Evidence, Not Screenshots | Staff Security GFC Analyst @ Suno

**Verse 1** Nothing's mapped yet, just a standard on a page SOC 2, NIST CSF, a framework I need to shape I read the cloud config like it's telling me a story Does it do what it claims, or is it just performatory **Pre-Chorus** Not chasing screenshots, not another manual chase I build the thing that proves it, automate the case **Chorus** I'm building the control that ties it all together Mapped and measured, evidence, not just paper Design versus operating, I know the difference well Audit's not a fire drill, it's a story I can tell Seven years of reading systems, knowing what's enforced Greenfield, real stakes, building it from source **Verse 2** Vendor reviews stacking, questionnaires in line Policy that's current, not frozen back in time CISO needs a picture, clear and backed by proof Board wants the truth — I bring 'em the whole truth **Pre-Chorus** Not chasing screenshots, not another manual chase I build the thing that proves it, automate the case **Chorus** I'm building the control that ties it all together Mapped and measured, evidence, not just paper Design versus operating, I know the difference well Audit's not a fire drill, it's a story I can tell Seven years of reading systems, knowing what's enforced Greenfield, real stakes, building it from source **Bridge** AI does the gathering, I keep the human eye Deciding where the automation gets to fly Not a checkbox exercise, not compliance for show Trust that customers can see and know **Outro** Evidence, not screenshots, that's the way I build Somewhere a customer signs because the trust was earned, fulfilled That's the job — quiet, exact, and true A framework nobody sees, holding up the view