Platform ​/ DevOps Engineer

Role and Company Overview

EC Markets runs a UK markets business on top of a real engineering estate: trading apps, a CRM, AI services, websites, and data platforms. We move quickly and ship often and our infrastructure has to keep up without breaking things.

We're looking for a Platform / Dev Ops Lead: a hands‑on engineer who codes their infrastructure, automates the manual stuff, and sets the standard for shipping trusted changes. You'll own infrastructure‑as‑code end to end Terraform first, with our existing AWS CDK stacks alongside it and you'll have the mandate to fix what's slow or fragile.

This is a doer's role with real ownership. You write the Terraform, you build the pipelines, you carry the standard. Your flagship first project is already waiting: stand up a cleanly separated production environment with a credible Devroy promotion path.

• Own infrastructure‑as‑code across the estate. Terraform is the primary tool managing both AWS and Snowflake from a single, version‑controlled source of truth and you'll also own the AWS CDK (Type Script) stacks. Drive the estate toward consistent, reusable, well‑tested IaC.
• Stand up a real production environment. Build a clean separation between development and production and a safe, repeatable promotion path between them. This is the headline gap and your first big win.
• Build and harden CI/CD. Git Hub Actions with OIDC, matrix container builds to ECR, plan‑on‑pull‑request with deliberate applies, and multi‑environment staging production promotion. Make deploys predictable and reversible.
• Automate away the toil. Secret provisioning and rotation, state‑lock hygiene, drift detection, safe‑apply guardrails. Every manual runbook step is a candidate for a pipeline.
• Run the AWS footprint. VPC and networking, ECS Fargate, DMS, S3, IAM, Secrets Manager, Event Bridge provisioned as code, sized sensibly, and cost‑aware (you'll make the calls on things like NAT vs VPC endpoints).
• Own observability and reliability. Cloud Watch alarms and dashboards, SNS alerting, data freshness and quality signals, and automated recovery for the pipelines that need it. When something breaks at 2am, you've already built the thing that catches it.
• Manage Snowflake as code. Storage and notification integrations, Snowpipe ingestion, role‑based access control, SSO via Entra  (SAML/SCIM), and data masking / PII governance.
• Set the bar for trusted code. Code review, tests, repeatable deploys, clean rollbacks. Partner with product and data engineers so they can move fast without fear and so what ships is what was reviewed.

• Deep Terraform. Multi‑provider setups, reusable modules, remote state and locking, and a healthy respect for what a bad plan can do in production.
• Strong AWS. Hands‑on across networking, containers (ECS/Fargate), IAM, S3, Secrets Manager, and event‑driven scheduling built as code, not clicked in the console.
• CI/CD you've actually built. Git Hub Actions (or equivalent), OIDC‑based cloud auth, container builds, and multi‑environment delivery pipelines.
• Docker fluency building, slimming, tagging, and shipping images through a registry.
• Deep understanding in VPC, Subnets, Routing, Gateways, trust boundaries.
• Comfortable in Python and Bash to glue systems together and automate operations.
• Security instincts. Sound secrets management and least‑privilege IAM as a default, not an afterthought.
• Polyglot comfort. You can read across Python, Type Script, and Java well enough to unblock a build or debug a pipeline you don't need to own those apps, just keep them shipping.
• A bias to ship and automate. You'd rather write the automation once than do the manual step twice. You finish things.

• Degree in Computer Science, Data Engineering, or related field.
• 8+ years of hands‑on experience as a Devops or Platform engineer
• Excellent understanding of networking andA WS cloud.
• Knowledge of security frameworks (ISO 27001, NIST) applied in practice.
• Experience with Dev Ops tooling, automation, and secure system design.
• Certifications such as CISSP, CISM, CCSP, or cloud security certifications are desirable.

• AWS CDK (Type Script)
• AWS DMS /…