Cloud Services in New York

Financial Services / Asset Management

A New York-based asset management firm ($45B AUM, 850 employees, running quantitative and fundamental strategies across global equity, fixed income, and alternatives) needed to migrate its analytics and operations infrastructure to cloud while maintaining the performance and security required for investment operations. (1) Infrastructure constraints: the firm operated 2,400 physical servers in a midtown Manhattan data centre — running portfolio management, risk analytics, order management, market data, client reporting, and research systems. The data centre lease was expiring in 18 months with a $12M annual renewal cost. However, the firm could not simply lift-and-shift to cloud — 40% of workloads had latency or regulatory requirements that prevented straightforward migration. (2) Analytics performance: the firm's quantitative strategies required massive computational power for backtesting, factor analysis, and risk modelling — consuming 1,200 CPU cores during peak periods (end of month, quarter end). On-premises, this meant maintaining 1,200 cores that sat 70% idle during non-peak periods. The firm wanted cloud elasticity for analytics but needed consistent, predictable performance — a backtest that took 4 hours on-premises should not take 6 hours on cloud due to noisy-neighbour effects. (3) Market data: the firm consumed real-time market data from Bloomberg, Reuters, and direct exchange feeds — requiring dedicated infrastructure for data ingestion, normalisation, and distribution. Market data latency was critical for trading operations — any degradation from cloud migration would directly impact execution quality. (4) NYDFS compliance: as a registered investment adviser with operations in New York, the firm was subject to NYDFS cybersecurity requirements. The cloud infrastructure needed documented security controls, encryption, access management, and audit capabilities that would satisfy NYDFS examination. The firm's CISO required that cloud security posture meet or exceed the existing on-premises security controls. (5) Client reporting: institutional clients (pension funds, endowments, family offices) required detailed portfolio reporting — monthly performance, risk analytics, attribution, and compliance reports. The reporting infrastructure processed $45B in positions across 800 client accounts — requiring data from portfolio management, market data, and accounting systems. Reporting currently ran as overnight batch jobs on dedicated servers.

We designed and implemented a hybrid cloud platform over 14 weeks. (1) Hybrid architecture: on-premises retention (market data infrastructure, order management, and execution systems remained in a downsized colocation facility in Equinix NY5 — connected to exchanges and market data providers through existing low-latency links), cloud migration (analytics, risk, client reporting, research, and development workloads migrated to AWS — using dedicated tenancy and placement groups for performance-sensitive workloads), dedicated connectivity (AWS Direct Connect with 10Gbps dedicated connections between Equinix NY5 and AWS us-east-1 — providing consistent, low-latency connectivity between on-premises and cloud), and network architecture (private subnets, VPN failover, and traffic engineering ensuring that investment data never traversed the public internet). (2) Elastic analytics: GPU and CPU compute clusters on AWS — auto-scaling based on workload demand. Backtesting: Kubernetes-based job scheduling — backtests distributed across dynamically provisioned compute nodes, scaling from baseline (200 cores) to peak (3,000+ cores) within minutes. Performance: compute-optimised instances with placement groups delivering consistent performance — backtests completing 35% faster than on-premises due to access to newer hardware and unlimited scale. Cost management: spot instances for interruptible workloads (backtesting, research) with on-demand fallback — reducing compute costs by 60% compared to equivalent on-demand pricing. (3) Data platform: Snowflake for analytics data warehouse — consolidating portfolio data, market data history, research data, and operational data into a single queryable platform. Real-time data: market data ingested through the on-premises infrastructure and streamed to cloud through Direct Connect — maintaining data freshness for cloud-based analytics without compromising latency for trading operations. Historical data: 15 years of market data and portfolio history migrated to cloud storage (S3) with Snowflake for query access — enabling research and backtesting against deep historical datasets. (4) NYDFS-compliant security: encryption (AES-256 for data at rest, TLS 1.3 for data in transit — including all Direct Connect traffic), access management (Okta SSO with MFA for all cloud access, role-based permissions aligned with investment team structure), network security (private subnets, security groups, and WAF — no direct internet access for investment systems), audit logging (CloudTrail, VPC Flow Logs, and application-level audit logs — providing the comprehensive audit trail required by NYDFS), penetration testing (quarterly penetration testing of cloud infrastructure — documented and reported per NYDFS examination requirements), and encryption key management (AWS KMS with customer-managed keys — the firm controlled encryption keys, not AWS). (5) Client reporting: cloud-native reporting platform — portfolio data, market data, and accounting data combined in Snowflake, with automated report generation through cloud-based processing. Reporting cycle: from overnight batch (reports available 9am) to continuous processing (reports available within 2 hours of market close). Client portal: cloud-hosted client portal providing self-service access to reports, performance analytics, and portfolio data — replacing email-based report distribution. Interactive analytics: clients accessed interactive dashboards (attribution, risk decomposition, exposure analysis) rather than static PDF reports.

Data centre costs: from $12M/year (data centre lease, power, cooling, hardware maintenance) to $4.8M/year (cloud + downsized colocation) — $7.2M annual savings. Hardware refresh: avoided $8M capital expenditure for server refresh that was scheduled for the following year. Analytics performance: backtests completing 35% faster with access to 3,000+ cores (from 1,200 on-premises). Research team productivity increased by 40% — faster iteration on strategy development and risk analysis. Spot instance usage reduced analytics compute costs by 60% — from $3.2M on-demand equivalent to $1.3M actual. Trading operations: zero impact — market data and execution infrastructure maintained existing performance in the downsized colocation facility. Direct Connect provided consistent, low-latency connectivity between on-premises and cloud. NYDFS compliance: passed NYDFS examination with zero findings related to cloud infrastructure. The examiner noted the comprehensive security architecture and audit capabilities as exemplary. Client reporting: reports available within 2 hours of market close (from next morning). Client portal adoption: 78% of institutional clients using self-service portal within 6 months. Client satisfaction with reporting improved from 3.8/5 to 4.6/5. Operational resilience: cloud-based DR providing 4-hour RPO and 2-hour RTO (from 24-hour RPO with the previous tape-based backup system). Multi-AZ deployment providing 99.99% availability for cloud-hosted systems. Annual value: $7.2M (infrastructure savings — data centre cost reduction), $5.8M (analytics productivity — faster research iteration and strategy development driving better investment performance), $3.2M (client retention — improved reporting driving client satisfaction and retention of $45B AUM), $2.4M (operational efficiency — automated infrastructure management, eliminated hardware maintenance, and reduced IT staffing), $1.8M (avoided capex — eliminated hardware refresh and ongoing procurement cycles) = $20.4M. Development cost: $680,000. Payback: under 13 days.