grc-engineer

Plugin grc-engineer from marketplace grc-engineering-suite in GRCEngClub/claude-grc-engineering. Commands read from the repo's manifest — today.

Skills (7)

• access-review-triage

  Helps you triage a quarterly user access review from an Okta, Azure AD, AWS IAM, GitHub, or generic CSV/JSON export. For each row, recommends certify, revoke, manager confirm, or investigate using rules that catch the usual audit-fail patterns: terminated users still active, dormant admin accounts,

• audit-ready-pr-reviewer

  Reviews pull requests for compliance regressions. Scans code diffs for security and compliance violations, flags issues, and suggests fixes aligned with frameworks like SOC 2, ISO 27001, NIST 800-53.

• code-to-control-mapper

  Maps infrastructure code (Terraform, Kubernetes, CloudFormation) to compliance controls (ISO 27001, SOC 2, NIST 800-53). Analyzes IaC files and generates compliance evidence mappings showing which controls are satisfied.

• evidence-artifact-collector

  Generates CLI commands and API scripts to collect point-in-time evidence for audit controls. Automates evidence gathering from cloud providers (AWS, Azure, GCP) and outputs formatted reports.

• interview-question-generator

  Generates focused assessor interview questions from a technology stack and maps them to compliance frameworks with practical CLI/API evidence hints.

• policy-as-code-generator

  Selects draft policy templates for a limited set of S3 and EC2 requirements. Output requires independent review and testing.

• risk-to-jira-transformer

  Converts unstructured risk assessments into structured Jira tickets. Extracts Likelihood, Impact, Mitigation from natural language and generates JSON formatted for Jira API with clear Definition of Done criteria.

Slash commands (19)

• /grc-engineer:collect-evidence

  Generate scripts to collect audit evidence

• /grc-engineer:find-conflicts

  Identify conflicting requirements across frameworks

• /grc-engineer:frameworks

  List every SCF-mapped framework (249) and show which have a dedicated plugin

• /grc-engineer:gap-assessment

  Aggregate connector findings, map to requested frameworks via SCF crosswalk, and produce a prioritized gap report with remediation links.

• /grc-engineer:generate-implementation

  Generate implementation code for a security control

• /grc-engineer:generate-interview-questions

  Generate assessment interview questions mapped to framework controls

• /grc-engineer:generate-policy

  Generate draft policy templates from natural language requirements

• /grc-engineer:map-control

  Map infrastructure code to compliance framework controls

• /grc-engineer:map-controls-unified

  Map a control across all compliance frameworks

• /grc-engineer:monitor-continuous

  Run recurring compliance checks and emit machine-readable alerts

• /grc-engineer:optimize-multi-framework

  Optimize implementation across multiple compliance frameworks

• /grc-engineer:pipeline-status

  Summarize every configured connector — auth validity, cache freshness, last-run counts — so operators can see the data-pipeline state at a glance.

• /grc-engineer:plan-evidence-transfer

  Plan a human-approved secure evidence transfer without collecting or transmitting evidence

• /grc-engineer:record-automation-metrics

  Write automation coverage metric snapshots into grc-data/metrics

• /grc-engineer:review-pr

  Review pull requests for compliance regressions

• /grc-engineer:scaffold-framework

  Scaffold a new framework plugin from the SCF crosswalk (Stub or Reference depth)

• /grc-engineer:scan-iac

  Scan Infrastructure as Code for compliance violations

• /grc-engineer:test-control

  Run experimental security control checks

• /grc-engineer:transform-risk

  Transform risk assessments into Jira tickets