Introduction
A leading recruitment technology platform serving millions of job seekers and recruiters across India partnered with DevSecCops.ai to completely modernize its infrastructure. The goal: migrate from a legacy monolithic architecture to a cloud-native AWS platform capable of supporting rapid feature delivery, high availability, and enterprise-grade security.
Here is the engagement at a glance, followed by the key takeaways.
| Client | A recruitment technology platform serving millions of job seekers and recruiters across India (anonymised) |
|---|---|
| Starting point | A legacy monolith, manual releases taking 6 to 8 hours, credentials in plaintext configuration files and limited observability |
| Target platform | Multi-AZ AWS, Amazon EKS for containers, GitOps delivery with ArgoCD |
| Security approach | Automated scanning in the pipeline, KMS encryption, Secrets Manager, admission policies with OPA Gatekeeper, GuardDuty and CloudTrail |
| Services | Cloud migration, Kubernetes platform engineering, DevSecOps, SOC 2 readiness |
| Headline results | Deployment cycle from 6 to 8 hours to under 15 minutes, 99.95% availability, 45% lower cloud infrastructure cost, SOC 2 Type II audit completed 3 months ahead of schedule |
Key Takeaways
- Moving from a monolith to Amazon EKS with GitOps cut the deployment cycle from 6 to 8 hours to under 15 minutes.
- Security was built into the pipeline and the cluster from the start, which helped the client complete its SOC 2 Type II audit ahead of schedule.
- Spot capacity, right-sizing and leaner logging reduced cloud infrastructure costs by 45%.
- Multi-AZ design and automated failover took availability to 99.95%.
- The same approach suits any team that needs to scale, ship faster and satisfy enterprise security reviews.
The Challenge
- Monolithic architecture unable to scale horizontally during hiring season traffic spikes.
- Manual deployment processes causing 6-8 hour release cycles with frequent rollback incidents.
- No centralized secrets management — credentials stored in plaintext configuration files.
- Limited observability making root cause analysis slow and error-prone.
- Security posture not aligned with SOC 2 requirements needed for enterprise customer contracts.
How we approached it: four phases. The five problems above were linked, so we fixed them in an order where each step made the next one safer.
| Phase | Focus | What we did | What it unlocked |
|---|---|---|---|
| 1. Assess and baseline | Understand the starting point | Reviewed the monolith, the manual release process, how credentials were stored, what could be observed and where the platform fell short of SOC 2 | A clear list of risks and a plan ranked by impact |
| 2. Build the foundation | Secure, repeatable base | Created the multi-AZ VPC and the EKS clusters, moved credentials into AWS Secrets Manager with KMS encryption, and began clearing the security findings backlog | A safe place to run workloads, and the first risks closed |
| 3. Migrate and automate | Faster, safer delivery | Built the CI/CD pipeline with automated scanning, adopted GitOps with ArgoCD, set up blue/green releases and autoscaling | Releases in minutes instead of hours, with no downtime |
| 4. Prove and hand over | Evidence and visibility | Set up monitoring, dashboards and alerting, and gathered the controls and evidence needed for the SOC 2 Type II audit | Faster root-cause analysis and an audit completed ahead of schedule |
Solution Overview
- Multi-AZ AWS VPC architecture with tiered public, private, and intra subnets.
- Amazon EKS for containerized workload orchestration with GitOps delivery via ArgoCD.
- Comprehensive CI/CD pipeline with automated security scanning at each stage.
- Centralized secrets management using AWS Secrets Manager and KMS.
- Full observability stack with Prometheus, Grafana, and CloudWatch.
Technology stack at a glance. The full platform used the following tools, grouped by layer.
| Layer | Technology | Role |
|---|---|---|
| Edge | Cloudflare WAF, Amazon CloudFront, AWS WAF, AWS Certificate Manager | DDoS and bot protection, content delivery, API protection, certificate renewal |
| Compute | Amazon EKS with managed node groups, Horizontal Pod Autoscaler, Cluster Autoscaler, Karpenter | Container orchestration and automatic scaling, including Spot capacity |
| Delivery | GitHub Actions, Semgrep, Trivy, Amazon ECR, ArgoCD, Argo Rollouts | Build, scan, sign, store and deploy images with blue/green releases |
| Data | Amazon RDS PostgreSQL (Multi-AZ), read replicas, Amazon ElastiCache for Redis, Amazon S3 | Transactional data, analytics queries, caching and resume storage |
| Security | AWS KMS customer managed keys, AWS Secrets Manager, Secrets Store CSI Driver, IRSA, OPA Gatekeeper, GuardDuty, CloudTrail | Encryption, secrets, pod-level permissions, admission policy, threat detection and audit logs |
| Observability | Prometheus, Grafana, Fluent Bit, Amazon CloudWatch, PagerDuty | Metrics, dashboards, log routing and on-call alerts |
AWS Architecture
Traffic enters through Cloudflare WAF for edge protection, then routes to Amazon CloudFront for content delivery. An Application Load Balancer in public subnets distributes requests to EKS workloads running in private subnets across three Availability Zones. Amazon RDS PostgreSQL in Multi-AZ configuration handles transactional data, while ElastiCache Redis reduces database read pressure.
