An Iceland-based fintech serving the US market needed SOC2 Type II certification and to pass a major US bank's due diligence review. Devopsity upgraded the existing AWS infrastructure to SOC2 standards, deployed the full security stack, and established continuous security operations under SLA.
Industry
Fintech, Property Finance
Location
United States / Iceland
Time
2025 - Present (ongoing retainer)
Company
Under NDA
The client is an Iceland-based fintech company (incorporated in the US) providing a cash-free alternative to traditional rental security deposits. Their platform allows tenants to move into rental units without putting down a lump-sum cash deposit, while guaranteeing landlords that funds are available if needed. The company has approximately 20 employees across the United States and Iceland, with no dedicated security or infrastructure team.
The platform processes financial transactions and handles sensitive personal and financial data for both tenants and landlords, making security and compliance non-negotiable requirements. The client needed to achieve SOC2 Type II certification to satisfy partner requirements and pass due diligence reviews from a major US bank - milestones that would determine whether the business could scale. This engagement is delivered as part of our security and compliance services.
Devopsity joined the project at the point of production entry. Pre-production environments (development, staging) were already in place, but did not meet the standards required for SOC2. Our goal was to upgrade the entire infrastructure to SOC2 Type II compliance - both by building out the production environment and implementing security controls across all layers.
No security operations capability. With a 20-person team focused on product development, there was no one to manage security monitoring, triage vulnerabilities, investigate threats, or maintain compliance. They needed an outsourced Cloud SOC (Security Operations Center) that could operate continuously - not a one-time security assessment.
SOC2 Type II certification was required. Their banking partners and enterprise landlord clients expected SOC2 as a baseline. SOC2 Type II requires not just implementing controls but demonstrating that they operate effectively over time - which means continuous evidence collection, not a point-in-time audit preparation sprint.
A major US bank’s due diligence review was pending. The bank’s assessment specifically evaluated identity and access management, encryption, vulnerability management, incident detection and response, and data backup and recovery. Failing this review would block a critical business partnership.
The infrastructure needed to handle financial transactions securely. Microservices communicating across network boundaries, databases storing financial data, and a frontend serving end users - all needed to be architected with security built in from day one.
We built out and hardened the production AWS infrastructure using Terraform, with security embedded in every architectural decision rather than layered on after the fact.
The network architecture uses two separate VPCs - an Application VPC and a Data VPC - connected via VPC Peering. This separation ensures that the data layer (RDS databases, RabbitMQ message broker, ElastiCache Redis) has no direct internet access path. Application services in the Application VPC reach data services only through the peering connection, and only on specific ports enforced by security groups. A compromised application container cannot reach the internet from the Data VPC, and an attacker who gains network access to the Application VPC still needs to traverse the peering connection and pass security group checks to reach any data store.
Within the Application VPC, ECS Fargate services run in private subnets across us-east-1a and us-east-1b. The Application Load Balancer in public subnets is the only internet-facing component for application traffic. CloudFront serves the frontend from an S3 bucket. A bastion host provides controlled administrative access to internal services - restricted by security groups to authorised source IPs.
Every security group, subnet, route table, peering connection, and network ACL is defined in Terraform. No network infrastructure was created through the console.
All human access uses IAM users with enforced MFA. aws-vault manages CLI credentials with temporary STS sessions. Devopsity operates as the access gatekeeper - every permission request is evaluated against least-privilege principles, approved or denied, and documented for SOC2 audit evidence.
Every ECS service and EC2 instance has a dedicated IAM role scoped to only the API actions and resource ARNs it needs. No two services share roles. Bastion host access is restricted to authorised administrators via security group rules on source IPs.
All application credentials - database passwords, API keys, service integration tokens - are stored in AWS Secrets Manager. Nothing is hardcoded in application code or configuration files. KMS customer-managed keys encrypt all data at rest across RDS, ElastiCache, DynamoDB, S3, and EBS volumes.
We deployed the full AWS-native security stack and operate it daily as the client’s Cloud SOC:
AWS Security Hub serves as the centralised dashboard, aggregating findings from GuardDuty, Inspector, and Config into a single prioritised view. Devopsity reviews Security Hub daily under a defined SLA - critical findings trigger immediate investigation, high findings are remediated within defined timeframes.
Amazon GuardDuty provides continuous threat detection across VPC Flow Logs, CloudTrail management events, and DNS query logs. Findings at critical and high severity trigger PagerDuty alerts, ensuring the Devopsity operations team is notified in real time.
