:37Introduction to GRC engineering
- 18:34Building the audit engine
- 24:44Modes of operation and Q&A
related talks
31m📗 Rehearsal is Over: Moving GRC Engineering from Theory into Practice ⚖️
40mCloud Native GRC
40mFun with Continuous Compliance
38mHow to Be a GRC Hero (Without Heroics)
32mAutomating Security Compliance at Scale
32mHow Can SRE Help Security Governance?...
20mA Practical Guide to CI/CD Security Gating
17mGamify security best practices to scalably improve engineering culture