DevOps Engineer, Octopus Money

• Three or more years running production infrastructure on AWS, with real ownership of at least one multi-account estate
• Strong Terraform: you have written and maintained reusable modules, understand state and provider lifecycles, and can read a plan and spot what it will actually do
• Comfortable with IAM at depth: trust policies, OIDC federation, permission boundaries, and the discipline to scope every policy to specific ARNs
• Experience running containers in production, ideally ECS, including load balancing, service discovery, autoscaling and task-level IAM
• Solid CI/CD practice with GitHub Actions or similar: reusable workflows, environment gating, and PR-driven change with no manual console edits
• Operational grounding in relational and NoSQL databases: backups, restores, migrations and the alerts that catch problems early
• A security-first habit: least privilege by default, secrets never in code, and the instinct to flag a risk rather than work around it
• Clear written communication. Most of your work lands as PR descriptions, review comments and short Slack updates to engineers who were not in the room
• Willingness to work inside a regulated environment where change control, auditability and separation of environments matter
• Hands-on experience supporting an ISO 27001 (or SOC 2) programme: turning control requirements into infrastructure changes and producing audit evidence without slowing delivery
• Experience working with external penetration testers, from scoping and access through to remediation and retest
• IAM Identity Center or another SSO-based access model forAWS, including permission set design and least-privilege access reviews
• Confidence to challenge and influence

Desirable

• Octopus Money is hiring a DevOps Engineer to own and evolve the AWS platform that our customer-facing products run on
• The platform is defined entirely as code: a single Terraform monorepo, orchestrated with Terramate, spanning dev, staging and production accounts across multiple tenants
• You will join a small platform team and take shared ownership of everything from networking and IAM to container services, databases, observability and the CI/CD pipelines that ship it all
• This is a hands-on engineering role
• You will spend most of your time writing Terraform modules, reviewing infrastructure PRs, running plans through GitHub Actions, and working with product engineers to get new services onto the platform safely
• Octopus Money is FCA-regulated, so security, least privilege and auditable change are part of the day job, not an afterthought
• A large share of the recent work has been driven by our ISO 27001 programme and external penetration testing
• You will own the technical side of both: implementing controls as code, producing the evidence auditors ask for, and closing pentest findings through the normal PR process
• Design, build and maintain reusable Terraform modules forAWS services (ECS, ALB, RDS, DynamoDB, Lambda, Cognito, CloudFront, SES, SQS, SNS, KMS, WAF, Route 53) and wire them into per-tenant Terramate stacks
• Onboard new backend services onto the ECS platform: task roles, load balancers, DNS, autoscaling, observability, and the GitHub OIDC roles their CI/CD pipelines deploy with
• Own the change pipeline: PR-based Terraform plans in GitHub Actions, Terramate runs per project and environment, and controlled applies to staging and production
• Review infrastructure PRs for correctness, least-privilege IAM, correct secret and account references, and adherence to the repo's module conventions
• Run and improve security tooling: GuardDuty, Security Hub, IAM Access Analyzer, CloudTrail Lake, AWS Config, access-key rotation, network ACLs and WAF rules
• Build and tune observability: CloudWatch dashboards and alarms, New Relic alerts, load balancer and RDS alerts, and Slack-routed notifications for anything that pages
• Maintain data platform plumbing: RDS Postgres with backups, bastions and nightly dumps, DynamoDB backup exports to S3, DMS ingestion pipelines and S3 replication
• Support developer productivity: ephemeral test environments (EC2 + k3s + Helm), branch-preview deployments behind Traefik, and scripts that spin a full environment up in minutes
• Manage third-party integrations as code: Cloudflare, New Relic, SFTP transfers, Slack and email delivery, and vendor-specific IAM boundaries
• Investigate drift and incidents using read-only access first, and drive fixes through the normal PR process rather than console changes
• Keep documentation, module READMEs and runbooks current so the next engineer can pick up any stack cold
• Deliver ISO 27001 controls as code and keep them evidenced: automated IAM access key rotation, KMS key rotation, pgaudit on Aurora, S3 server access logging and default bucket policies, TLS 1.2+ on every load balancer, encryption at rest, cross-region replication of backups, and the Vanta integration that reports on all of it
• Support external penetration tests end to end: provision tester access through IAM Identity Center, triage the findings, remediate them (HTTPS redirects, failed-login and access-denied alerting, region locks on privileged roles, CloudTrail change alerts), and remove access when the engagement closes
• Administer IAM Identity Center: permission sets per environment, read-only versus admin access, group-based grants for data and engineering teams, migrating users off legacy IAM, and periodic access-key audits and cleanup
• Keep an eye on cost, from right-sizing services to measuring and trimming spend on newer workloads such as Bedrock-backed tooling