You’re the program manager for Identity & Access Management (IAM) at ShopSphere, a global e-commerce marketplace with 38M monthly active buyers and ~120K seller accounts. ShopSphere is entering its highest-traffic period (Black Friday through New Year), where the platform processes $1.6B/week GMV at peak. A recent internal red-team exercise demonstrated that a compromised IT operations account could be used to pivot into production, access customer PII, and modify order routing rules.
Following the exercise, the CISO issued a directive: enforce phishing-resistant multi-factor authentication (MFA) for all privileged access (production SSH, Kubernetes admin, cloud console, CI/CD admin, and break-glass accounts). The policy must be enforced before the annual SOC 2 Type II audit window begins in 10 weeks. Failure to show enforcement and evidence would put renewal deals with enterprise sellers at risk (estimated $22M ARR tied to security questionnaires).
The challenge: the IT Operations organization (responsible for 24/7 incident response, deployments, and on-call) strongly opposes the policy as written. They argue it will increase mean time to recovery (MTTR), create lockout risk during incidents, and slow down routine maintenance. You must deliver a plan that meets security and audit requirements without causing outages during peak season.
The tension is explicit: Security wants strict enforcement; Ops wants reliability and speed; Compliance wants provable controls; Product leadership wants “no surprises” during peak.
| Constraint | Details |
|---|---|
| Timeline | 10 weeks to demonstrate enforcement before SOC 2 audit sampling begins; peak freeze starts in 8 weeks |
| Scope | ~430 privileged users (Ops, SRE, DBAs, SecOps) + ~160 service accounts used by automation |
| Systems | AWS + GCP, Kubernetes (EKS/GKE), GitHub Enterprise, Terraform Cloud, internal bastion |
| Current state | SSO supports TOTP; hardware keys piloted for only 35 users; some shared “admin” accounts still exist |
| Reliability | No more than 15 minutes of cumulative access disruption per team during rollout; no changes that increase P0 incident MTTR by > 10% |
| Budget | $120K available this quarter for hardware keys, contractor support, and training |
| Resourcing | Platform Eng can spare 2 engineers part-time; IT Ops can allocate 1 ops lead; Security Eng has 1 staff engineer |
Produce a complete execution approach that addresses the policy enforcement and the organizational resistance. Specifically:
You are expected to demonstrate how you would enforce an unpopular security policy while maintaining operational excellence: aligning stakeholders, making explicit trade-offs, sequencing work under constraints, and ensuring the control is both real and auditable.