Leading SOC 2 Type 2 without a compliance team

The situation

Our platform handled loan data for regional banks with up to $44B in assets. Banks that size run every vendor through due diligence, and the largest ones expected a SOC 2 Type 2 report before they would sign.

The problem

We had no dedicated security or compliance staff. The same three engineers who built the product would have to write the policies, put the controls in place and keep them running for the whole audit period, without stopping product work. A Type 2 report doesn't check that controls exist on paper; it checks that they ran, every time, for months.

What I did

• Built the audit trail into the product itself. Approval routing captured a point-in-time snapshot of each deal, so approvers signed off on exactly what was submitted and auditors had a permanent record without anyone assembling one by hand.
• Led the certification from start to finish: wrote the policies and controls, then made sure the platform and our process actually followed them.
• Made the evidence a side effect of normal work. Snyk dependency scanning in the pipeline and centralized logging and alerting were good practice on their own, and they also produced the records the auditor asked for.
• Managed the third-party audit.
• Represented the company in bank due diligence, completing security questionnaires and joining vendor-risk reviews with prospective clients.

The result

We earned SOC 2 Type 2 certification, which opened the door to the company's largest bank contracts. Security reviews with prospective banks became something I could answer from what we already had, instead of a scramble.

Need something like this? See the SOC 2 readiness package.