← Back to home
Secure Banking Platform

A Secure, Governed Snowflake Platform Foundation for a Bank

2026 · 13-week engagement · architecture, identity & repeatable deployment

Over 13 weeks I stood up a secure, governed Snowflake environment for a commercial bank — enterprise identity, two-layer RBAC, a medallion data foundation and dbt infrastructure. I designed the defense-in-depth architecture and built repeatable deployment scripts for a common dev, QA and production environment pattern, supported by a 40-work-area assessment the client's team can operate itself.

2 accts
NONPROD + PROD architecture
13 wks
architecture & delivery engagement
20
RBAC roles · 3,700+ grants
4-layer
security architecture

Architecture — Cloud & Data

The common architecture for environment separation, governed data and repeatable deployment.

Microsoft Azure cloud
External sources
GitHub
Git integration for dbt projects
CRM data share
Inbound Snowflake share
Document store
File connector
Openflow
Data ingestion
PostgreSQL
Source-system mirror
↓ data ingestion
Snowflake — two accounts
NONPROD · DEV + QA PROD · same architecture
Bronze
Raw landing · inbound shares isolated
→
Silver
Cleaned, conformed, business-keyed · staging
→
Gold
Analytics-ready marts
→
Consumers
Semantic views · Cortex Agent · Search · Streamlit · BI
dbt — transformation engine across Bronze → Silver → Gold
PLATFORM_DB — cross-cutting platform, utility, security, and dbt-project objects
↑ identity · storage · private networking
Azure platform services
Microsoft Entra ID
SSO (SAML2) + SCIM — central identity
Azure Storage
Storage containers + external stage
VNet + PrivateLink
Private connectivity over the corporate network

Outcomes

Governed Platform Foundation

  • Medallion architecture (Bronze / Silver / Gold + staging) across dev and QA
  • 13 databases, 84 schemas, 7 workload-isolated warehouses
  • Two-layer RBAC — 20 custom roles, 3,700+ privilege grants

Enterprise Identity & Access

  • Microsoft Entra ID / Azure AD SSO (SAML2) + SCIM provisioning, live
  • Authentication architecture and operating guidance documented
  • RBAC and ownership-management runbook for the client team

Data & Transformation Layer

  • Live CRM source data across dev and QA
  • dbt infrastructure — external access, git, native project objects
  • Scheduled-task framework for repeatable transformation workloads

Repeatable Environment Provisioning

  • Dev and QA environments built with scripts designed for production provisioning
  • Turn-key build scripts regenerate the environment end to end
  • Common environment architecture with isolated data & credentials
  • Snowflake-native AI & BI workloads run on the governed foundation

Architecture Assessment & Team Handoff

  • 40-work-area assessment connecting architecture decisions to delivery priorities
  • Deployment playbook and independent architecture review
  • YAML-driven discovery taxonomy with build scripts that regenerate the reports
  • Snapshot toolchain captures live account state as evidence — the team runs the system going forward

Security Architecture — Defense in Depth

L1 · Network
PrivateLink connectivity Network policy / IP allowlist
L2 · Identity & Authentication
Azure AD SSO (SAML2) SCIM provisioning Key-pair (JWT) auth MFA enrollment Break-glass account
L3 · Data Protection
Masking policies Row-access policies Data classification tags
L4 · Monitoring & Governance
Cortex usage monitoring Resource monitors Audit queries Data retention policy
Data

The four-layer design connects network boundaries, enterprise identity, data protection and monitoring in one security architecture.

The Stack

Snowflake Cortex AI — Search, Analyst, Agents dbt Streamlit Azure AD — SSO / SCIM Azure Storage PrivateLink Python tooling Medallion architecture RBAC

My consulting approach pairs architecture decisions with working deployment patterns, evidence and a team handoff. The result is a foundation the client can reproduce and extend.

Client name withheld. Figures and outcomes are drawn from the engagement's client-verified closeout.