DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

project #1: Company: *FinTrust Bank (digital banking platform) your role: 👉 Site Reliability Engineer (SRE)

What bank do:

  • Online banking (accounts, transfers, payments)
  • Mobile + web applications
  • Real-time transactions
  • Strict security & compliance (PCI-DSS, encryption)

👩‍💻 YOUR ROLE

Title:

👉 Site Reliability Engineer (SRE)

Your responsibility

  • Ensure 99.99% uptime
  • Protect sensitive financial data
  • Prevent unauthorized access
  • Ensure low latency transactions
  • Handle incidents quickly
  • Maintain secure architecture

🏗️ PROJECT NAME

👉 Secure Multi-Tier Banking Infrastructure on AWS with High Availability and Zero-Trust Networking

🧠 CORE IDEA

Banking system MUST:

✔ Never expose database
✔ Encrypt all traffic
✔ Restrict access strictly
✔ Handle failures instantly
✔ Be fully observable
✔ Support multi-region design
Enter fullscreen mode Exit fullscreen mode

🏗️ ARCHITECTURE 

User (Mobile / Web)
   ↓
DNS (:contentReference[oaicite:0]{index=0})
   ↓
:contentReference[oaicite:1]{index=1} + Shield
   ↓
CloudFront (CDN + TLS)
   ↓
Application Load Balancer (DMZ / Public)
   ↓
App Layer (Private Subnets)
   ↓
Transaction Services (Private)
   ↓
Database (Private DB Subnet, encrypted)
Enter fullscreen mode Exit fullscreen mode

🔐 SECURITY (MOST IMPORTANT FOR BANK)

What you implemented

1. Network isolation

  • VPC with private architecture
  • No public IPs for app or DB
  • Only ALB exposed

2. Firewall design

  • ALB SG → allow 443 from internet
  • App SG → allow only from ALB
  • DB SG → allow only from app

👉 Zero trust model

3. Encryption

  • HTTPS everywhere (TLS)
  • DB encryption (at rest)
  • Secrets stored securely

4. WAF protection

  • blocked SQL injection
  • blocked bots
  • rate limiting

🌐 NETWORKING (WHAT YOU BUILT)

VPC design 

10.0.0.0/16
Enter fullscreen mode Exit fullscreen mode

Subnets:

Public (DMZ):
- ALB
- NAT

Private App:
- Banking APIs

Private DB:
- RDS (transactions)
Enter fullscreen mode Exit fullscreen mode

Routing

Public route table:

0.0.0.0/0 → IGW
Enter fullscreen mode Exit fullscreen mode

Private route table:

0.0.0.0/0 → NAT
Enter fullscreen mode Exit fullscreen mode

DB route table:

NO internet access
Enter fullscreen mode Exit fullscreen mode

Private access

Used:

  • VPC Endpoint for S3
  • VPC Endpoint for Secrets Manager

👉 No internet dependency

⚖️ HIGH AVAILABILITY (BANK REQUIREMENT)

  • Multi-AZ deployment
  • ALB distributes traffic
  • Auto Scaling enabled

Failure handling

If one AZ fails:

Traffic shifts automatically
Enter fullscreen mode Exit fullscreen mode

📡 MULTI-VPC / ENTERPRISE DESIGN

You designed:

  • Core banking VPC
  • Shared services VPC

Connected using:

  • VPC Peering
  • AWS Transit Gateway

🔒 PRIVATELINK (VERY STRONG POINT)

Used:

  • AWS PrivateLink

Use case:

  • internal fraud detection API exposed privately

👉 No full VPC exposure

🏢 HYBRID (REAL BANKING)

Bank has on-prem systems:

  • legacy transaction systems

Connected using:

  • VPN
  • Direct Connect (concept)

📊 OBSERVABILITY (SRE CORE)

You implemented:

  • CloudWatch metrics
  • ALB access logs
  • VPC Flow Logs

What you monitor

  • latency
  • error rate
  • traffic spikes
  • blocked requests
  • DB connections

🚨 INCIDENTS YOU HANDLED

Example 1 — Payment API down

  • ALB 503
  • found unhealthy targets
  • restarted service
  • fixed health check

Example 2 — Transaction delay

  • high latency detected
  • traced to DB slow query
  • optimized query

Example 3 — Security alert

  • WAF blocked traffic spike
  • identified bot attack
  • tuned rules

Example 4 — Private EC2 lost internet

  • NAT route missing
  • fixed route table

Example 5 — DNS misrouting

  • wrong ALB target
  • updated Route 53

🧑‍🤝‍🧑 TEAM STRUCTURE

  • 2 SREs
  • 5 backend engineers
  • 2 frontend engineers
  • 1 security engineer
  • 1 DevOps/platform engineer

🤝 YOUR COLLABORATION

You worked with:

  • backend → debugging API failures
  • security → WAF rules, compliance
  • DevOps → deployments
  • product → outage impact

📅 YOUR DAILY WORK

Morning:

  • check dashboards
  • review alerts

During day:

  • fix incidents
  • optimize performance
  • deploy updates

On-call:

  • respond to outages
  • troubleshoot quickly

🏆 YOUR ACHIEVEMENTS

You can say:

  • achieved 99.99% uptime
  • reduced downtime by resolving recurring issues
  • secured architecture (no public DB)
  • improved performance
  • reduced costs using VPC endpoints

💬 STRONG INTERVIEW ANSWER

Say this:

“I worked as an SRE on a banking platform where I designed and maintained a secure multi-tier AWS architecture. I implemented private networking using VPC, subnets, and NAT Gateway, and ensured that only the load balancer was exposed publicly. I secured communication using security groups and WAF, and placed the database in isolated private subnets with no internet access. I integrated DNS using Route 53 and implemented private access to AWS services using VPC endpoints. I also designed multi-VPC connectivity using Transit Gateway and PrivateLink for secure service exposure. As part of my SRE responsibilities, I monitored system health using CloudWatch and logs, handled incidents such as load balancer failures and database connectivity issues, and ensured high availability and performance for critical banking transactions.”

🔥 WHY THIS PROJECT IS POWERFUL

Because it shows:

✔ Security (bank-level)
✔ Networking (deep)
✔ Reliability (SRE core)
✔ Real-world scenarios
✔ Troubleshooting

Top comments (0)