Not a compliance officer interview
Know what engineers do when company pursues certifications.
SOC 2 (awareness)
Trust criteria: security, availability, confidentiality, processing integrity, privacy.
Engineer impact: access reviews, change management tickets, encryption enabled, logging on, vendor security reviews.
PCI-DSS (payments)
If you touch card data — use tokenization (Stripe); never store PAN/CVV.
Most teams use payment processor to stay out of PCI scope.
HIPAA (health)
PHI encryption, audit logs, BAA with vendors — architecture uses dedicated compliant cloud regions.
Engineer during audit
Provide evidence: IAM policies, deploy logs, scan reports. Don't improvise policy.
Interview
"Experience with regulated environments?" — describe controls you built (audit log, encryption, access tiers), not certificate number memorization.
Cross-reference: Data Privacy for GDPR engineer actions.