Senior DevOps Engineer

The role
We are expanding our DevOps team and raising its bar. You will join an existing team of five as a senior
engineer who sets the standard — the person others look to for how Terraform should be structured, how a release should be promoted, and how an incident should be run. We are hiring for depth and judgment, not headcount.

The role spans infrastructure and application delivery. On the infrastructure side: consolidating our AWS and Azure estates into reusable Terraform modules, hardening how we deploy to and operate Kubernetes, and building the guardrails, observability and recovery posture that enterprise clients expect from a vendor holding their data. On the application side: owning the CI/CD pipelines that take every Grey Chain service from commit to production — build, test, scan, package, promote — and the developer experience around them. And across both: standing up and running client environments, owning releases, and sitting across the table from client IT and security teams. When something breaks in production, you are the person who is answerable for it — for leading the response, for the explanation to the client, and for the fix that stops it happening again.

One thing about how we deliver shapes this role more than anything else: every new client engagement starts with fresh cloud infrastructure, often in the client's own AWS account or Azure subscription. There is no shared estate to drop a tenant into. Someone has to take that environment from an empty account to a hardened, monitored, production go-live — networking, identity, clusters, databases, secrets, pipelines, bservability, security sign-off — and then hand it over cleanly. We need you to be that person, repeatedly, and to make each build faster and more consistent than the last.
There are no direct reports on day one; we expect you to mentor the team, review their work, and grow into a lead role as the function scales.

What you will own
Greenfield client environments. day one to go-live. Lead the build of each new client environment end to end: account or subscription setup and landing-zone foundations, network design (VPCs/VNets, private connectivity, egress control), identity federation with the client's Entra tenant, Kubernetes clusters, managed PostgreSQL, secrets, container registries, CI/CD wiring, monitoring and alerting, backup and recovery, security hardening and the evidence the client's security team will ask for before sign-off. Own the go-live checklist, the cutover, and the handover into steady-state operations. Turn what you learn on each build into templates so the next one is faster.

Cloud platform. Design. build and run our AWS estate (primary — EKS, RDS PostgreSQL, Bedrock, IAM, networking) and our Azure footprint (secondary — AKS, Azure OpenAI, Entra ID integration) for clients who mandate it. Consolidate what exists today into reusable, versioned Terraform modules with remote state, locked-down blast radius and explicit protection for stateful resources — the building blocks every new client environment is assembled from.

Application CI/CD. Own the pipelines for every Grey Chain service — Python and TypeScript backends, frontends, agent workers and MCP servers. That means the build stage (dependency caching, container builds, multi-arch where needed), quality gates (unit and integration tests, linting, SAST, dependency and image vulnerability scanning), artefact management (registries, versioning, SBOMs, signing), and pipeline templates that product teams can adopt without a DevOps engineer in the loop. You will own pipeline speed and reliability as metrics, and you will be the person developers come to when a build is slow, flaky or blocked.

Kubernetes and deployment. Own our EKS/AKS clusters end to end — cluster lifecycle and upgrades, node and workload sizing, ingress, networking, autoscaling and cluster-level security. Own how services get onto those clusters: a build-once, promote-many model where the same immutable, signed image moves from dev through staging to production with environment-specific configuration, driven from our GitHub and Azure DevOps pipelines. Make that model the default for every service — and hold the team to it.

Data protection and recovery. Define and enforce the controls that keep client data safe: automated backups and point-in-time recovery for every PostgreSQL instance, deletion protection and lifecycle guards in IaC, encryption at rest and in transit, tested restore runbooks, and a change-review process for any Terraform plan that touches a stateful resource. You will be measured on recovery objectives being real, not on the diagrams.

LLM application infrastructure. Run the stateful services that agentic products depend on in production — LLM observability, durable workflow orchestration, vector stores — and the gateways in front of Bedrock and Azure OpenAI. Own model quota management, rate limiting, token-level cost visibility and per-tenant attribution, so we know exactly which client, agent and workflow spent what.

