Secure DevOps for Financial Middleware: Integrating Compliance into CI/CD Pipelines

Abstract

Aim: This study proposed a Secure DevOps model for financial middleware that integrates automated security controls and regulatory compliance mechanisms into Continuous Integration and Continuous Deployment (CI/CD) pipelines. Methods: The study adopted a proposal-based architectural approach to design a security- and compliance-aware DevOps model for financial middleware. The proposed architecture integrates static and dynamic security testing, policy validation, software dependency scanning, infrastructure security checks, Compliance-as-Code, and automated policy enforcement into the software development lifecycle. The model embeds security and regulatory compliance controls throughout the CI/CD pipeline rather than concentrating validation in later development stages. Results: The proposed model provides an integrated architecture for continuously assessing security vulnerabilities and compliance requirements during financial middleware development and deployment. By incorporating automated security testing, dependency analysis, policy validation, and infrastructure security checks into the CI/CD pipeline, the model establishes mechanisms for earlier identification of security and compliance issues. Compliance-as-Code and automated policy enforcement further provide a basis for consistently applying regulatory requirements across development and deployment processes. However, because the study presents a proposed model rather than an empirically evaluated implementation, its effects on vulnerability detection, compliance risk, deployment efficiency, and operational resilience remain to be validated. Conclusion: The proposed Secure DevOps model provides a conceptual foundation for balancing software delivery agility with the security and regulatory requirements of financial institutions. Recommendations: Financial institutions should pilot and empirically evaluate the proposed model using representative middleware environments and realistic regulatory scenarios.