Re-architected identity and access management from perimeter-based security to zero-trust architecture ahead of a SOC 2 Type II audit, passing on the first attempt with zero findings.

Key Results

100% — SOC 2 Type II pass rate (zero findings)

8 weeks — From project start to audit-ready

98% — Reduction in lateral movement risk

Zero — Security incidents during 6-month audit observation period

Client Requirements

The client, a digital lending platform serving small businesses with $500M+ in annual loan volume, needed to achieve SOC 2 Type II compliance to close enterprise partnerships and expand into regulated markets.

Pass SOC 2 Type II audit within 8 weeks to meet partnership deadlines
Implement zero-trust architecture replacing legacy VPN-based perimeter security
Enforce least-privilege access across all systems and data
Deploy multi-factor authentication (MFA) for all employees and contractors
Establish comprehensive audit logging and monitoring for all access events
Implement network segmentation isolating production from development environments
Create automated compliance evidence collection for continuous audit readiness
Maintain zero downtime during migration (24/7 loan origination platform)
Document all security controls and policies to auditor standards

Challenge: The existing architecture relied on perimeter security (VPN with shared credentials) and overly broad access permissions. Engineers had production database access, customer service reps could view all loan applications, and audit logs were incomplete. The 8-week timeline left no room for delays.

Solution Developed

We designed and implemented a zero-trust security architecture based on identity-driven access control, continuous verification, and comprehensive logging—architected specifically to satisfy SOC 2 Type II requirements.

Architecture Components

Identity Provider & SSO: Migrated from VPN with shared credentials to Okta as centralized identity provider. Implemented SAML-based single sign-on for all internal applications. Enforced MFA for 100% of user accounts with hardware security keys for privileged access.

Zero-Trust Network Access: Replaced VPN with Cloudflare Access (zero-trust network access). Every request authenticated and authorized individually, even from corporate network. No implicit trust based on network location.

Role-Based Access Control (RBAC): Defined 12 roles with least-privilege permissions mapped to job functions. Quarterly access reviews automated via workflow. Privileged access (production databases, AWS console) required just-in-time approval with automatic revocation.

Network Segmentation: Isolated production, staging, and development environments in separate AWS VPCs. Implemented security groups restricting traffic to necessary services only. Eliminated lateral movement paths.

Secrets Management: Migrated hardcoded credentials and .env files to HashiCorp Vault. Application credentials rotated automatically every 30 days. Human access to secrets required MFA and logged to SIEM.

Comprehensive Audit Logging: Centralized all access logs (Okta, AWS CloudTrail, application logs, database queries) into Splunk. Configured 40+ detection rules for suspicious activity. Logs immutable and retained for 7 years per compliance requirements.

Key Security Controls

Principle of least privilege: Users granted minimum access required for their role
Just-in-time access: Privileged access granted temporarily with approval workflow
Continuous authentication: Sessions re-verified every 12 hours
Device posture checks: Only managed, up-to-date devices allowed
Automated offboarding: Access revoked within 1 hour of HR termination notice
Encryption everywhere: TLS 1.3 in transit, AES-256 at rest

Activities Performed

Phase 1: Security Assessment & Gap Analysis (Week 1)

Conducted security audit against SOC 2 Trust Services Criteria
Mapped current architecture and identified 37 security gaps
Interviewed 15 employees across engineering, operations, and customer service
Reviewed existing policies (found incomplete documentation)
Assessed AWS environment for misconfigurations (found 18 critical issues)
Prioritized gaps by audit impact and implementation effort
Created remediation roadmap aligned to 8-week deadline

Phase 2: Identity & Access Foundation (Week 2-3)

Deployed Okta as identity provider and configured SAML SSO
Migrated all users from VPN credentials to Okta accounts
Enforced MFA (Okta Verify app) for all users
Defined 12 RBAC roles with least-privilege permissions
Conducted access audit: removed 200+ unused accounts, right-sized 45 over-privileged accounts
Implemented just-in-time access workflow for production environments
Configured automated offboarding integration with HR system (BambooHR)

Phase 3: Zero-Trust Network & Segmentation (Week 4)

Deployed Cloudflare Access replacing legacy VPN
Configured per-application access policies based on user role and device posture
Implemented network segmentation: production, staging, dev in separate VPCs
Tightened security groups: default deny, explicit allow rules only
Removed SSH bastion hosts, replaced with AWS Systems Manager Session Manager
Tested and validated zero lateral movement between environments

Phase 4: Secrets, Logging & Monitoring (Week 5)

