DevTools · Cloud & Infrastructure · 200–1000 · North America #b015_07

Context

We are an independent infrastructure cloud offering virtual machines, bare metal and accelerator instances in many regions, competing on price against the large providers.

Industry

DevTools & Software · Cloud & Infrastructure

Size

200–1000 employees

Region

North America

Tools budget

$5K–20K per month

Needs

Audit evidence collection. Publishing compliance artifacts for both our platform and data center partners requires collecting evidence from many sources by hand.

Today: a compliance analyst reporting to a governance director, using general-purpose GRC platforms · Urgency: now

Application security & code scanning. Security scanning in our build pipelines is uneven, so risky images and dependencies sometimes ship before anyone reviews them.

Today: a devsecops engineer embedding scanning and policy checks into delivery pipelines · Urgency: this year

Cloud security posture. We need hardening baselines for host images and clusters enforced continuously rather than checked occasionally.

Today: a security architect hardening images, hosts and clusters against framework control mappings · Urgency: later

Who decides

head of compliance · security review

Expects from suppliers

Policy checks that run inside our existing pipelines; Baselines for hardened virtual machine images; Reports mapping findings to payment-card and attestation controls

Not a fit

Scanners that flood teams with unprioritised alerts; Agents that degrade customer workload performance

Stack

CI/CD pipeline in place, Kubernetes, on-prem / private cloud, compliance tooling in place

Buying triggers

security incident risk, upcoming audit or certification