Zero-Trust Architecture for a Multi-Region Fintech
Replaced perimeter VPNs with identity-aware access, cutting the attack surface and passing SOC 2 Type II with zero exceptions.
Rapid growth left a sprawl of VPNs, shared credentials, and inconsistent access policies that would not survive a SOC 2 Type II audit.
We implemented identity-aware proxies, phishing-resistant MFA, and policy-as-code, then generated continuous evidence so audit readiness became a steady state rather than a scramble.
Okta as the identity backbone, Cloudflare Access for application gating, HashiCorp Vault for secrets, OPA for policy-as-code, and Wiz for continuous cloud posture management.
Passed SOC 2 Type II with zero exceptions, reduced the externally reachable attack surface by 78%, and made quarterly access reviews three times faster.