Deployed HashiCorp Vault for centralized secrets management
Migrated 200+ hardcoded credentials from codebases and .env files
Configured automated credential rotation (30-day cycle)
Centralized logs into Splunk: Okta, CloudTrail, app logs, DB audit logs
Built 40+ detection rules for anomalous access patterns
Set up alerting: PagerDuty for critical security events
Configured log retention policy (7 years immutable storage in S3 Glacier)

Phase 5: Documentation & Evidence Collection (Week 6-7)

Documented all security policies: access control, incident response, change management
Created system security plans for each component
Implemented automated compliance evidence collection (Vanta integration)
Generated access review reports, change logs, and incident response records
Conducted internal pre-audit with external security consultant
Remediated 5 findings from pre-audit
Prepared audit evidence package for auditor review

Phase 6: SOC 2 Type II Audit (Week 8 + 6-month observation)

Auditor kickoff: scope review, control walkthroughs
Provided evidence for 60+ control requirements
Demonstrated controls in live environment (MFA, access logs, segmentation)
Responded to auditor questions within 24 hours
Zero findings during 6-month observation period
Received SOC 2 Type II report with unqualified opinion (clean pass)

Technologies Used

Identity & Access Management

Identity Provider: Okta (SSO, MFA, lifecycle management)

MFA: Okta Verify mobile app, Yubikey hardware keys for admins

Zero-Trust Network: Cloudflare Access (identity-aware proxy)

Privileged Access: HashiCorp Boundary (just-in-time access)

Secrets Management: HashiCorp Vault (dynamic credentials, rotation)

Security & Monitoring

SIEM: Splunk (centralized logging, threat detection)

Cloud Security: AWS Security Hub, GuardDuty, Config

Vulnerability Management: Wiz (cloud security posture, container scanning)

Endpoint Security: CrowdStrike Falcon (EDR on employee devices)

Network Security: AWS Security Groups, Network ACLs, VPC Flow Logs

Alerting: PagerDuty (security incident escalation)

Compliance & Governance

Compliance Automation: Vanta (continuous SOC 2 monitoring, evidence collection)

Policy Management: Drata (policy templates, attestation workflows)

HR Integration: BambooHR API (automated onboarding/offboarding)

Change Management: Jira + Slack (approval workflows, audit trails)

Encryption: AWS KMS (key management), TLS 1.3 (transport)

Infrastructure

Cloud: AWS (VPC, Security Groups, IAM, CloudTrail, Systems Manager)

Infrastructure as Code: Terraform (version-controlled infrastructure changes)

CI/CD Security: GitHub Actions with OIDC (no long-lived credentials)

Container Security: Amazon ECR image scanning, Snyk container analysis

Outcomes & Impact

SOC 2 Type II Audit Results

Pass rate: 100% (zero findings, unqualified opinion)

Timeline: Completed in 8 weeks from project start to audit-ready

Observation period: 6 months with zero security incidents

Control effectiveness: All 60+ controls rated as operating effectively

Auditor feedback: Cited as "exceptionally well-prepared" with "mature controls"

Security Improvements

Lateral movement risk: Reduced 98% through network segmentation and zero-trust

Privileged access: Reduced from 25 always-on admin accounts to 3 just-in-time approvals/week

Credential exposure: Eliminated 200+ hardcoded secrets from codebases

MFA coverage: Increased from 20% to 100% of accounts

Access reviews: Automated quarterly reviews, previously done ad-hoc

Incident detection: Mean time to detect dropped from hours to minutes

Business Impact

Closed 3 enterprise partnerships requiring SOC 2 (worth $12M ARR)
Reduced cyber insurance premiums by 35% after compliance certification
Eliminated security as a blocker in sales cycles (reduced deal cycles by 2 weeks)
Improved employee security awareness through mandatory training and MFA adoption
Positioned for future compliance certifications (ISO 27001, PCI DSS)
Zero security breaches during observation period (previous year had 2 incidents)

Client Testimonial

"Passing SOC 2 Type II on the first attempt in 8 weeks seemed impossible when we started. Amartam not only delivered the technical architecture but also understood the audit process inside and out. They knew exactly what evidence auditors would ask for and built systems to generate it automatically. More importantly, we are now genuinely more secure—this was not just a compliance checkbox. The zero-trust architecture has become our competitive advantage in enterprise sales."

— CTO, Digital Lending Platform

Post-Audit Roadmap

Following SOC 2 Type II success, the client is expanding their security program:

ISO 27001 certification: Pursuing international security standard
PCI DSS compliance: Required for expanded payment processing
Penetration testing: Quarterly external pen tests + annual red team exercise
Security awareness training: Phishing simulations and role-based training
Data loss prevention (DLP): Monitoring for sensitive data exfiltration
Advanced threat detection: ML-based anomaly detection in SIEM

Zero-Trust Migration for a Regulated Lender