DevOps Engineer
Octopus Money · Holborn, London · hybrid
Octopus Money is hiring a DevOps Engineer to own and evolve the AWS platform that our customer-facing products run on. The platform is defined entirely as code: a single Terraform monorepo, orchestrated with Terramate, spanning dev, staging and production accounts across multiple tenants. You will join a small platform team and take shared ownership of everything from networking and IAM to container services, databases, observability and the CI/CD pipelines that ship it all.
This is a hands-on engineering role. You will spend most of your time writing Terraform modules, reviewing infrastructure PRs, running plans through GitHub Actions, and working with product engineers to get new services onto the platform safely. Octopus Money is FCA-regulated, so security, least privilege and auditable change are part of the day job, not an afterthought.
A large share of the recent work has been driven by our ISO 27001 programme and external penetration testing. You will own the technical side of both: implementing controls as code, producing the evidence auditors ask for, and closing pentest findings through the normal PR process.
What you'll do:
- Design, build and maintain reusable Terraform modules forAWS services (ECS, ALB, RDS, DynamoDB, Lambda, Cognito, CloudFront, SES, SQS, SNS, KMS, WAF, Route 53) and wire them into per-tenant Terramate stacks.
- Onboard new backend services onto the ECS platform: task roles, load balancers, DNS, autoscaling, observability, and the GitHub OIDC roles their CI/CD pipelines deploy with.
- Own the change pipeline: PR-based Terraform plans in GitHub Actions, Terramate runs per project and environment, and controlled applies to staging and production.
- Review infrastructure PRs for correctness, least-privilege IAM, correct secret and account references, and adherence to the repo's module conventions.
- Run and improve security tooling: GuardDuty, Security Hub, IAM Access Analyzer, CloudTrail Lake, AWS Config, access-key rotation, network ACLs and WAF rules.
- Build and tune observability: CloudWatch dashboards and alarms, New Relic alerts, load balancer and RDS alerts, and Slack-routed notifications for anything that pages.
- Maintain data platform plumbing: RDS Postgres with backups, bastions and nightly dumps, DynamoDB backup exports to S3, DMS ingestion pipelines and S3 replication.
- Support developer productivity: ephemeral test environments (EC2 + k3s + Helm), branch-preview deployments behind Traefik, and scripts that spin a full environment up in minutes.
- Manage third-party integrations as code: Cloudflare, New Relic, SFTP transfers, Slack and email delivery, and vendor-specific IAM boundaries.
- Investigate drift and incidents using read-only access first, and drive fixes through the normal PR process rather than console changes.
- Keep documentation, module READMEs and runbooks current so the next engineer can pick up any stack cold.
- Deliver ISO 27001 controls as code and keep them evidenced: automated IAM access key rotation, KMS key rotation, pgaudit on Aurora, S3 server access logging and default bucket policies, TLS 1.2+ on every load balancer, encryption at rest, cross-region replication of backups, and the Vanta integration that reports on all of it.
- Support external penetration tests end to end: provision tester access through IAM Identity Center, triage the findings, remediate them (HTTPS redirects, failed-login and access-denied alerting, region locks on privileged roles, CloudTrail change alerts), and remove access when the engagement closes.
- Administer IAM Identity Center: permission sets per environment, read-only versus admin access, group-based grants for data and engineering teams, migrating users off legacy IAM, and periodic access-key audits and cleanup.
- Keep an eye on cost, from right-sizing services to measuring and trimming spend on newer workloads such as Bedrock-backed tooling.
What we're looking for:
- Three or more years running production infrastructure on AWS, with real ownership of at least one multi-account estate.
- Strong Terraform: you have written and maintained reusable modules, understand state and provider lifecycles, and can read a plan and spot what it will actually do.
- Comfortable with IAM at depth: trust policies, OIDC federation, permission boundaries, and the discipline to scope every policy to specific ARNs.
- Experience running containers in production, ideally ECS, including load balancing, service discovery, autoscaling and task-level IAM.
- Solid CI/CD practice with GitHub Actions or similar: reusable workflows, environment gating, and PR-driven change with no manual console edits.
- Operational grounding in relational and NoSQL databases: backups, restores, migrations and the alerts that catch problems early.
- A security-first habit: least privilege by default, secrets never in code, and the instinct to flag a risk rather than work around it.
- Clear written communication. Most of your work lands as PR descriptions, review comments and short Slack updates to engineers who were not in the room.
- Willingness to work inside a regulated environment where change control, auditability and separation of environments matter.
- Hands-on experience supporting an ISO 27001 (or SOC 2) programme: turning control requirements into infrastructure changes and producing audit evidence without slowing delivery.
- Experience working with external penetration testers, from scoping and access through to remediation and retest.
- IAM Identity Center or another SSO-based access model forAWS, including permission set design and least-privilege access reviews.
- Confidence to challenge and influence.
Nice to have:
- Terramate or another stack orchestrator on top of Terraform.
- Kubernetes basics (k3s, Helm, Traefik) for our ephemeral test environments.
- Cognito or another managed identity provider, including user migration.
- Observability tooling beyond CloudWatch: New Relic, Grafana, OpenTelemetry. AWS security services in anger: GuardDuty, Security Hub, CloudTrail Lake, Access Analyzer.
- Email deliverability with SES: domain identities, dedicated IP pools, configuration sets.
- Scripting in Bash and Python for glue tooling and one-off automation.
- Experience in fintech or another regulated sector.
- Compliance automation platforms such as Vanta or Drata.
- Database auditing and hardening on Aurora or RDS Postgres, including pgaudit.
Success looks like this at Octopus Money:
- You can handle ambiguity. You’re comfortable using judgement to create structure and applying first principle thinking.
- You’re someone who ‘chases the ball’, rather than just hoping others pick it up. We look for determination, resilience and a healthy dose of optimism.
- You thrive in a fast paced environment. You’re open to course correct when needed, and challenge yourself and others to.
About Octopus Money
🐙 We’re on a mission to become the most recommended financial services business in the UK 🐙
Money shapes every part of life. Yet most people never get the support they need:
- Half of Brits reach retirement age without enough to live the life they want
- Financial stress is a leading cause of poor mental health
- Only 8% of people have access to 1-to-1 financial advice
There’s no shortage of information. What people actually need is clarity, guidance and a plan that makes sense for them.
That’s where we come in.
Octopus Money brings together financial planning, investment expertise and smart technology so people can understand their options and take action with confidence. We help people build a clear plan for their savings, investments and pensions and make investing simple with managed portfolios built by experts. We also support employers who want their teams to feel more secure and in control.
Some people need regulated advice. Others need coaching. Many need both at different points in life. Our s