Building security services for an investment business

The challenge

An American investment management company needed coordinated protection services and clear operating responsibilities. My Security Architect role covered six workstreams: endpoints, vulnerability management, email, data loss prevention, shared credentials and AWS security.

I connected the architecture and infrastructure roadmap with the processes needed to maintain each service.

What I did

• Designed protection and remediation services. The Trend Micro architecture covered endpoint policies, deployment, exceptions and reporting. Qualys agents and scanners supported an assessment process with asset ownership, prioritisation, controlled patching, rescanning and risk exceptions.
• Connected email and data controls to review. Exchange Online Protection guidance covered spam, phishing, quarantine and investigation. The Office 365 DLP implementation used 60+ custom detection types to generate incident reports, with access roles and review procedures for handling policy matches.
• Established shared-credential controls and cloud priorities. I designed the AWS-hosted TeamPass service with Amazon RDS, role-based access, login auditing and Cisco Duo integration. A wider AWS roadmap addressed permissions, network segmentation, encryption, configuration assessment and logging.

The outcome

The engagement delivered coordinated endpoint and email configurations, a vulnerability-remediation process, DLP review procedures and a shared-credential service. Deployment and administration guidance supported changes, exceptions and handover.

The AWS roadmap identified further improvements and dependencies; broader monitoring and incident-response operations remained planning work.

The practical value was consistent service ownership: teams had a reference for what each control protected, how to operate it and how to handle exceptions. DLP reporting gave reviewers a defined process for investigating policy matches.