Banking · Commercial bank · regulated under DORA and BAIT

Hybrid cloud platform and security architecture for a commercial bank under DORA and BAIT

Founder's project experience: Bastian Wenske led this project before founding WCS.

The columned stone facade of a classic bank building in early morning light, a pedestrian walking past in the distance.

Duration: 2.5 years
Role: Platform and security architecture
Frameworks: DORA, BAIT, ISO 27001
Operations: 24/7

Situation

A commercial bank regulated under the Digital Operational Resilience Act (DORA) and BAIT, the German supervisory requirements for IT in banks, had acquired a fintech. Its containerised core applications had to be brought under the bank’s security and governance architecture. In parallel, the bank’s enterprise architecture needed a platform model for secure communication between services and a plan for moving existing applications to the cloud.

Approach

Between December 2022 and June 2025, Bastian Wenske, now managing director of WCS, was responsible for platform and security architecture in two consecutive projects.

Fintech integration: realignment of the cloud security and governance architecture, set-up of a Cloud Centre of Excellence and migration of the containerised core applications into Azure landing zones.
Secure delivery and operations: security reporting pipelines, shift-left practices with SAST and threat modelling, and 24/7 operations on AKS with observability and incident response.
Platform architecture: Azure API Management with mutual TLS (mTLS) across platform boundaries between AKS, ingress and Key Vault, and a workload identity model in Entra ID for applications in AKS.
Secrets and roadmap: secret management with managed identities and several Key Vaults, a cloud placement strategy and a refactoring roadmap for existing applications.

Result

The fintech’s core applications run in the bank’s Azure landing zones under the same governance as the rest of the platform, with 24/7 operations on AKS. Communication across platform boundaries is authenticated with mTLS. Applications in AKS authenticate through Entra ID workload identities and managed identities, with secrets held in Key Vault. The cloud placement strategy and refactoring roadmap set out where existing applications belong and in which order they are reworked. This experience from regulated banking now feeds into the mandates of WCS.