How Buoyant Cloud helped a growing SaaS company modernize its software delivery process with secure CI/CD, GitOps, and enterprise-grade DevSecOps controls on Google Cloud.
AT A GLANCE
Industry: B2B SaaS
Platform: Google Cloud (GKE, Terraform, GitHub Actions, Argo CD, Helm)
Security Tooling: SonarQube, Checkmarx, Black Duck, Synk
Services Delivered: DevSecOps, Platform Engineering, CI/CD Modernization
Location: Canada
Engagement led by Amit Malhotra, Principal GCP Architect at Buoyant Cloud Inc. — Toronto, Canada
The Business Problem
A growing SaaS company had built a functional product and engineering team — but its software delivery practices had not matured alongside the business.
As release velocity increased, the security team began identifying gaps across the CI/CD process, code quality controls, secrets handling, and deployment governance. At the same time, the engineering team was feeling increasing friction: deployments were inconsistent, rollback paths were unclear, and production releases carried unnecessary operational risk.
The company was also preparing for SOC 2 readiness, making delivery security and auditability more urgent.
What worked for an early-stage product was now becoming a risk to scale.
Without stronger delivery controls, secure deployment paths, and better release discipline, the company risked slower delivery, security incidents, and delays in compliance readiness.
What Needed to Change
Software delivery lacked governance
There was no clear branching strategy, no branch protection policies, and no standardized promotion path into production. Releases depended too heavily on individual developer workflows.
Security controls were inconsistent
Code scanning, dependency scanning, and secrets detection were either missing or fragmented. Security issues were often identified late in the release cycle.
Deployments were risky and difficult to roll back
The deployment model lacked GitOps principles, controlled rollback paths, and clear deployment ownership — increasing production risk.
Credentials were creating unnecessary exposure
CI/CD workflows relied on long-lived credentials instead of federated identity models, increasing secret sprawl and audit concerns.
Compliance readiness was behind
SOC 2 preparation exposed the need for stronger evidence around release controls, security validation, and deployment auditability.
The Platform Transformation
I designed and implemented a secure DevSecOps delivery platform built around trunk-based development, GitOps deployment patterns, and integrated security controls.
Trunk-based delivery model with governance controls
A trunk-based branching strategy was introduced with branch protection rules, pull request approvals, and standardized release workflows. This improved deployment discipline and reduced ad hoc release practices.
Secure CI/CD pipelines with GitHub Actions
GitHub Actions pipelines were designed to standardize build, validation, and deployment workflows across services. This reduced manual intervention and created consistent release paths across environments.
GitOps delivery with Argo CD and Helm
Application deployments were standardized using Helm charts and managed through Argo CD, creating a declarative deployment model with improved visibility, consistency, and rollback reliability.
Integrated DevSecOps controls
Security checks were embedded directly into the delivery pipeline, including:
- SonarQube for code quality and static analysis
- Checkmarx for SAST
- Black Duck for dependency and open-source risk analysis
- Secret scanning for exposed credentials
- DAST controls for runtime security validation
This shifted security earlier into the development lifecycle.
Workload Identity Federation for secure CI/CD authentication
Long-lived service account keys were removed and replaced with Workload Identity Federation, allowing GitHub Actions to securely authenticate into Google Cloud without static credentials.
Terraform-based platform standardization
Terraform was introduced to standardize cloud infrastructure dependencies and align delivery workflows with infrastructure governance.
| Before | After |
|---|---|
| No branching discipline | Trunk-based release model |
| No branch protection | Protected production workflows |
| Manual deployment flows | Standardized CI/CD pipelines |
| Weak rollback paths | GitOps rollback with Argo CD |
| Security scans inconsistent | Embedded SAST, DAST, SCA, secret scanning |
| Long-lived credentials in CI/CD | Workload Identity Federation |
| Limited auditability | Full deployment traceability |
What Changed After the Engagement
→ Deployment times reduced significantly through standardized automation
→ Security checks moved earlier into the delivery lifecycle
→ Rollback times improved through GitOps deployment controls
→ Static credentials removed from CI/CD pipelines
→ Delivery workflows aligned with SOC 2 readiness requirements
Beyond the technical metrics:
- Release confidence improved through structured deployment paths and approval controls
- Security findings were identified earlier, reducing downstream remediation effort
- Deployment risk decreased through automated validation and rollback-safe GitOps workflows
- Audit readiness improved through version-controlled deployment history and security evidence
- Engineering teams gained a repeatable, secure delivery model that could scale with the business
This type of engagement is common for SaaS companies preparing for SOC 2, enterprise customer audits, or scaling engineering teams where delivery maturity and security controls have not kept pace with product growth.
If your CI/CD process still relies on manual approvals, inconsistent security scanning, weak rollback paths, or long-lived credentials, this is the kind of DevSecOps modernization work I typically lead.