DevOps engineer in fintech

Octopus Money is hiring a DevOps Engineer to own and evolve the AWS platform that our customer-facing products run on. The platform is defined entirely as code: a single Terraform monorepo, orchestrated with Terramate, spanning dev, staging and production accounts across multiple tenants. You will join a small platform team and take shared ownership of everything from networking and IAM to container services, databases, observability and the CI/CD pipelines that ship it all.

• Design, build and maintain reusable Terraform modules for AWS services (ECS, ALB, RDS, DynamoDB, Lambda, Cognito, CloudFront, SES, SQS, SNS, KMS, WAF, Route 53) and wire them into per-tenant Terramate stacks.
• Onboard new backend services onto the ECS platform: task roles, load balancers, DNS, autoscaling, observability, and the GitHub OIDC roles their CI/CD pipelines deploy with.
• Own the change pipeline: PR-based Terraform plans in GitHub Actions, Terramate runs per project and environment, and controlled applies to staging and production.
• Review infrastructure PRs for correctness, least-privilege IAM, correct secret and account references, and adherence to the repo's module conventions.
• Run and improve security tooling: GuardDuty, Security Hub, IAM Access Analyzer, CloudTrail Lake, AWS Config, access-key rotation, network ACLs and WAF rules.
• Build and tune observability: CloudWatch dashboards and alarms, New Relic alerts, load balancer and RDS alerts, and Slack-routed notifications for anything that pages.
• Maintain data platform plumbing: RDS Postgres with backups, bastions and nightly dumps, DynamoDB backup exports to S3, DMS ingestion pipelines and S3 replication.
• Support developer productivity: ephemeral test environments (EC2 + k3s + Helm), branch-preview deployments behind Traefik, and scripts that spin a full environment up in minutes.
• Manage third-party integrations as code: Cloudflare, New Relic, SFTP transfers, Slack and email delivery, and vendor-specific IAM boundaries.
• Investigate drift and incidents using read-only access first, and drive fixes through the normal PR process rather than console changes.
• Keep documentation, module READMEs and runbooks current so the next engineer can pick up any stack cold.
• Deliver ISO 27001 controls as code and keep them evidenced: automated IAM access key rotation, KMS key rotation, pgaudit on Aurora, S3 server access logging and default bucket policies, TLS 1.2+ on every load balancer, encryption at rest, cross-region replication of backups, and the Vanta integration that reports on all of it.
• Support external penetration tests end to end: provision tester access through IAM Identity Center, triage the findings, remediate them (HTTPS redirects, failed-login and access-denied alerting, region locks on privileged roles, CloudTrail change alerts), and remove access when the engagement closes.
• Administer IAM Identity Center: permission sets per environment, read-only versus admin access, group-based grants for data and engineering teams, migrating users off legacy IAM, and periodic access-key audits and cleanup.
• Keep an eye on cost, from right-sizing services to measuring and trimming spend on newer workloads such as Bedrock-backed tooling.

• Three or more years running production infrastructure on AWS, with real ownership of at least one multi-account estate.
• Strong Terraform: you have written and maintained reusable modules, understand state and provider lifecycles, and can read a plan and spot what it will actually do.
• Comfortable with IAM at depth: trust policies, OIDC federation, permission boundaries, and the discipline to scope every policy to specific ARNs.
• Experience running containers in production, ideally ECS, including load balancing, service discovery, autoscaling and task-level IAM.
• Solid CI/CD practice with GitHub Actions or similar: reusable workflows, environment gating, and PR-driven change with no manual console edits.
• Operational grounding in relational and NoSQL databases: backups, restores, migrations and the alerts that catch problems early.
• A security-first habit: least privilege by default, secrets never in code, and the instinct to flag a risk rather than work around it.
• Clear written communication. Most of your work lands as PR descriptions, review comments and short Slack updates to engineers who were not in the room.
• Willingness to work inside a regulated environment where change control, auditability and separation of environments matter.
• Hands-on experience supporting an ISO 27001 (or SOC 2) programme: turning control requirements into infrastructure changes and producing audit evidence without slowing delivery.
• Experience working with external penetration testers, from scoping and access through to remediation and retest.
• IAM Identity Center or another SSO-based access model for AWS, including permission set design and least-privilege access reviews.
• Confidence to challenge and influence.
• Будет плюсом: Terramate or another stack orchestrator on top of Terraform; Kubernetes basics (k3s, Helm, Traefik) for our ephemeral test environments; Cognito or another managed identity provider, including user migration; Observability tooling beyond CloudWatch: New Relic, Grafana, OpenTelemetry. AWS security services in anger: GuardDuty, Security Hub, CloudTrail Lake, Access Analyzer; Email deliverability with SES: domain identities, dedicated IP pools, configuration sets; Scripting in Bash and Python for glue tooling and one-off automation; Experience in fintech or another regulated sector; Compliance automation platforms such as Vanta or Drata; Database auditing and hardening on Aurora or RDS Postgres, including pgaudit

• Base salary: £67,500 + benefits
• Hybrid working with 3 days in the office each week (Tuesday - Thursday)
• 18 days a year working from anywhere
• Performance-based bonus
• The opportunity to participate in our Share Incentive Plan (HMRC approved scheme enabling employees to invest tax efficiently)
• Company pension
• Private medical insurance
• Enhanced parental leave and Return to Work coaching (find out more on our website)
• Birthday day off
• A mission driven focus - the chance to help people improve their lives through financial wellbeing, and a supportive team who care about what they do