Automation & Code
Policy-as-code, compliance-as-code and CI/CD guardrails. You stop describing controls in Word and start expressing them in Rego, YAML and Python that a pipeline can enforce.
12
rooms
2410
total XP
10h
est. time
What you'll be able to do
- ›Model controls as structured data (YAML/JSON/OSCAL)
- ›Write and test OPA/Rego policies against real inputs
- ›Fail a build on a control violation inside CI/CD
- ›Script against Jira, Okta and cloud APIs to remove manual steps
Rooms
What Is GRC Engineering?
The failure mode of traditional GRC, what changes when you treat compliance as a software problem, and the skills that define a GRC engineer.
The Spreadsheet Failure Mode
Diagnose a real compliance program drowning in manual work and identify the three automations that save the most work.
Your First Automated Control
Take one access-review control from Word document to a scheduled check that produces its own evidence.
Git for GRC Artifacts
Version control, review and approval workflows applied to policies and control definitions.
Controls as Data
Model a control catalog in YAML/JSON and OSCAL so it can be queried, diffed and tested.
Policy as Code with OPA/Rego
Write Rego policies that evaluate cloud configuration against your control catalog.
Control Checks in CI/CD
Fail a pipeline on a control violation, and design the exception path that keeps engineers moving.
OSCAL Profiles & Baselines
Tailor a catalog into a profile without destroying it, and keep the SSP, assessment results and POA&M pointing at the same control ids.
Automating GRC with APIs
Script against Okta, Jira and cloud APIs for evidence: authentication, pagination, throttling and proving the population was complete.
Testing Compliance Code
Write tests that can actually fail: negative cases, missing-field cases and assertions on the decision rather than on the run.
Build an Evidence Pipeline, Step by Step
Build a working GRC evidence pipeline end to end: collectors for identity, cloud, ticketing, CI and HR sources, a normalised evidence record, policy code you write yourself, custody, scheduling and reporting.
Automation Capstone
Ship one control end to end as code: repository layout, tests that can fail, a gate that cannot be skipped quietly, and evidence emitted by the pipeline itself.