Description

A focused course, tailored for you

The Senior InfoSec Engineer Cross-Mapped Evidence Pack

Stop rebuilding the same control evidence three different ways for SOC 2, ISO 27001, and the customer security questionnaire that just hit your inbox.

You produce the same evidence four times every audit window because four different stakeholders want it in four different formats. The control did not change. The auditor changed. The evidence work should not be rebuilt every time.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

A Senior Information Security Engineer who carries the technical evidence for SOC 2, ISO 27001, NIST 800-53 alignment, and a steady stream of customer security questionnaires runs into the same friction every quarter. The SOC 2 auditor wants the quarterly user access review with the reviewer name, the date, the population, and the exception list. The ISO 27001 lead wants an Annex A.5.18 narrative that maps the same review to a policy clause. The customer's vendor risk team sends a CAIQ or SIG Lite spreadsheet with seventy rows, several of which ask the same question two different ways. The control is the same: quarterly access review of privileged accounts in Okta and AWS IAM. The artefacts that prove it are the same: the export, the screenshot of the sign-off, the Jira ticket where the exceptions were tracked. But the evidence is rebuilt every time because no one ever stood up a single source-of-truth pack that all four audiences could be pointed at. The result is a Senior InfoSec Engineer spending two weeks per quarter on evidence rework that should be one afternoon of pointer-updates.

What you walk away with

Stand up one cross-mapped evidence pack that satisfies SOC 2, ISO 27001, NIST 800-53, and customer security questionnaires from a single source per control.
Cut audit-window evidence rework from two weeks per quarter to a half-day of pointer updates and re-runs of stored queries.
Hand the SOC 2 Type II auditor, the ISO 27001 surveillance team, and the customer's vendor risk reviewer the same artefact with a different cover note, not four different rebuilds.
Reply to the next CAIQ or SIG Lite with row-level links into the evidence pack instead of free-text answers that the customer team will follow up on.
Produce auditor-acceptable export queries for Okta, AWS IAM, Jira, and the SIEM that include the date, the population, the reviewer, and the exception path on every run.

The 12 modules

Module 1. The control families an InfoSec Engineer actually owns

Maps the six control families a Senior Information Security Engineer carries end-to-end (identity and access, change management, vulnerability and patch management, logging and monitoring, vendor and third-party risk, incident response) against the SOC 2 Trust Services Criteria, ISO 27001 Annex A controls, and NIST 800-53 control families. Names the specific controls where the engineer owns the evidence versus where GRC owns the narrative. Sets the boundary that drives the rest of the pack.

Module 2. The single source-of-truth evidence folder structure

Builds the controlled folder structure the rest of the course populates. One folder per control family, one subfolder per control, each subfolder holding the source export, the dated screenshot, the linked ticket, the narrative paragraph, and the mapping table that points multiple frameworks at the same artefact. Sets naming conventions, retention rules, and access controls so the pack survives an auditor walkthrough without an apology.

Module 3. Identity and access: Okta and AWS IAM evidence the auditor accepts

Walks through the quarterly privileged-access review for Okta and AWS IAM. Sets up the saved SQL or System Log API export that pulls the population, the reviewer assignment, the sign-off date, and the exception list in one query. Covers the joiner-mover-leaver evidence the SOC 2 auditor will ask for, including the offboarding ticket linked to the access removal timestamp.

Module 4. Change management: Jira, GitHub, and the production deploy trail

Produces the change-evidence pack that satisfies SOC 2 CC8.1, ISO 27001 A.8.32, and the customer questionnaire question about segregation of duties in production deploys. Sets the Jira JQL query, the GitHub pull-request approval export, and the CI/CD deploy log selector. Covers how to handle emergency changes so the exception list does not become the audit finding.

Module 5. Vulnerability management: scanner output to remediation evidence

Turns the raw output of a vulnerability scanner into evidence the auditor will accept. Covers the scan cadence proof, the SLA tracking by severity, the exception register for accepted risks, and the remediation ticket link per critical finding. Includes the narrative paragraph that connects the scanner output to the policy commitment so the ISO 27001 A.8.8 control reads as operated, not just documented.

