Secure and Compliant DevSecOps Architecture for Automated CI/CD Pipelines in Regulated Cloud Environments

Regulated cloud environments require continuous software delivery while maintaining strict security and compliance controls. Traditional DevSecOps approaches are largely reactive and struggle to address dynamic cloud native threats and evolving regulatory requirements. This paper proposes a secure and compliant AI-driven DevSecOps architecture for automated CI/CD pipelines in regulated cloud environments, with the goal of enabling continuous compliance and proactive security enforcement without reducing deployment velocity. The architecture integrates machine learning based anomaly detection, compliance as code, and policy as code directly into CI/CD workflows to automate security validation, detect behavioral deviations, and enforce regulatory controls aligned with standards such as HIPAA, PCI DSS, FedRAMP, and NIST. Designed for cloud native and hybrid environments, the approach supports containers, microservices, and infrastructure as code while applying zero trust principles and continuous monitoring. The proposed framework demonstrates how AI-augmented DevSecOps can transform security and compliance from reactive processes into predictive, adaptive capabilities for regulated cloud ecosystems.