Security, privacy, and compliance engineering research focuses on the realization of these quality attributes within software systems. In practice, however, implementing security, privacy, and compliance requirements extends beyond technical solutions and requires an understanding of human factors, organizational processes, and the broader operational environment. It often also demands the integration of insights from disciplines outside software engineering.

These considerations should be carefully addressed when designing and conducting empirical studies in these domains. This is particularly important in requirements engineering, which serves as a bridge between the context in which a software system operates and its technical implementation.

In this talk, Alex will present his approach to addressing these empirical research challenges throughout his PhD work on regulatory requirements engineering for compliance-by-design. Drawing on experiences from interdisciplinary collaborations and empirical investigations, he will discuss lessons learned, methodological considerations, and recommendations for conducting empirical research in security, privacy, and compliance engineering.