Module 6. Logging and monitoring: SIEM evidence without screenshot fatigue

Produces logging-control evidence from the SIEM without manually screenshotting ten dashboards. Covers the saved search per control, the alert-to-ticket pipeline that proves response, the log-retention policy attestation, and the access-to-logs control. Includes the AWS CloudTrail and identity-provider log queries that double as detection content and as auditor evidence.

Module 7. Vendor and third-party risk: the sub-processor evidence cycle

Builds the vendor-risk evidence pack: the sub-processor list, the annual review evidence per critical vendor, the SOC 2 report receipt log, and the contract-clause attestation. Sets the cadence so the next SOC 2 auditor question about vendor review is answered with a folder, not a search through email. Covers the customer-questionnaire questions about sub-processor notification and how to answer them with the pack rather than free text.

Module 8. Incident response: the timeline an auditor can follow

Produces an incident-evidence pack that survives a SOC 2 walkthrough and a customer breach-notification clause review. Covers the on-call rotation evidence, the tabletop exercise output, the post-incident review template, and the incident ticket trail that the auditor can follow from detection to closure. Includes the narrative for the ISO 27001 A.5.24 to A.5.28 control set so the engineer is not writing it from scratch on audit day.

Module 9. The cross-framework mapping table that does the heavy lifting

Builds the single mapping table that points SOC 2 Trust Services Criteria, ISO 27001 Annex A controls, NIST 800-53 control IDs, and the most common CAIQ and SIG Lite question identifiers at the same evidence artefact. Covers how to keep the table current as frameworks revise, and the policy decision about what to do when frameworks disagree on what the evidence should prove.

Module 10. Answering customer security questionnaires from the pack

Turns the evidence pack into a customer-questionnaire response engine. Covers how to answer a SIG Lite, a CAIQ, and a bespoke customer security review with row-level links into the pack rather than free-text answers. Includes the cover-letter template that names what the customer is being given, the boundary of what is shared, and the redaction rules for shared evidence. Sales escalation drops by an order of magnitude.

Module 11. The SOC 2 Type II window: from kickoff to report

Walks the engineer through a SOC 2 Type II observation window using the pack as the working surface. Covers the auditor evidence-request list translation, the population-and-sample mechanics, the walkthrough preparation, the exception-handling pattern, and the management response language. Includes the pre-audit dry-run the engineer can run two weeks out so the auditor's first request finds the answer already filed.

Module 12. The ISO 27001 surveillance audit and the next questionnaire cycle

Closes the loop with an ISO 27001 surveillance audit run against the same pack, plus the steady-state rhythm for the next four quarters of customer questionnaires and internal audits. Covers the Statement of Applicability maintenance, the management-review evidence, the internal-audit programme alignment, and the quarterly pack-maintenance checklist that keeps the engineer out of evidence-rework hell going forward.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Module 3 (Okta and AWS IAM) when the SOC 2 auditor asks for the quarterly privileged access review and the customer SIG Lite asks the same question two rows apart.

Module 9 (cross-framework mapping table) when the ISO 27001 surveillance team asks for the Annex A control narrative and the SOC 2 evidence already exists in a different format.

Module 10 (questionnaire answers from the pack) when sales escalates a customer security review with a seventy-row CAIQ and a five-day deadline.

Module 11 (SOC 2 Type II window) when the auditor kickoff email arrives and the engineer needs the next twelve weeks to be evidence pointer-updates rather than evidence rebuilds.

What you get with this course

Twelve written modules with worked examples drawn from a Senior Information Security Engineer's actual evidence workflow.
Downloadable folder-structure template, naming conventions, and retention policy for the cross-mapped evidence pack.
Saved-query library for Okta System Log, AWS IAM, Jira, GitHub, and SIEM exports that produce auditor-acceptable output on each run.
Cross-framework mapping table linking SOC 2 Trust Services Criteria, ISO 27001 Annex A, NIST 800-53, CAIQ, and SIG Lite rows to evidence artefacts.
Customer-questionnaire cover-letter and redaction template.
Hand-built implementation playbook tailored to the buyer's stack delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours, the buyer's account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Module 1 to 2 in the first sitting, sets the boundary and stands up the folder structure.

