Security Governance, Risk & Privacy Topics
Governance, compliance frameworks, regulatory requirements, compliance implementation, and compliance-driven risk management. Covers compliance frameworks (SOX, GDPR, HIPAA, FCPA, etc.), regulatory interpretation, compliance control design, audit and control effectiveness evaluation, and compliance process management. For operational security implementation and technical threat mitigation, see Security Engineering & Operations.
Data Subject Rights and Request Handling
Operationalizing individual rights: access, rectification, erasure, portability, restriction, and objection requests. Covers identity verification, response timelines, locating data across systems to fulfill a request, and handling edge cases and exemptions. Includes designing systems that can execute deletion and export reliably at scale.
GDPR Principles and Compliance
The General Data Protection Regulation in depth: the six lawful bases, data subject rights, accountability and records obligations, DPO requirements, and enforcement and fines. Covers how GDPR principles translate into concrete engineering and product controls. Includes controller and processor obligations and demonstrating compliance.
Privacy by Design and Default
Designing privacy into products, architectures and the software development lifecycle instead of bolting it on afterward. Covers the privacy-by-design principles and privacy-protective defaults, data minimization and purpose limitation at design time, personal-data flow mapping and PII inventory for a feature, consent and preference design including consent storage, enforcement across web and mobile and region-specific consent flows, retention and deletion design including legal holds, deletion across backups and immutable logs, provable deletion, and data-subject access, export and erasure flows, PII-safe logging, telemetry and session replay, on-device processing to limit data exposure, privacy-versus-personalization trade-offs, privacy in ML training data, feature stores and erasure from trained models, and privacy review gates, checklists, CI/CD checks, release readiness and requirements traceability inside engineering workflows. Includes designing privacy-first features, reference architectures, remediating privacy design flaws and rollout programs across product teams, and working with product, legal and security partners. Cryptographic and statistical privacy techniques, formal impact assessments, data-protection law, cross-border transfer rules, vendor risk, and encryption or access-control mechanics are covered elsewhere.
Security Findings Management and Remediation Tracking
Managing the lifecycle of security and compliance findings from identification through closure. Covers triaging and prioritizing findings and large backlogs by business impact, assigning ownership, designing tracker states and remediation ticket workflows with SLAs, escalation and time-bound risk-accepted exceptions, tracking remediation to completion, verifying fixes and choosing a retest approach, ingesting, deduplicating and normalizing findings across scanners and manual tests, and turning post-incident and vendor-blocked issues into tracked, prioritized remediation plans. Also covers reporting on remediation status, aging and program metrics (and how those metrics get misread), building auditor-ready evidence and mapping findings to compliance controls, scripting and querying remediation data, and writing the findings report itself: structure for developer and executive audiences, reproducible evidence, remediation guidance and safe handling of exploit proof. Discovering vulnerabilities and scoring them are out of scope.
Data Minimization and Retention
Collecting and keeping only what is necessary: data minimization at collection, purpose limitation, and retention scheduling with automated deletion. Covers defining retention periods, enforcing them technically, and defensibly disposing of data. Includes balancing operational or analytics needs against minimization obligations.
Balancing Security, Privacy and Business Enablement
Judgment calls where security, privacy or compliance requirements collide with delivery speed, cost, conversion, performance, availability or product ambition, and how to decide and defend them. Covers weighing a control against its business impact, right-sizing controls to risk and organizational context, accepting residual risk with compensating controls and documented sign-off, deciding when to delay a launch versus ship or pause feature work, phasing remediation and interim measures under audit or regulatory deadlines, trading security against latency, uptime and release velocity, deciding on vendors and deals with weak security maturity, negotiating data collection, retention and personalization limits with product, legal and finance (budget cuts, roadmap pressure, vendor timelines), and positioning these functions as enablers of trust rather than blockers. Boundary: the program operating model and governance bodies, privacy and control engineering mechanics, formal risk assessment and quantification, privacy-focused marketing and data strategy, and presenting security investment cases to executives and boards are covered elsewhere.
Global Privacy Regulations and Data Protection Frameworks
The landscape of privacy and data protection law and how core frameworks fit together: controllers vs processors, personal vs sensitive data, lawful processing, and cross-framework concepts. Covers foundational privacy terminology and how to reason about which regimes apply to a given data flow. Serves as the orientation layer beneath the regulation-specific topics.
Data Classification and Sensitivity Handling
Classifying data by sensitivity and applying controls proportionate to that classification: identifying personal, sensitive, and special-category data and tagging it through its lifecycle. Covers classification schemes, labeling, and how classification drives access, encryption, and retention decisions. Includes assessing the impact of a given data type on privacy and security risk.