Rebuilding Globex's compliance pipeline for SOC 2 readiness
A ground-up rebuild of the data pipeline and access-control layer that took Globex from a failed audit to SOC 2 Type II certification in one cycle.
The challenge
Globex had failed a SOC 2 readiness assessment the prior year. Access controls were inconsistent across services, and audit logging was incomplete for several of the systems handling customer financial data.
The engineering team needed the fixes to ship without freezing feature development for the two other product lines sharing the same platform.
Our approach
We ran a full threat model and access audit first, then implemented centralized, role-based access control across every service touching customer data, replacing a patchwork of service-specific permission checks.
Audit logging was rebuilt as a shared library so every team got compliant logging automatically rather than needing to implement it service by service.
Work was scoped and shipped incrementally alongside the existing roadmap, with compliance-critical changes prioritized first and reviewed by Globex's security lead at each milestone.
The results
Globex passed its SOC 2 Type II audit on the next cycle with zero major findings.
The centralized access-control layer is now the default for every new service Globex ships, rather than something bolted on after the fact.
Feature velocity on the two unrelated product lines was unaffected during the six-month engagement.