Fintech cost and security program

Situation

Compute had been scaled during product bursts and never returned. Finance could not explain unit cost. IAM was inherited, logging was incomplete, and the evidence path for audit was informal.

Approach

We mapped spend and privilege on the same topology. Idle resources were removed, pricing architecture was rebuilt, and identity, network and detection were redesigned as one program.

1. Joint assessmentCost drivers and security findings ranked together. Over-permissioned roles and over-provisioned compute were often the same decision, years later.
2. Run-rate resetRightsizing, storage class, transfer paths and commitment strategy sequenced so engineering could continue to release.
3. Control-plane rebuildIAM, service control policies, logging and network paths that a fintech CISO could defend.
4. Evidence as a by-productCompliance automation so the six-week baseline was how the account ran, not a project with an end date.

Result

AWS expenditure reduced by 35%. Security posture reached a level the next diligence cycle could accept. The compliance baseline was in place in six weeks.