Security and compliance. Implement the identity and secrets posture our clients audit: OAuth 2.0 / OIDC integration with client identity providers (Entra ID in particular), workload identity instead of long-lived keys, centralised secrets management, least-privilege IAM, network segmentation, and audit logging. Own our answers to client security questionnaires and drive us toward SOC 2 / ISO 27001-aligned controls.

Observability and incident accountability. Stand up metrics, logs and traces across the platform
(Prometheus/Grafana or equivalent, OpenTelemetry), define SLOs for client-facing services, and make sure problems are detected by us before they are reported by a client. Own incident response end to end: lead the call, coordinate the fix, communicate with the client, and write the blameless post-mortems that turn incidents into guardrails.

Client engagement. Join client calls when the work needs it, present architecture and security posture to client infrastructure teams, and translate their requirements (data residency, private networking, identity federation) into platform capabilities.

What we are looking for
Must have

• 6–9 years in DevOps / platform / SRE roles, with at least 3 years running Kubernetes in production for external users.

• Greenfield delivery, more than once. You have personally taken at least two environments from an
empty cloud account to production go-live — owning every layer, not just the Kubernetes part — and
can walk us through what you set up first, what you got wrong the first time, and what you templated
the second time.

• Deep, hands-on AWS: EKS, RDS, IAM, VPC networking, and the operational habits that come with
them. Working knowledge of Azure (AKS, Entra ID, Azure OpenAI) or the demonstrated ability to
become productive on it quickly.

• Terraform at scale: module design, remote state and locking, workspaces or equivalent environment
separation, drift detection, and a clear-eyed understanding of when a plan will destroy-and-replace a
resource — and how to stop it.

• Application CI/CD ownership on GitHub Actions and Azure DevOps — both are in daily use here. You
have designed and run pipelines end to end for real product teams — build, test, scan, package,
promote — including reusable workflow/pipeline templates, environments and approvals, secrets
handling in CI, self-hosted runners/agents where needed, and diagnosing slow or flaky builds.

• Kubernetes deployment tooling: Helm (or Kustomize), rollout strategies, environment promotion of
immutable images, and supply-chain basics such as image signing and SBOMs. Experience with GitOps controllers (Argo CD, Flux) and policy-as-code (Kyverno, OPA Gatekeeper) is welcome but not
required.

• Production PostgreSQL operations: backups, PITR, restore testing, encryption, upgrades.

• Security fundamentals: OAuth 2.0 / OIDC, secrets management (Vault, AWS Secrets Manager, Azure
Key Vault), least-privilege IAM, TLS, and experience answering enterprise security questionnaires.

• Solid scripting in Python and Bash; comfortable reading application code (Python, TypeScript) to debug a build or a deployment, and with containerising services you did not write.

• Experience running LLM or ML-serving workloads, or the infrastructure around them (LLM
observability platforms, workflow engines, vector databases, model gateways). If you have not run
these specifically, you should be able to show equivalent depth on comparable stateful services and a
strong pull toward this space.

• A track record of raising the standard of a team you joined — through code review, runbooks,
templates or example — not just of doing good work yourself.

• Clear written and spoken English; comfortable presenting to client engineering and security teams

Strongly preferred

• Experience in a services or multi-client product company where infrastructure is delivered into
external clients' cloud accounts, not just to internal product teams — including working within a
client's landing zone, guardrails and change process.

• Multi-tenant SaaS on Kubernetes: tenant isolation, per-tenant cost attribution, noisy-neighbour
controls.

• FinOps discipline on AWS and Azure, including LLM token spend.

• Certifications are welcome but not required: AWS Solutions Architect / DevOps Engineer Professional, CKA/CKS, AZ-104/AZ-400.

• Experience using AI coding agents (Claude Code, Cursor or similar) in infrastructure work