DevOps Services in Dublin

Financial Services / Asset Management

An IFSC-based asset management firm (EUR 22B AUM, 280 employees, CBI-regulated) managed its technology infrastructure through a combination of manual deployment processes and ad-hoc automation scripts maintained by 3 senior engineers. The firm operated 28 production applications (portfolio management, trading, risk, compliance, client reporting, and operations) across on-premises and cloud infrastructure. The problems: (1) Deployment risk -- deployments were executed manually by senior engineers, with no standardised process. Each deployment was unique, dependent on the deploying engineer's knowledge of the specific application. Deployment failures occurred in approximately 12% of releases, with rollback procedures poorly documented. (2) Change management gap -- the CBI had flagged the firm's IT change management process during a PRISM review: changes lacked formal approval workflows, testing evidence was inconsistent, and deployment records were incomplete. The CBI expected material improvement within 6 months. (3) DORA readiness -- DORA required ICT risk management, incident reporting, resilience testing, and third-party risk management. The firm had no resilience testing program, incident classification was informal, and disaster recovery procedures had not been tested in 14 months. (4) Key person dependency -- the 3 senior engineers who managed deployments held critical knowledge about system configurations, deployment procedures, and infrastructure architecture. Two of the three were over 50, and the firm had no documented succession plan for their knowledge. (5) The firm needed to transform its deployment practices from manual and ad-hoc to automated, governed, and DORA-compliant within 6 months to satisfy CBI expectations.

We implemented a DORA-compliant DevOps platform over 16 weeks: (1) CI/CD Pipeline Engineering -- built standardised CI/CD pipelines (using GitLab CI) for all 28 production applications: automated build, automated testing (unit, integration, regression), security scanning (SAST, dependency vulnerability scanning), and automated deployment to staging and production environments. Each pipeline produced a complete deployment record: who approved the change, what tests passed, what configuration changed, and when the deployment completed. (2) Change Management Automation -- embedded CBI-compliant change approval workflows in the deployment pipeline: change requests were automatically generated from merge requests, categorised by risk (standard, significant, emergency), and routed to appropriate approvers. Standard changes followed pre-approved processes. Significant changes required CAB (Change Advisory Board) review. Emergency changes followed expedited approval with post-implementation review. All approvals, test results, and deployment logs were captured in an audit-ready format. (3) Infrastructure-as-Code -- all infrastructure (servers, networking, databases, monitoring) was codified in Terraform, eliminating manual configuration and key-person dependency. Infrastructure changes went through the same CI/CD pipeline as application changes: code review, automated testing, approval, and documented deployment. Configuration drift detection alerted the team when infrastructure deviated from the defined state. (4) DORA Resilience Framework -- implemented the DORA operational resilience requirements: ICT asset inventory (all systems documented with criticality classification), disaster recovery automation (automated failover testing for critical systems quarterly), incident management (classification, escalation, CBI notification procedures, and post-incident review), and third-party risk management (monitoring cloud provider SLAs and incident notifications). (5) Observability Platform -- deployed comprehensive monitoring (Datadog): application performance metrics, infrastructure health, security events, deployment metrics (frequency, failure rate, mean time to recovery), and automated alerting with on-call rotation. Dashboards provided visibility for operations, management, and CBI reporting. (6) Knowledge Documentation -- all deployment procedures, infrastructure configurations, and operational runbooks were documented in a team wiki, eliminating the key-person dependency. Runbook-driven operations enabled any qualified team member to manage deployments and respond to incidents.

Deployment failure rate decreased from 12% to 1.8% -- automated pipelines eliminated the manual errors that caused most deployment failures. Deployment frequency increased from 2 per month (batch releases) to 4 per week (smaller, safer releases). Mean time to recovery improved from 4.2 hours to 38 minutes as automated rollback and documented runbooks replaced ad-hoc recovery. CBI change management: the firm passed its 6-month CBI review with IT change management noted as materially improved. The standardised approval workflows, testing evidence, and deployment records satisfied CBI expectations. DORA compliance was achieved: ICT asset inventory, incident management procedures, resilience testing program, and third-party risk management were all operational -- 10 months ahead of the DORA compliance deadline. Key-person dependency was eliminated: infrastructure-as-code and documented runbooks enabled the firm to hire 2 mid-level engineers who were independently productive within 4 weeks, compared to the 6+ months previously required. The firm estimated annual value at EUR 1.6M: EUR 0.6M in deployment efficiency and reliability (reduced failures, faster deployments, lower recovery time), EUR 0.4M in CBI compliance (avoided potential supervisory actions and remediation costs), EUR 0.3M in DORA readiness (early compliance reducing future remediation burden), and EUR 0.3M in key-person risk reduction (documented procedures reducing organizational risk). The platform was extended to include automated performance testing and chaos engineering exercises.