Role and Company Overview

EC Markets runs a UK markets business on top of a real engineering estate: trading apps, a CRM, AI services, websites, and data platforms. We move quickly and ship often and our infrastructure has to keep up without breaking things.

We're looking for a Platform / DevOps Lead: a hands-on engineer who codes their infrastructure, automates the manual stuff, and sets the standard for shipping trusted changes. You'll own infrastructure-as-code end to end Terraform first, with our existing AWS CDK stacks alongside it and you'll have the mandate to fix what's slow or fragile.

This is a doer's role with real ownership. You write the Terraform, you build the pipelines, you carry the standard. Your flagship first project is already waiting: stand up a cleanly separated production environment with a credible Devroy promotion path.

Key Responsibilities

• Own infrastructure-as-code across the estate. Terraform is the primary tool managing both AWS and Snowflake from a single, version-controlled source of truth and you'll also own the AWS CDK (TypeScript) stacks. Drive the estate toward consistent, reusable, well-tested IaC.
• Stand up a real production environment. Build a clean separation between development and production and a safe, repeatable promotion path between them. This is the headline gap and your first big win.
• Build and harden CI/CD. GitHub Actions with OIDC, matrix container builds to ECR, plan-on-pull-request with deliberate applies, and multi-environment staging production promotion. Make deploys predictable and reversible.
• Automate away the toil. Secret provisioning and rotation, state-lock hygiene, drift detection, safe-apply guardrails. Every manual runbook step is a candidate for a pipeline.
• Run the AWS footprint. VPC and networking, ECS Fargate, DMS, S3, IAM, Secrets Manager, EventBridge provisioned as code, sized sensibly, and cost-aware (you'll make the calls on things like NAT vs VPC endpoints).
• Own observability and reliability. CloudWatch alarms and dashboards, SNS alerting, data freshness and quality signals, and automated recovery for the pipelines that need it. When something breaks at 2am, you've already built the thing that catches it.
• Manage Snowflake as code. Storage and notification integrations, Snowpipe ingestion, role-based access control, SSO via Entra ID (SAML/SCIM), and data masking / PII governance.
• Set the bar for trusted code. Code review, tests, repeatable deploys, clean rollbacks. Partner with product and data engineers so they can move fast without fear and so what ships is what was reviewed.