DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

project #1: Company: *FinTrust Bank (digital banking platform) your role: πŸ‘‰ Site Reliability Engineer (SRE)

What bank do:

  • Online banking (accounts, transfers, payments)
  • Mobile + web applications
  • Real-time transactions
  • Strict security & compliance (PCI-DSS, encryption)

πŸ‘©β€πŸ’» YOUR ROLE

Title:

πŸ‘‰ Site Reliability Engineer (SRE)

Your responsibility

  • Ensure 99.99% uptime
  • Protect sensitive financial data
  • Prevent unauthorized access
  • Ensure low latency transactions
  • Handle incidents quickly
  • Maintain secure architecture

πŸ—οΈ PROJECT NAME

πŸ‘‰ Secure Multi-Tier Banking Infrastructure on AWS with High Availability and Zero-Trust Networking

🧠 CORE IDEA

Banking system MUST:

βœ” Never expose database
βœ” Encrypt all traffic
βœ” Restrict access strictly
βœ” Handle failures instantly
βœ” Be fully observable
βœ” Support multi-region design
Enter fullscreen mode Exit fullscreen mode

πŸ—οΈ ARCHITECTURE 

User (Mobile / Web)
   ↓
DNS (:contentReference[oaicite:0]{index=0})
   ↓
:contentReference[oaicite:1]{index=1} + Shield
   ↓
CloudFront (CDN + TLS)
   ↓
Application Load Balancer (DMZ / Public)
   ↓
App Layer (Private Subnets)
   ↓
Transaction Services (Private)
   ↓
Database (Private DB Subnet, encrypted)
Enter fullscreen mode Exit fullscreen mode

πŸ” SECURITY (MOST IMPORTANT FOR BANK)

What you implemented

1. Network isolation

  • VPC with private architecture
  • No public IPs for app or DB
  • Only ALB exposed

2. Firewall design

  • ALB SG β†’ allow 443 from internet
  • App SG β†’ allow only from ALB
  • DB SG β†’ allow only from app

πŸ‘‰ Zero trust model

3. Encryption

  • HTTPS everywhere (TLS)
  • DB encryption (at rest)
  • Secrets stored securely

4. WAF protection

  • blocked SQL injection
  • blocked bots
  • rate limiting

🌐 NETWORKING (WHAT YOU BUILT)

VPC design 

10.0.0.0/16
Enter fullscreen mode Exit fullscreen mode

Subnets:

Public (DMZ):
- ALB
- NAT

Private App:
- Banking APIs

Private DB:
- RDS (transactions)
Enter fullscreen mode Exit fullscreen mode

Routing

Public route table:

0.0.0.0/0 β†’ IGW
Enter fullscreen mode Exit fullscreen mode

Private route table:

0.0.0.0/0 β†’ NAT
Enter fullscreen mode Exit fullscreen mode

DB route table:

NO internet access
Enter fullscreen mode Exit fullscreen mode

Private access

Used:

  • VPC Endpoint for S3
  • VPC Endpoint for Secrets Manager

πŸ‘‰ No internet dependency

βš–οΈ HIGH AVAILABILITY (BANK REQUIREMENT)

  • Multi-AZ deployment
  • ALB distributes traffic
  • Auto Scaling enabled

Failure handling

If one AZ fails:

Traffic shifts automatically
Enter fullscreen mode Exit fullscreen mode

πŸ“‘ MULTI-VPC / ENTERPRISE DESIGN

You designed:

  • Core banking VPC
  • Shared services VPC

Connected using:

  • VPC Peering
  • AWS Transit Gateway

πŸ”’ PRIVATELINK (VERY STRONG POINT)

Used:

  • AWS PrivateLink

Use case:

  • internal fraud detection API exposed privately

πŸ‘‰ No full VPC exposure

🏒 HYBRID (REAL BANKING)

Bank has on-prem systems:

  • legacy transaction systems

Connected using:

  • VPN
  • Direct Connect (concept)

πŸ“Š OBSERVABILITY (SRE CORE)

You implemented:

  • CloudWatch metrics
  • ALB access logs
  • VPC Flow Logs

What you monitor

  • latency
  • error rate
  • traffic spikes
  • blocked requests
  • DB connections

🚨 INCIDENTS YOU HANDLED

Example 1 β€” Payment API down

  • ALB 503
  • found unhealthy targets
  • restarted service
  • fixed health check

Example 2 β€” Transaction delay

  • high latency detected
  • traced to DB slow query
  • optimized query

Example 3 β€” Security alert

  • WAF blocked traffic spike
  • identified bot attack
  • tuned rules

Example 4 β€” Private EC2 lost internet

  • NAT route missing
  • fixed route table

Example 5 β€” DNS misrouting

  • wrong ALB target
  • updated Route 53

πŸ§‘β€πŸ€β€πŸ§‘ TEAM STRUCTURE

  • 2 SREs
  • 5 backend engineers
  • 2 frontend engineers
  • 1 security engineer
  • 1 DevOps/platform engineer

🀝 YOUR COLLABORATION

You worked with:

  • backend β†’ debugging API failures
  • security β†’ WAF rules, compliance
  • DevOps β†’ deployments
  • product β†’ outage impact

πŸ“… YOUR DAILY WORK

Morning:

  • check dashboards
  • review alerts

During day:

  • fix incidents
  • optimize performance
  • deploy updates

On-call:

  • respond to outages
  • troubleshoot quickly

πŸ† YOUR ACHIEVEMENTS

You can say:

  • achieved 99.99% uptime
  • reduced downtime by resolving recurring issues
  • secured architecture (no public DB)
  • improved performance
  • reduced costs using VPC endpoints

πŸ’¬ STRONG INTERVIEW ANSWER

Say this:

β€œI worked as an SRE on a banking platform where I designed and maintained a secure multi-tier AWS architecture. I implemented private networking using VPC, subnets, and NAT Gateway, and ensured that only the load balancer was exposed publicly. I secured communication using security groups and WAF, and placed the database in isolated private subnets with no internet access. I integrated DNS using Route 53 and implemented private access to AWS services using VPC endpoints. I also designed multi-VPC connectivity using Transit Gateway and PrivateLink for secure service exposure. As part of my SRE responsibilities, I monitored system health using CloudWatch and logs, handled incidents such as load balancer failures and database connectivity issues, and ensured high availability and performance for critical banking transactions.”

πŸ”₯ WHY THIS PROJECT IS POWERFUL

Because it shows:

βœ” Security (bank-level)
βœ” Networking (deep)
βœ” Reliability (SRE core)
βœ” Real-world scenarios
βœ” Troubleshooting

Top comments (0)