SystemFlare
ES Talk to an engineer

Fintech · Payments & cards

DevOps leadership for a payments fintech's PCI DSS-scope infrastructure

A European fintech processing payments, cards and crypto, with 20–50 people and a regulated core. We lead its DevOps over the long term: infrastructure as code, PCI DSS controls, payments connectivity and disaster recovery.

PCI DSS
scope infrastructure built and operated
EKS
KYC, AML, wallets and ledger services as code
HSM
over a private link to AWS for card processing
Multi-AZ
disaster recovery with cross-region backups

The situation

A European payments fintech processes payments, cards and crypto. It has between 20 and 50 people, a growing set of microservices and a card-processing stack that sits in PCI DSS scope.

A business like this answers to more than its own engineers. Card schemes, banking partners and assessors all ask the same questions: who can reach what, what changed and when, how vulnerabilities are found and fixed, and what happens if a data centre goes away. The infrastructure has to produce those answers as a matter of routine.

We provide its DevOps leadership on a long-term basis.

What we did

Infrastructure as code.

  • AWS environments are described in Terraform and Terragrunt, so changes are reviewed in pull requests and environments can be reproduced.
  • Microservices run on EKS: KYC, AML screening, customer wallets, the general ledger, exchange, invoicing and bank connectors.
  • ArgoCD deploys from Git, Kyverno enforces cluster policies and KEDA scales workloads on demand.
  • A Packer golden image gives every server the same hardened starting point.
  • Ansible configures the card-processing stack.

Security and PCI DSS controls.

  • A Wazuh SIEM collects and correlates security events.
  • Device management with FleetDM.
  • Scheduled vulnerability scanning with Greenbone. The scanner runs only during scans, reports are archived, alerts go to the team chat, and the CISO has a written workflow for handling findings.
  • A WAF with a remediation playbook.
  • Mesh-VPN access policies are changed through pull requests, so every access change is reviewed and recorded.

Payments connectivity.

  • An HSM connected to AWS over a private link (Direct Connect).
  • Connectivity to the card schemes for a third-party card-processing suite.
  • A tap-to-phone (SoftPOS) deployment.

Databases and disaster recovery.

  • Oracle Enterprise Edition with Data Guard, RMAN and TDE.
  • A disaster-recovery design across availability zones, with cross-region backups.
  • The TDE wallet is kept away from the data, so a stolen backup cannot be decrypted on its own.

Ledger and core. We supported a financial ledger and internal middleware that replaced a vendor core-banking product.

Outcome

The fintech runs its regulated infrastructure as code. Access changes, cluster policies and server images all go through review. Vulnerability scanning, event monitoring and device management run on a schedule and leave a trail. The card-processing path, the databases and the recovery plan are documented and repeatable.

When an assessor or a banking partner asks how something is controlled, the answer is in Git.

We implement and evidence the technical controls. Certification itself is done by a QSA.