Описание:
Octopus Money is hiring a DevOps Engineer to own and evolve the AWS platform that our customer-facing products run on. The platform is defined entirely as code: a single Terraform monorepo, orchestrated with Terramate, spanning dev, staging and production accounts across multiple tenants. You will join a small platform team and take shared ownership of everything from networking and IAM to container services, databases, observability and the CI/CD pipelines that ship it all.
Задачи:
Design, build and maintain reusable Terraform modules for AWS services (ECS, ALB, RDS, DynamoDB, Lambda, Cognito, CloudFront, SES, SQS, SNS, KMS, WAF, Route 53) and wire them into per-tenant Terramate stacks. Onboard new backend services onto the ECS platform: task roles, load balancers, DNS, autoscaling, observability, and the GitHub OIDC roles their CI/CD pipelines deploy with. Own the change pipeline: PR-based Terraform plans in GitHub Actions, Terramate runs per project and environment, and controlled applies to staging and production. Review infrastructure PRs for correctness, least-privilege IAM, correct secret and account references, and adherence to the repo’s module conventions. Run and improve security tooling: GuardDuty, Security Hub, IAM Access Analyzer, CloudTrail Lake, AWS Config, access-key rotation, network ACLs and WAF rules. Build and tune observability: CloudWatch dashboards and alarms, New Relic alerts, load balancer and RDS alerts, and Slack-routed notifications for anything that pages. Maintain data platform plumbing: RDS Postgres with backups, bastions and nightly dumps, DynamoDB backup exports to S3, DMS ingestion pipelines and S3 replication. Support developer productivity: ephe… (EC2 + k3s + Helm), branch-preview deployments behind Traefik, and scripts that spin a full environment up in minutes. Manage third-party integrations as code: Cloudflare, New Relic, SFTP transfers, Slack and email delivery, and vendor-specific IAM boundaries. Investigate drift and incidents using read-only access first, and drive fixes through the normal PR process rather than console changes. Keep documentation, module READMEs and runbooks current so the next engineer can pick up any stack cold. Deliver ISO 27001 controls as code and keep them evidenced: automated IAM access key rotation, KMS key rotation, pgaudit on Aurora, S3 server access logging and default bucket policies, TLS 1.2+ on every load balancer, encryption at rest, cross-region replication of backups, and the Vanta integration that reports on all of it. Support external penetration tests end to end: provision tester access through IAM Identity Center, triage the findings, remediate them (HTTPS redirects, failed-login and access-denied alerting, region locks on privileged roles, CloudTrail change alerts), and remove access when the engagement closes. Administer IAM Identity Center: permission sets per environment, read-only versus admin access, group-based grants for data and engineering teams, migrating users off legacy IAM, and periodic access-key audits and cleanup. Keep an eye on cost, from right-sizing services to measuring and trimming spend on newer workloads such as Bedrock-backed tooling.
Требования:
Three or more years running production infrastructure on AWS, with real ownership of at least one multi-account estate. Strong Terraform: you have written and maintained reusable modules, understand state and provider lifecycles, and can read a plan and spot what it will actually do. Comfortable with IAM at depth: trust policies, OIDC federation, permission boundaries, and the discipline to scope every policy to specific ARNs. Experience running containers in production, ideally ECS, including load balancing, service discovery, autoscaling and task-level IAM. Solid CI/CD practice with GitHub Actions or similar: reusable workflows, environment gating, and PR-driven change with no manual console edits. Operational grounding in relational and NoSQL databases: backups, restores, migrations and the alerts that catch problems early. A security-first habit: least privilege by default, secrets never in code, and the instinct to flag a risk rather than work around it. Clear written communication. Most of your work lands as PR descriptions, review comments and short Slack updates to engineers who were not in the room. Willingness to work inside a regulated environment where change control, auditability and separation of environments matter. Hands‑on experience supporting an ISO 27001 (or SOC 2) programme: turning control requirements into infrastructure changes and producing audit evidence without slowing delivery. Experience working with external penetration testers, from scoping and access through to remediation and retest. IAM Identity Center or another SSO‑based access model for AWS, including permission set design and least‑privilege access reviews. Confidence to challenge and influence.
Будет плюсом:
- Terramate or another stack orchestrator on top of Terraform
- Kubernetes basics (k3s, Helm, Traefik) for our ephe…
- Cognito or another managed identity provider, including user migration
- Observability tooling beyond CloudWatch: New Relic, Grafana, OpenTelemetry.
- AWS security services in anger: GuardDuty, Security Hub, CloudTrail Lake, Access Analyzer
- Email deliverability with SES: domain identities, dedicated IP pools, configuration sets
- Scripting in Bash and Python for glue tooling and one-off automation
- Experience in fintech or another regulated sector
- Compliance automation platforms such as Vanta or Drata
- Database auditing and hardening on Aurora or RDS Postgres, including pgaudit
Условия:
- Base salary: £67,500 + benefits
- Hybrid working with 3 days in the office each week (Tuesday – Thursday)
- 18 days a year working from anywhere
- Performance-based bonus
- The opportunity to participate in our Share Incentive Plan (HMRC approved scheme enabling employees to invest tax efficiently)
- Company pension
- Private medical insurance
- Enhanced parental leave and Return to Work coaching (find out more on our website)
- Birthday day off
- A mission driven focus – the chance to help people improve their lives through financial wellbeing, and a supportive team who care about what they do
#J-18808-Ljbffr…