AWS Cloud Architecture, Security & SOC 2 Compliance
Designed and implemented a SOC 2–aligned AWS architecture with least-privilege IAM, centralized secrets, and continuous security monitoring.
Key highlights
- Implemented least-privilege IAM principals, reducing unnecessary permissions by ~70% and improving security posture.
- Integrated GuardDuty, AWS KMS, AWS Config, and Inspector to continuously monitor vulnerabilities and misconfigurations — cutting manual audit effort by ~70%.
- Configured AWS WAF (Bot control, SQLi, XSS, IP-restricted admin URLs), blocking ~99% of common web exploits.
- Led investigation and remediation of a security incident, improving monitoring and access controls.
- Optimized infrastructure cost through rightsizing and monitoring, achieving 30–40% reduction in monthly AWS spend.
Overview
Designed an end-to-end AWS cloud architecture for production-grade applications, then audited and aligned it with SOC 2 compliance requirements. The goal was a security baseline that auditors trust and engineers can actually work within day to day.
What I did
Identity & access
Rebuilt IAM around least-privilege principals, removing standing broad permissions and scoping access to exactly what each role needs. This reduced unnecessary permissions by ~70%.
Secrets management
Removed hard-coded credentials across the stack by moving secrets into AWS Secrets Manager and Parameter Store, with rotation where supported.
Continuous monitoring
Wired up GuardDuty, AWS Config, Inspector, and KMS so vulnerabilities and configuration drift surface automatically — cutting manual audit effort by ~70%.
Edge protection
Configured AWS WAF with managed rule groups (SQLi, XSS, bot control) and IP-restricted the admin login URLs, blocking roughly 99% of common web exploits.
Logging & alerting
Centralized logging and alerting on CloudWatch for fast detection and resolution of security and availability events.
Outcome
A SOC 2–aligned, continuously-monitored AWS environment with least-privilege access, centralized secrets, and 30–40% lower monthly spend — plus a central knowledge base documenting the whole architecture.
← Back to all projects