Each layer has one job: the edge filters hostile traffic before it reaches AWS, the load balancer spreads requests, EKS runs and scales the application across three Availability Zones, and the data layer keeps transactions safe while the cache takes read load off the database.
Edge Security & WAF
Cloudflare WAF provides Layer 7 DDoS protection and bot management at the edge. AWS WAF rules protect the API Gateway layer from SQL injection, XSS, and credential stuffing attacks. Certificate management handled via ACM with automated renewal.
Auto Scaling Strategy
Kubernetes Horizontal Pod Autoscaler (HPA) scales application pods based on CPU and custom business metrics. Cluster Autoscaler adds EC2 nodes when pod pending queues grow. Karpenter provisioner manages spot instance allocation, achieving 60% compute cost reduction versus on-demand-only configurations.
Kubernetes & EKS Configuration
EKS clusters deployed with managed node groups spanning three AZs. IRSA (IAM Roles for Service Accounts) provides pod-level AWS API permissions without instance-level credentials. OPA Gatekeeper enforces admission policies preventing privileged containers, missing resource limits, and unscanned images from deploying.
Key design decisions and trade-offs. Every architecture involves trade-offs — including our approach to Kubernetes consulting. These were the main choices on this platform and what we managed in return.
| Decision | Why we chose it | Trade-off we managed |
|---|---|---|
| Amazon EKS with managed node groups | AWS runs the control plane and handles node lifecycle, so the team spends less time on cluster upkeep | Less control over node internals, and regular version upgrades to plan |
| GitOps with ArgoCD | Git becomes the source of truth, every change is reviewed and recorded, and drift is corrected automatically | The team must work through pull requests and learn the Git-driven workflow |
| Spot capacity managed by Karpenter | Large compute savings versus on-demand-only nodes | Spot capacity can be interrupted, so workloads must tolerate it and a stable baseline is kept |
| Two layers of edge protection | Cloudflare filters hostile traffic first, and AWS WAF protects the API layer behind it | Two tools to configure, tune and monitor |
| Admission policies with OPA Gatekeeper | Unsafe workloads are blocked before they run | Policies need tuning, and teams need a clear exception process |
| IRSA for pod permissions | Each workload gets only the AWS access it needs, with no instance-wide credentials | A role must be designed for each service |
Data Architecture
Amazon RDS PostgreSQL Multi-AZ for primary transactional workloads. Read replicas dedicated to analytics and search queries. Amazon S3 with lifecycle policies for resume storage and archival. ElastiCache Redis clusters for session management and frequently accessed job listing data.
CI/CD & GitOps
GitHub Actions pipelines build container images, run SAST with Semgrep, scan dependencies with Trivy, and push signed images to Amazon ECR. ArgoCD monitors Git repository state and automatically reconciles cluster configuration. Blue/green deployments via ArgoCD Rollouts eliminate deployment downtime.
Security Controls
AWS KMS Customer Managed Keys encrypt data at rest across RDS, S3, and EBS volumes. AWS Secrets Manager stores and rotates credentials, injected into pods via the Secrets Store CSI Driver. GuardDuty monitors for anomalous API activity, exposed credentials, and cryptomining indicators. CloudTrail provides immutable audit logs for all AWS API calls.
How the controls map to SOC 2. The client needed SOC 2 for enterprise contracts. This table shows how the platform's controls line up with common SOC 2 areas, and what an auditor can sample as evidence.
| SOC 2 area | Control on this platform | Evidence an auditor can sample |
|---|---|---|
| Logical access | Pod-level permissions through IRSA, credentials held in Secrets Manager and rotated | Role definitions, secret rotation history |
| Change management | Every change flows through Git and the CI/CD pipeline, images are signed, ArgoCD reconciles the cluster to Git | Pull request history, pipeline runs, ArgoCD sync history |
| Vulnerability management | SAST with Semgrep, dependency scanning with Trivy, admission policy blocks unscanned images | Scan reports, blocked deployment records, findings backlog trend |
| Encryption | KMS customer managed keys across RDS, S3 and EBS | Key policies and encryption settings |
| Monitoring and incident response | GuardDuty, Prometheus, Grafana, CloudWatch and PagerDuty escalation policies | Alert history, on-call policies |
| Availability | Multi-AZ RDS and EKS across three Availability Zones, automated failover | Architecture records, uptime history |
| Audit logging | CloudTrail records for all AWS API calls | Log samples |
An independent CPA firm performs the SOC 2 audit and issues the report. Our role was to build the controls and gather the evidence as part of a broader cloud compliance program, so the audit could proceed smoothly.
