DevOps Engineer

Octopus Money is hiring a Dev Ops Engineer to own and evolve the AWS platform that our customer-facing products run on. The platform is defined entirely as code: a single Terraform monorepo, orchestrated with Terramate, spanning dev, staging and production accounts across multiple tenants. You will join a small platform team and take shared ownership of everything from networking and IAM to container services, databases, observability and the CI/CD pipelines that ship it all.

This is a hands‑on engineering role. You will spend most of your time writing Terraform modules, reviewing infrastructure PRs, running plans through Git Hub Actions, and working with product engineers to get new services onto the platform safely. Octopus Money is FCA‑regulated, so security, least privilege and auditable change are part of the day job, not an afterthought.

A large share of the recent work has been driven by our ISO 27001 programme and external penetration testing. You will own the technical side of both: implementing controls as code, producing the evidence auditors ask for, and closing pentest findings through the normal PR process.

• Design, build and maintain reusable Terraform modules forAWS services (ECS, ALB, RDS, DynamoDB, Lambda, Cognito, Cloud Front, SES, SQS, SNS, KMS, WAF, Route 53) and wire them into per-tenant Terramate stacks.
• Onboard new backend services onto the ECS platform: task roles, load balancers, DNS, autoscaling, observability, and the Git Hub OIDC roles their CI/CD pipelines deploy with.
• Own the change pipeline: PR-based Terraform plans in Git Hub Actions, Terramate runs per project and environment, and controlled applies to staging and production.
• Review infrastructure PRs for correctness, least-privilege IAM, correct secret and account references, and adherence to the repo's module conventions.
• Run and improve security tooling:
  Guard Duty, Security Hub, IAM Access Analyzer, Cloud Trail Lake, AWS Config, access-key rotation, network ACLs and WAF rules.
• Build and tune observability:
  Cloud Watch dashboards and alarms, New Relic alerts, load balancer and RDS alerts, and Slack-routed notifications for anything that pages.
• Maintain data platform plumbing: RDS Postgres with backups, bastions and nightly dumps, DynamoDB backup exports to S3, DMS ingestion pipelines and S3 replication.
• Support developer productivity: ephemera test environments (EC2 + k3s + Helm), branch-preview deployments behind Traefik, and scripts that spin a full environment up in minutes.
• Manage third-party integrations as code:
  Cloudflare, New Relic, SFTP transfers, Slack and email delivery, and vendor-specific IAM boundaries.
• Investigate drift and incidents using read-only access first, and drive fixes through the normal PR process rather than console changes.
• Keep documentation, module READMEs and runbooks current so the next engineer can pick up any stack cold.
• Deliver ISO 27001 controls as code and keep them evidenced: automated IAM access key rotation, KMS key rotation, pgaudit on Aurora, S3 server access logging and default bucket policies, TLS 1.2+ on every load balancer, encryption at rest, cross-region replication of backups, and the Vanta integration that reports on all of it.
• Support external penetration tests end to end: provision tester access through IAM Identity Center, triage the findings, remediate them (HTTPS redirects, failed-login and access-denied alerting, region locks on privileged roles, Cloud Trail change alerts), and remove access when the engagement closes.
• Administer IAM Identity Center: permission sets per environment, read-only versus admin access, group-based grants for data and engineering teams, migrating users off legacy IAM, and periodic access-key audits and cleanup.
• Keep an eye on cost, from right-sizing services to measuring and trimming spend on newer workloads such as Bedrock-backed tooling.

• Three or more years running production infrastructure on AWS, with real ownership of at least one multi-account estate.
• Strong Terraform: you have written and maintained reusable modules, understand state and provider life cycles, and can read a plan and spot what it will actually do.
• Comfortable with IAM at depth: trust policies, OIDC federation, permission boundaries, and the discipline to scope every policy to specific ARNs.
• Experience running containers in production, ideally ECS, including load balancing, service discovery, autoscaling and task-level IAM.
• Solid CI/CD practice with Git Hub…