DevOps Services in Zurich, Switzerland

Banking / Financial Services

A Zurich-based private bank with CHF 12 billion in assets under management had a technology team of 35 engineers maintaining: a core banking platform (Java monolith on on-premises servers), a client-facing wealth management portal (React application deployed to a Swiss colocation facility), and 12 internal tools (portfolio analytics, compliance reporting, client onboarding — a mix of Python, .NET, and legacy VBA applications). The deployment process: developers wrote code on local machines, committed to an on-premises GitLab, then raised a change request. The IT operations team (4 people) manually reviewed the change, scheduled a deployment window (Thursday evenings — the bank's designated change window), and deployed using scripts that were maintained in a shared folder (not version-controlled). Production deployments took 4-6 hours, during which the client portal was unavailable. Problems: (1) Deployment frequency: 2 deployments per month (forced by the manual process and limited change windows). Feature requests from the wealth management team waited 6-8 weeks from completion to production — the bank was losing competitiveness because competitors were shipping features weekly. (2) Failed deployments: 30% of deployments required rollback (typically due to configuration differences between the development environment and production — "it worked on my machine"). Each failed deployment meant: the team worked until 2-3 AM fixing the issue, the client portal remained down until the fix was deployed, and the incident had to be documented and reported to FINMA as a service disruption. (3) FINMA audit findings: the most recent FINMA IT audit identified 4 findings: insufficient change documentation (the change request system had free-text descriptions that were often incomplete), no automated testing before deployment (testing was manual and selective), no evidence of rollback testing (the bank could not prove that rollback procedures worked), and configuration management gaps (no systematic tracking of infrastructure configuration — the operations team relied on institutional knowledge). The bank had 12 months to remediate these findings before the next FINMA review.

We transformed the bank's DevOps over 16 weeks: (1) CI/CD pipeline: replaced the manual deployment process with an automated pipeline on GitLab CI (self-hosted on the bank's Swiss infrastructure — no code or artifacts leave Switzerland). The pipeline runs: automated build and unit tests (triggered on every commit — build failures are caught within minutes, not discovered on deployment night), integration tests (running against a staging environment that mirrors production — including database schema, sample data, and configuration), security scanning (Semgrep for static analysis, Trivy for dependency vulnerabilities, GitLeaks for secrets detection — any critical or high severity finding blocks deployment), FINMA compliance checks (automated verification that: the linked change ticket exists and is approved, the deployment target is a Swiss-hosted environment, required approvals are recorded, and the deployment artifact SHA matches the tested artifact), and automated deployment (blue-green deployment — the new version deploys alongside the current version, traffic switches only after health checks pass, and the previous version remains available for instant rollback). (2) Infrastructure as Code: the bank's infrastructure was manually configured (the operations team knew how the servers were set up, but this knowledge existed only in their heads and in scattered documentation). We codified everything in Terraform: compute infrastructure (VMs, networking, load balancers, firewalls), database configuration (PostgreSQL parameters, backup schedules, replication settings), monitoring infrastructure (Prometheus, Grafana, Loki — all Swiss-hosted), and DR infrastructure (standby environment in the Geneva datacenter — previously set up manually once per year for DR testing, now continuously synchronized through Terraform). (3) Environment parity: created identical development, staging, and production environments using the same Terraform modules. Developers run the application in Docker containers that match the production runtime. Configuration differences between environments are managed through environment-specific variable files — the application code is identical across all environments. This eliminated the "it worked on my machine" problem: if it works in the CI pipeline, it works in production. (4) Change management automation: integrated the CI/CD pipeline with the bank's ServiceNow instance. The workflow: developer creates a merge request → code review and automated tests run → reviewer approves → a change ticket is automatically created in ServiceNow with: description of changes (generated from commit messages and merge request description), test results summary (automated test report attached), risk assessment (automated — based on what areas of the codebase changed), and rollback plan (automated — the previous deployment is tagged and the rollback command is documented). The change ticket routes to the designated approver based on risk level: low-risk changes (non-customer-facing, no data model changes) → auto-approved after automated checks pass. Medium-risk changes → team lead approval. High-risk changes (database migrations, security-sensitive, customer-facing) → CTO approval. This replaced the manual change advisory board that met weekly and processed change requests in bulk. (5) Monitoring and alerting: deployed a comprehensive observability stack: application metrics (response times, error rates, throughput — per endpoint), infrastructure metrics (CPU, memory, disk, network — per server), business metrics (login success rate, transaction processing time, portfolio calculation completion — the metrics that matter to the bank, not just the infrastructure), log aggregation with structured logging (every log entry includes: timestamp, service name, correlation ID, user context — enabling rapid incident investigation), and automated alerting (critical alerts → PagerDuty → on-call engineer's Swiss mobile number; warning alerts → Slack channel for morning review).

Deployment frequency: 2 per month → 12 per month (6x increase). The Thursday deployment window was eliminated — deployments happen during business hours with zero downtime (blue-green deployment). Feature time-to-production: 6-8 weeks → 1-2 weeks. The wealth management team receives features 4x faster. Failed deployments: 30% rollback rate → 3% rollback rate. The 3% remaining failures are caught by automated health checks and rolled back within 2 minutes — compared to the previous 4-6 hour manual rollback process. Client portal availability: 99.2% → 99.95%. Zero unplanned downtime events in the 6 months since transformation (previously: 2-3 unplanned outages per quarter from failed deployments). FINMA audit remediation: all 4 findings addressed. The automated pipeline produces the documentation FINMA requires as a byproduct of normal operation — change documentation, test evidence, rollback testing, and configuration management are all automated. The follow-up FINMA review closed all findings with commendation for the automated compliance approach. Operations team reallocation: the 4-person operations team previously spent 60% of their time on manual deployments and fire-fighting. Post-transformation, they spend 80% of their time on infrastructure improvement and security hardening — the manual deployment work was eliminated. Annual cost impact: reduced downtime (estimated CHF 50,000/hour for the client portal × reduced hours of outage) and operational efficiency improvement save approximately CHF 480,000/year. Transformation cost: CHF 280,000. Payback period: 7 months.