Monitoring & Observability
Prometheus collects application and infrastructure metrics with 90-day retention. Grafana dashboards surface deployment frequency, error rates, and cost trends. Fluent Bit routes logs to CloudWatch with 30% reduction in log ingestion costs versus direct agent approaches. PagerDuty integration routes critical alerts with on-call escalation policies.
Business Outcomes
- Deployment cycle time reduced from 6-8 hours to under 15 minutes.
- Platform availability improved to 99.95% with Multi-AZ and automated failover.
- Cloud infrastructure costs reduced 45% through right-sizing and Spot instance adoption.
- SOC 2 Type II audit completed 3 months ahead of schedule.
- Engineering team velocity doubled — from 2 to 4+ deployments per day.
- Security findings backlog cleared within 6 weeks of engagement start.
Before and after. The same results, side by side.
| Area | Before | After |
|---|---|---|
| Deployment cycle | 6 to 8 hours | Under 15 minutes |
| Deployments per day | 2 | 4 or more |
| Releases | Manual, with frequent rollback incidents | Automated, with blue/green releases and no deployment downtime |
| Credentials | Plaintext configuration files | AWS Secrets Manager with rotation, injected into pods |
| Observability | Limited, with slow and error-prone root cause analysis | Prometheus, Grafana and CloudWatch with on-call alerting |
| Scaling | A monolith that could not scale horizontally in hiring season | EKS with pod and node autoscaling, including Spot capacity |
| SOC 2 | Security posture not aligned with SOC 2 requirements | SOC 2 Type II audit completed 3 months ahead of schedule |
| Availability | Not disclosed | 99.95% |
| Cloud infrastructure cost | Not disclosed | 45% lower |
Lessons Learned
- Fix credentials first. Plaintext credentials are the quickest high-impact risk to close. Moving them into a managed secrets store early reduces exposure and makes later audits simpler.
- Make releases safe before making them fast. Blue/green releases and easy rollback give teams the confidence to ship often, so speed follows.
- Put policy where it cannot be skipped. Admission policies stop unsafe workloads from running, whoever deploys them.
- Treat cloud cost optimization as a design input. Spot capacity, right-sizing and leaner logging were part of the design from the start, not a clean-up job later.
- Collect audit evidence as you go. Git history, pipeline runs and cluster records produce the evidence auditors ask for without a separate project.
- Keep progress visible. Dashboards for deployment frequency, error rates and cost trends show the team and the business what is improving.
Conclusion
This transformation demonstrates that cloud-native modernization, when executed with a security-first approach, delivers compounding returns: faster delivery, lower costs, stronger compliance, and a platform that continues to improve as engineering teams adopt GitOps and platform engineering practices.
Planning a similar move to AWS and Kubernetes? Start with a free assessment of your architecture, pipelines and security posture. Book a Free DevOps Assessment →
Cloud-Native AWS Migration FAQ
Q01What is a cloud-native transformation?
It is the move from a single large application on fixed servers to containerised services built for the cloud. Delivery is automated, scaling happens on demand, and security and observability are part of the platform. In this project, a monolith became a platform on Amazon EKS with GitOps delivery.
Q02How long does a monolith to EKS migration take?
It depends on the size of the application, the number of services and the starting security posture. We usually agree phases and milestones after an assessment, so each stage delivers something working.
Q03Why use Amazon EKS and GitOps?
EKS gives you managed Kubernetes on AWS, so your team spends less time running the control plane. GitOps with ArgoCD makes Git the single source of truth, so every change is reviewed, recorded and reversible, and the cluster corrects itself if it drifts.
Q04How does Karpenter help reduce cloud costs?
Karpenter adds right-sized nodes when workloads need them and can use Spot capacity, which is priced below on-demand capacity. Workloads must tolerate interruptions, so a stable baseline is usually kept. On this platform, Spot adoption was a major part of the compute savings.
Q05How do you migrate without downtime?
We shift traffic in stages and use blue/green releases, so the new version runs next to the old one and can be rolled back instantly. On this platform, blue/green deployments with ArgoCD Rollouts removed deployment downtime.
Q06How do you secure a CI/CD pipeline on AWS?
We scan code and dependencies on every build, sign images, keep credentials in a managed secrets store, apply least-privilege permissions to each workload, and block unscanned or unsafe images with admission policy. Logs and audit trails record who changed what.
Q07How do you prepare for SOC 2 on AWS?
We build the controls an auditor samples, such as change records, access control, encryption, monitoring and audit logs, and gather the evidence automatically. An independent CPA firm performs the audit and issues the report, so we support readiness and do not certify.
Q08Do we have to rebuild our tools to work with you?
No. We work with the tools you already use where they fit, and recommend changes only where they remove a real risk or bottleneck.
Planning a similar migration? Explore our cloud migration services and DevSecOps consulting, see more case studies, read our guide to AI-driven cloud cost optimization or AI reliability engineering, or Book a Free DevOps Assessment →.