Modules 3 to 8 over the next two weeks, populates each control family's evidence subfolder against the buyer's actual stack.

Modules 9 to 10 in week three, builds the mapping table and the questionnaire response engine.

Modules 11 to 12 ahead of the next audit window, walks the SOC 2 Type II and ISO 27001 surveillance preparation against the pack.

Before and after

Before

Two weeks of evidence rebuild every audit window, screenshots and exports duplicated four ways, customer questionnaires answered in free text that the customer's vendor risk team follows up on for a fortnight.

After

A controlled evidence pack that the SOC 2 auditor, the ISO 27001 lead, and the next customer security reviewer are all pointed at, with stored queries, dated screenshots, linked tickets, and a mapping table that does the cross-framework translation once.

What happens if you do not address this

Two weeks per quarter goes on evidence rebuild that should be a half-day. The next customer security review drags into a four-week back-and-forth because answers are free text rather than pack pointers. The ISO 27001 surveillance auditor finds a narrative inconsistency between this year's response and the SOC 2 control description because no single source of truth exists. The Senior Information Security Engineer's calendar fills with evidence work and not with the security engineering the title implies.

Who it is for

A Senior Information Security Engineer at a mid-size SaaS or technology firm. Owns the technical implementation of identity, access, logging, vulnerability management, and incident response controls. Is the named technical contact on the SOC 2 report and the ISO 27001 SoA. Gets pulled into customer security reviews when sales escalates. Reports into a CISO or Director of Security. Three to seven years in the role, with the operational depth to run an Okta access review or write an SIEM detection but tired of being the evidence-export shop for every audit and questionnaire.

Who this is NOT for. GRC analysts who own the audit relationships but do not run the controls. CISOs setting strategy. Security architects designing future state. SOC analysts on detection-and-response shifts. This is for the engineer who exports the evidence and writes the technical narrative when an audit asks.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Around twenty hours of focused work across three to four weeks, with the implementation playbook providing the per-stack checklists so the engineer is not improvising the folder structure or the saved queries from scratch.

Why $199 is the right number

A GRC platform priced in the five-figure range can map controls across frameworks, but a Senior Information Security Engineer still has to produce the evidence and write the technical narrative. A consultant engagement to stand up an evidence programme runs into the low six figures. Building the pack from scratch from blog posts and the auditor's request list is what produces the two-weeks-per-quarter rework loop. This course gives the engineer the pack structure, the saved queries, the mapping table, and the questionnaire response engine for the price of a single hour of a Big Four advisor's time.

FAQ

Does this assume a specific compliance stack?

No. The folder structure, mapping table, and saved-query patterns assume Okta or an equivalent identity provider, AWS or an equivalent cloud, Jira or an equivalent ticketing system, and a SIEM. The implementation playbook is hand-built against the buyer's actual stack so the saved queries are usable on day one.

Is this a SOC 2 readiness course?

No. This is for the engineer who already operates the controls and needs the evidence and cross-framework mapping to stop being rebuilt every audit window. SOC 2 readiness is covered as one of four audiences the pack serves, alongside ISO 27001, NIST 800-53, and customer questionnaires.

How is the implementation playbook tailored?

After purchase, the buyer answers a short intake covering identity provider, cloud, ticketing, SIEM, current audit obligations, and active customer questionnaire formats. The playbook is hand-built against those answers within 24 hours and delivered alongside course access.

What if the audit is six weeks away?

Module 11 covers a compressed pre-audit dry run designed for an engineer with a tight window. Six weeks is enough to stand up the pack for the controls in scope, run a dry-evidence pass, and have the auditor's first request find the answer already filed.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.