Amazon Inspector provides continuous vulnerability scanning across ECR container images and EC2 instances. Container images are scanned on push to ECR and rescanned automatically when new CVEs are published. EC2 instances (bastion hosts) are scanned for OS-level vulnerabilities.
AWS Config monitors infrastructure compliance with continuous recording of all resource types. Config rules detect configuration drift - an unencrypted volume, a security group opened too broadly, a logging service disabled - and surface findings in Security Hub.
We implemented automated patching for EC2 instances via AWS Systems Manager, ensuring systems are consistently updated with the latest security patches without manual intervention. Patch compliance is tracked through Systems Manager and reported as part of the SOC2 evidence package.
Rather than treating SOC2 as an annual audit preparation exercise, we designed a continuous compliance architecture. Vanta integrates with the AWS security stack and continuously pulls compliance evidence - IAM configurations, encryption status, logging status, vulnerability findings, access reviews, patching status - mapping it to SOC2 trust service criteria automatically.
This means the client’s SOC2 posture is always current. When the auditor reviews, the evidence is already collected and organised. No last-minute scramble, no manual evidence gathering, no gaps where controls existed but evidence wasn’t captured.
We designed and implemented an incident response plan integrated with Slack notifications. GuardDuty and Security Hub findings at critical and high severity trigger PagerDuty incidents automatically. Devopsity is the first responder - triaging, investigating, and remediating under SLA. The incident response plan includes documented classification criteria, escalation paths, communication procedures, and post-incident review templates.
The team regularly practises the incident response plan to ensure quick recovery during actual events. DR procedures cover database restoration (RDS point-in-time recovery), application redeployment (ECS task definition rollback from ECR), and data recovery from backups.
We implemented a backup strategy with 7-year retention for financial regulatory compliance. RDS automated backups provide point-in-time recovery for database workloads. Custom Lambda functions with Step Functions orchestration handle scheduled backups with cross-region replication for critical data. S3 lifecycle policies transition older backups through storage tiers to manage long-term retention costs. Recovery procedures are documented in runbooks and tested regularly.
The CI/CD pipeline runs on GitLab CI with a GitLab Runner deployed in the Application VPC. The pipeline automates the build, test, and deployment process - ensuring consistent, repeatable deployments without manual intervention. Container images are pushed to ECR where Inspector scans them automatically. Deployments to ECS follow a rolling update pattern with health check validation.
We implemented scheduled scaling - cronjobs that scale resources up during business hours and down during off-peak periods - ensuring the client pays for capacity only when needed. Compute resources are right-sized based on CloudWatch utilisation data. CloudWatch alarms monitor for performance anomalies and cost spikes that could indicate compromised or misconfigured resources.
This was a complex project even though the initial infrastructure appeared to be designed with security in mind. Additional requirements from new business partners and a continuously changing security landscape create a constant need for improvement and innovation. SOC2 is not a one-time checkbox - it is an ongoing operational commitment that demands dedicated tooling and disciplined daily practice.
The SOC2 certification and bank due diligence were the opening milestones - the engagement continues as an ongoing Cloud SOC retainer. Devopsity continues to serve as the client’s security operations center, managing Security Hub triage under SLA, maintaining Vanta compliance evidence, responding to GuardDuty and Inspector findings, and supporting the client as they onboard new banking and landlord partners who each bring their own due diligence requirements. Planned improvements include migrating from IAM users to IAM Identity Center for centralised SSO and expanding GuardDuty protection types to include ECS Runtime Monitoring.
AWS Services: Amazon ECS (Fargate), Amazon ECR, Amazon EC2 (bastion hosts, GitLab Runner), Application Load Balancer, Amazon CloudFront, Amazon RDS, Amazon ElastiCache, Amazon MQ (RabbitMQ), Amazon DynamoDB, AWS Security Hub, Amazon GuardDuty, Amazon Inspector, AWS Config, AWS WAF, AWS IAM, AWS Secrets Manager, AWS KMS, AWS Systems Manager, Amazon CloudWatch, AWS CloudTrail, AWS Lambda, AWS Step Functions, Amazon SNS, Amazon SQS, Amazon SES, AWS Certificate Manager, Amazon Route53, Amazon S3
Tools: Terraform, GitLab CI, Docker, aws-vault, PagerDuty, Vanta
Devopsity upgraded the client's existing AWS infrastructure to SOC2 Type II standards - implementing a two-VPC architecture with data isolation, layered security groups, KMS encryption, continuous vulnerability scanning, and real-time threat detection. All defined in Terraform. The client passed a major US bank's due diligence review and is pursuing SOC2 Type II certification with continuous compliance evidence collection.