Manjunath Shivarudrappa

Compliance as Code: Embedding Regulatory Controls into Enterprise DevOps Pipelines

Abstract:

Modern DevOps pipelines can build infrastructure and release software far faster than traditional compliance processes can evaluate them, creating a growing gap between engineering velocity and regulatory assurance. This talk presents Compliance as Code as an architectural model for embedding regulatory intent directly into enterprise software delivery rather than treating compliance as a periodic external checkpoint. The approach translates regulatory obligations into control objectives, technical policies, enforceable rules, evidence artifacts, and continuous feedback, enabling controls to be versioned, tested, executed, and traced alongside application and infrastructure changes. A compliance-native reference architecture spans source control, CI/CD pipeline checks, infrastructure policy enforcement, runtime assurance, governance, and remediation feedback. It supports preventive and detective controls for dependency risk, secrets management, identity and access, encryption, network guardrails, infrastructure as code, release approvals, configuration drift, vulnerabilities, and access monitoring. Emphasis is placed on evidence quality and traceability, ensuring that each control decision captures the relevant commit, repository, environment, actor, timestamp, policy version, exception history, and remediation outcome. Risk-based, context-aware gates help organizations avoid merely automating bureaucracy, while governed exception processes preserve accountability through defined ownership, expiration, compensating controls, and explicit risk acceptance. The talk concludes by exploring future directions including risk-adaptive pipelines, policy-conflict detection, runtime compliance agents, AI-assisted regulatory mapping, digital control twins, and formal verification. The result is a DevOps model in which compliance becomes continuous, traceable, enforceable, and testable by design.

Brief Profile:

Manjunath Shivarudrappa is a senior engineering and technology leader with nearly 20 years of experience in cloud engineering, DevOps, Site Reliability Engineering (SRE), infrastructure automation, and enterprise platform modernization. He currently serves as Senior Manager, Staff Software Engineering at GEICO, where he leads DevOps and SRE teams supporting mission-critical financial platforms and drives initiatives in cloud transformation, application reliability, security, regulatory compliance, and large-scale engineering modernization.Throughout his career, Manjunath has held leadership and senior engineering roles at GEICO, Syapse, TaxAct, Citi, CVS Health, Cooper Tire & Rubber Company, Fujitsu, Country Fire Authority, and Yarra Valley Water. His experience spans enterprise cloud migrations, CI/CD transformation, Kubernetes platforms, infrastructure as code, cloud security, observability, and production operations across insurance, healthcare, financial services, retail, manufacturing, telecommunications, and the public sector.He is recognized for combining deep technical expertise with engineering leadership, building high-performing teams while modernizing complex technology ecosystems using AWS, Azure, Kubernetes, Terraform, Docker, GitHub Actions, Jenkins, and other cloud-native technologies. Manjunath holds a Master of Engineering from Swinburne University of Technology, Australia, and a Bachelor of Engineering from Visvesvaraya Technological University, India. He is an AWS Certified Solutions Architect – Associate, a Microsoft Certified Professional, and is certified in Microsoft System Center Configuration Manager.