Zero-trust AWS controls that took a FinTech to SOC 2 Type II in 8 weeks with no audit findings.

Enterprise customers required SOC 2 Type II before signing. The infrastructure had grown organically: secrets committed to repositories, IAM policies far broader than needed, no network segmentation between services, and no reliable record of who changed what. The gap had to close inside one quarter.

Layers top to bottom. Controls apply at every layer.

1. 01Map every SOC 2 control to a concrete technical control and an evidence source before touching infrastructure.
2. 02Make private the default: VPC endpoints, security groups and NACLs so nothing is reachable unless declared.
3. 03Move every secret into AWS Secrets Manager with rotation, and remove them from code and CI history.
4. 04Rebuild IAM around roles and least privilege, with access reviewed in pull requests.
5. 05Make change itself auditable: infrastructure only through reviewed Terraform, with CloudTrail and config history retained.

• Week 1: control mapping and gap assessment, agreed with the compliance lead and the auditor's checklist.
• Week 2–5: network, identity and secrets controls implemented as Terraform in the client's accounts.
• Week 6–7: audit logging, evidence collection and infrastructure code-review workflow. Dry-run against the control list.
• Week 8: hand-over, runbooks and evidence pack. External audit followed and closed with zero findings.

• Identity and access model with role catalogue
• Network, secrets and audit controls as Terraform
• Control-to-evidence map for SOC 2 Type II
• Security operations and incident runbooks