Client: Leading Banking and Financial Services Organization
Role: DevSecOps Engineer / Cloud Security Engineer
Duration: [Specify Duration – e.g., Jan 2024 – Sep 2024]
Environment: Azure Cloud | Kubernetes | Jenkins | SonarQube | Aqua Trivy | Terraform | Vault | GitHub Actions | Checkov | OWASP ZAP
The project aimed to modernize and secure the client’s existing digital banking infrastructure by implementing a DevSecOps-driven CI/CD framework. The goal was to integrate security at every stage of the SDLC, automate compliance checks, and ensure regulatory adherence (PCI DSS, ISO 27001) while enabling faster, safer, and more reliable releases of banking microservices.
End-to-End CI/CD Automation:
Designed and implemented Jenkins-based CI/CD pipelines integrated with GitHub Actions for microservices deployment on Azure Kubernetes Service (AKS).
Automated build, test, and deployment processes for 40+ microservices.
Infrastructure as Code (IaC):
Provisioned cloud resources using Terraform with policy as code (Checkov) for misconfiguration detection and compliance enforcement.
Implemented GitOps workflows with automated approvals for infrastructure changes.
Security Integration in CI/CD:
Integrated SAST (SonarQube) and DAST (OWASP ZAP) tools within pipelines for application code scanning.
Used Aqua Trivy for container image vulnerability scans and Anchore for image policy enforcement before deployment.
Shifted security left by embedding scans in the developer’s commit phase using pre-commit hooks.
Secrets and Access Management:
Centralized secret management using HashiCorp Vault integrated with Jenkins and Kubernetes.
Applied RBAC policies in Kubernetes clusters to restrict unauthorized access.
Cloud and Compliance Security:
Implemented Azure Security Center recommendations for cloud workload protection.
Automated compliance reporting aligned with PCI-DSS and SOC 2 controls.
Configured Azure Key Vault and Defender for Cloud for continuous security monitoring.
Container Security and Governance:
Established container hardening standards and signed container images before release.
Implemented runtime protection with Falco to detect policy violations in AKS clusters.
Monitoring & Observability:
Set up Prometheus and Grafana dashboards for performance and security metrics.
Integrated ELK stack for centralized logging and anomaly detection.