I'm a specialist in enterprise compliance architecture across regulated industries. I help you design systems that meet regulatory requirements while maintaining operational efficiency.
When to Use This Skill
Ask me when you need help with:
SOC 2 Type II compliance for SaaS applications
HIPAA compliance for healthcare data systems
GDPR compliance for European data protection
PCI-DSS compliance for payment card processing
Security architecture for regulated industries
Audit preparation and evidence collection
Compliance validation for serverless/cloud deployments
My Expertise
SOC 2 Type II Compliance
Core Requirements for Serverless:
Encryption Standards
Encryption at rest: All data in databases, S3, DynamoDB encrypted
Encryption in transit: TLS 1.2+ for all API communications
Quarterly vulnerability scans: External scanning service
Annual penetration testing: By approved assessor
Compliance validation: Annual SAQ or audit
Incident response testing: Test breach response procedures
Secure Card Data Handling
No storage of sensitive authentication data: CVC/CVV, PIN
No storage of magnetic stripe data after auth
Transaction logging: All card interactions logged
Access controls: Minimize people accessing card data
Security Misconfiguration Warnings
Common Serverless Security Issues:
❌ Public S3 Buckets
WRONG:
- S3 bucket with public read access
- "Block public access" disabled
- Bucket policy allows s3:GetObject to "*"
CORRECT:
- Block public access: enabled
- Bucket policy: Only CloudFront, VPC endpoints, specific IAM roles
- Encryption: enabled with customer-managed keys
WRONG:
const apiKey = "sk_test_123456789abcdef"; // In code or env vars
CORRECT:
// AWS
const secret = await secretsManager.getSecretValue('api-key');
// Azure
const credential = new DefaultAzureCredential();
const client = new SecretClient(vaultUrl, credential);
// GCP
const [version] = await client.accessSecretVersion({name: secretName});
❌ Unencrypted Databases
WRONG:
- RDS without encryption
- DynamoDB without encryption
- DocumentDB without encryption
CORRECT:
- All databases encrypted at rest
- Customer-managed keys in KMS
- Encryption enabled during creation
- Cannot be disabled after creation
❌ Missing HTTPS Enforcement
WRONG:
- API Gateway accepting HTTP traffic
- No redirect from HTTP to HTTPS
- Clients can connect via unencrypted channel
CORRECT:
- API Gateway: minimum TLS 1.2
- Redirect HTTP → HTTPS (301)
- Client certificates for additional security
- HSTS header: Strict-Transport-Security
❌ Exposed Environment Variables
WRONG:
export DATABASE_PASSWORD="MyPassword123"
console.log(process.env.DATABASE_PASSWORD) # In logs
CORRECT:
- Use AWS Secrets Manager, Azure Key Vault, GCP Secret Manager
- Inject as secret environment variables (redacted in logs)
- Never log secrets or sensitive configuration
- Rotate secrets annually
❌ Missing Network Isolation
WRONG:
- Lambda in public subnet with NAT
- Database accessible from internet
- No security groups restricting access
CORRECT:
- Lambda in private subnet
- Database in private subnet
- Security groups: Lambda → Database only
- No route to Internet Gateway from database subnet
Production Security Checklist
Before deploying to production, verify all items:
Identity & Access
[ ] IAM roles: Least privilege principle applied
[ ] No wildcard permissions: All permissions specific to resource/action
[ ] Cross-account access: No trusting wildcard principals
[ ] API keys: Rotated annually (or per policy)
[ ] MFA: Enabled for all human users
[ ] Service accounts: Using temporary credentials (STS)
[ ] Resource-based policies: Scoped to specific principals
Secrets Management
[ ] Database passwords: In Secrets Manager, not code
[ ] API keys: In Secrets Manager, not environment variables
[ ] Keys rotated: Annually or per compliance requirement
[ ] Audit logging: All secret access logged and monitored
[ ] Access restricted: Only authorized applications/users
[ ] Old versions: Deleted or marked deprecated
Encryption
[ ] Encryption at rest: Enabled for all databases and storage
[ ] Customer-managed keys: Using KMS, Key Vault, or equivalent