What does a compliance engineer do?

Mondays start in the GRC platform: whatever failed over the weekend — an unencrypted volume, a public bucket, an offboarding that didn’t complete — gets root-caused and either corrected directly or turned into a precise, pre-scoped ticket. Midweek is evidence work: writing the scripts that pull records automatically, uploading what can’t be automated, keeping screenshots and exports inside their freshness windows. There’s a standing block for people-driven controls — access reviews, security-training completion, background checks on new hires — and, in audit season, for pulling the samples the auditor requests.

The title matters because of what it isn’t: a GRC analyst manages documents and risk registers, while a compliance engineer works in IAM policies, Terraform, and CI pipelines. The formal definition sits in the glossary under compliance engineer.

A startup with one framework generates a few hundred hours of this work a year — too much to ignore, too little to hire for. That arithmetic is what managed providers are built on: Agency assigns compliance engineers across a small set of clients, under vCISO leadership that owns strategy while the engineers own execution.