Consumer lender: building a Production Security function from scratch

Context

A regulated financial institution operating under NIST and PCI DSS. Security operations were fragmented, reactive and entirely manual, and no Production Security function governed hardening, patching, privileged access or monitoring.

FuturWork embedded a senior security engineer for 2.5 years to create, structure and industrialize the ProdSec department.

Challenges

• Inconsistent patching and hardening. No standard baselines for Windows Server 2019/2022 or RHEL 8, and untracked drift in production.
• Ungoverned privileged access. CyberArk was deployed but not fully enforced: shared accounts, incomplete session recording and credential rotation.
• Manual operations and monitoring gaps. SIEM and Tenable.sc were underused, certificates untracked and firewall rules managed reactively.

What we did

• Built the ProdSec function. Hardening standards, reinforced NIST and PCI controls, and stabilized CyberArk, Tenable.sc/Nessus, Active Directory and GPO governance.
• Consolidated security infrastructure. Optimized SIEM monitoring, hardened WAF, firewall and proxy rules, and managed TLS certificates end to end.
• Automated controls. Ansible and PowerShell automation for compliance and patching.

Results

• Production Security function created from scratch
• ~40% less manual security workload
• Better patch and vulnerability compliance, stronger audit posture

From security fragmentation to automated Production Security governance.

Facing a similar challenge? Talk to our team.