A319 First Officer reported being alerted by TCAS and noticed VFR traffic in the approach corridor.

Narrative

Descending on the arrival into ZZZ; approximate location ZZZZZ intersection. Given a descent to cross ZZZZZ at 6;000 ft. Just before the intersection ATC gave us a turn off the arrival for VFR traffic. After a few moments; we were given a turn further north. A few moments after that we were given a turn back to the east as the VFR traffic was turning again. At this time our TCAS showed the VFR traffic as a TA; which I announced to the Captain during our turn to the east. I told the Captain the traffic was 400 below us and climbing and looked like it would become an RA; which it did shortly thereafter. The Captain clicked off the autopilot and followed the directions of the TCAS RA alert and ensured there was no descent. We visually acquired the target on the other side of the top of a cloud. The VFR traffic; which was a Cirrus SR20; was low on top of a solid cloud deck and appeared to be cloud surfing. It was apparent he did not know that he was in an approach corridor or at least did not care. We passed over the traffic by 300 - 400 ft. After maneuvering and letting ATC know that we adjusted course for an RA we were given a vector back onto the arrival. Upon reviewing the flight on FlightAware it appears that the Cirrus aircraft was making S-turns just outside of the Class B airspace; just under the approach corridor for the arrival. [This was caused by the] Cirrus's pilots lack of airspace awareness and lack of communication with ATC.It was apparent the pilot of the Cirrus was not following VFR cloud clearances; at least from our perspective as there was no way he could have contact with the ground being low and just above a solid cloud layer. ATC was not in contact with the aircraft and it was apparent that the pilot either did not know or did not care that he was in a very busy approach corridor.