Fugue is a cloud security and compliance company, part of the In-Q-Tel portfolio — the strategic investor that backs technology relevant to US national security.

I built the data warehouse behind their automated compliance verification: pipelines that collected Terraform state and cloud configuration data, applied compliance rules against it, and stored the results in an S3-backed warehouse managed through AWS Glue and Spark. The output was continuous FedRAMP and PCI DSS verification rather than periodic audit.

The design idea worth naming is that compliance is normally treated as an event. Someone runs an audit, produces a snapshot, and the organization is compliant on the day of the report and unknown thereafter. Modelling it as a continuous data pipeline turns it into a monitored property of the system — you can ask what the posture was on any given day, and answer with evidence rather than recollection.

That only works if the evidence is structured, repeatable, and visible to the people who have to make decisions. Most of the engineering effort went there rather than into the rule logic itself.

More context: projects-for-work case study