BSidesSF 2026 - Rehearsal is Over: Moving GRC Engineering from Theory into... (Branden Rosenlieb)

### Overview In this talk, Branden Rosenlieb discusses the transition of Governance, Risk, and Compliance (GRC) from theoretical, process-driven frameworks to practical GRC engineering. Traditional GRC relies on static point-in-time assessments, cyclical yearly audits, and manual spreadsheets that drain engineering bandwidth and fail to scale with modern technical environments. By adopting an iterative systems-design approach rooted in DevOps practices, organizations can shift from reactive "checkbox compliance" to continuous, automated compliance that actively enables business growth.

### Key Topics - **Current Limitations of Traditional GRC**: The reliance on annual audit cycles creates high stress, engineering distractions, and "spreadsheet hell" with version control issues. Manual approaches struggle to scale, particularly for startups and small-to-medium businesses. - **Engineering and Systems Thinking**: Treating GRC as a product engineering discipline involves iterative design, dynamic requirement updates, automated feedback loops, and continuous artifact repository refreshes. - **Expanding the Customer Base**: Moving beyond viewing external auditors as the primary GRC customer to treat internal stakeholders—such as developers, infrastructure teams, and project managers—as core customers to minimize friction. - **Business Alignment and Metrics**: Connecting GRC outcomes to core business metrics such as Key Risk Indicators (KRIs), mean time to remediate (MTTR), reduced fines, faster sales cycles, and automated trust center updates.

### Technical Details Rosenlieb illustrates GRC engineering through three technical components combined into an integrated pipeline: 1. **Automated Evidence Collection (AWS Audit Playbook)**: Utilizing Python and the `boto3` library (created by AJ Den) to query AWS APIs and extract resource states—such as S3 bucket listings, encryption settings, and public access flags—and export them into standardized JSON formats. 2. **Policy-as-Code via Open Policy Agent (OPA)**: Integrating OPA and Gatekeeper to evaluate configurations against programmatic policies written in Rego. The talk demonstrates analyzing a Terraform plan converted to JSON (`tfplan.json`). OPA assigns risk scores to planned infrastructure changes based on impact weights and tolerance levels, automatically rejecting high-risk actions (such as any modification or deletion involving IAM password policies). 3. **AI Virtual GRC Analyst**: Leveraging an open-source coding agent plugin (developed by Mario Lenado, supporting Claude Code and Open Code) with 72 reference files across 15 frameworks (including NIST, SOC 2, ISO 27001, and GDPR). Rosenlieb demonstrates using slash commands (e.g., `/grc control lookup`) to check compliance gaps for a proposed PR, assess ISO 27001 implications, and automatically crosswalk impacts to FedRAMP Moderate controls (specifically IA-5 and IA-5(1)). 4. **End-to-End Loop**: Demonstrates tying these components together: a pull request triggers OPA, which fails an IAM modification; an AWS script gathers current live state; the AI analyst evaluates the failure and recommends fixes; findings are logged to ticketing systems (Jira or Linear); and upon human remediation and deployment, the script reruns to confirm the compliant state.

### Takeaways - **Iterate and Automate Early**: Begin with straightforward, objective checks (e.g., encryption at rest, logging enabled) and treat GRC engineering like DevOps, expecting edge cases (like federated identity) to be resolved iteratively. - **Target Quick Wins**: Focus on immediate-value automations such as programmatic user access reviews (flagging cross-departmental access or highlighting delta changes) and feeding real-time JSON evidence into customer-facing trust centers. - **Don't Wait for Auditors**: Even if external auditors still expect spreadsheets or PDFs, building JSON-based continuous evidence pipelines prepares organizations for emerging standards (such as NIST FedRAMP 20x targeting ~80% automation) while desktop AI tools can bridge formatting gaps in the interim. - **GRC as a Value Enabler**: When GRC is integrated into development pipelines, it shifts from an organizational blocker into a strategic driver for sales enablement and operational trust.