• Cloud operations

  • Run the production estate day to day: monitoring, alerting, capacity, patching, certificate and key rotation, and scheduled maintenance.
  • Own observability across metrics, logs, traces and synthetic checks, with actionable alerting tuned to reduce noise and defined service level objectives and error budgets.
  • Act as escalation point for platform incidents. Lead incident response, run post-incident reviews and track remediation actions to closure.
  • Maintain runbooks, on-call rotation and documented operational procedures. Where a task is repeated, automate it.
  • Own backup, retention, restore testing and documented recovery objectives. Restores are tested, not assumed.
  • Support L2 and L3 escalation from the service desk and feed recurring issues back into product backlogs.

• Cloud infrastructure management

  • Manage all infrastructure as code (Terraform and/or AWS CDK). Console changes are exceptions that are reconciled back to code.
  • Own the AWS estate architecture in partnership with solutions architecture: multi-account structure, landing zone, organisational guardrails, networking, and tenant isolation in a multi-tenant model.
  • Manage the serverless core: Lambda, API Gateway, DynamoDB, S3, EventBridge, Step Functions, Cognito identity pools per tenant, KMS key hierarchy and payment integration boundaries.
  • Own identity and access management: least privilege roles, federated access, elimination of long-lived keys, and periodic access review.
  • Maintain security posture in partnership with Information Security: baseline hardening, configuration compliance, endpoint and workload protection tooling, log shipping to central detection, and remediation of findings.
  • Own cloud financial management: tagging and cost allocation discipline, rightsizing, storage lifecycle policy, commitment and reservation coverage, anomaly alerting, and monthly reporting of spend against forecast. Provide the consumption evidence that supports commercial negotiation with cloud vendors.
  • Manage hybrid and office-edge infrastructure where it interfaces with cloud services, including remaining virtual machine estate and its migration path to cloud.

Contract deliverables

Performance is assessed against these milestones. They form the basis of any extension decision.

Weeks 1 to 4

• Inventory of pipelines, repositories, environments and cloud accounts.
• Current quality gate and deployment baseline documented with gaps identified.
• Escalation and on-call participation in place.
• Immediate operational risks logged and prioritised.

Months 2 to 3

• All environments deployed from versioned code with no manual steps.
• Blocking security and quality gates live on priority repositories.
• Backup restore tested and evidenced.
• Cost allocation complete to tag level.
• Baseline DORA metrics published.

Months 4 to 6

• Release and rollback automated end to end, including mobile.
• Runbooks and operational documentation complete and validated by a second party.
• Partner dependency reduced to a defined, bounded scope.
• Written handover pack and knowledge transfer delivered.

Essential experience and skills

• Five years or more in DevOps, SRE, platform or cloud engineering, with at least three years operating production AWS workloads.
• Demonstrable depth in AWS serverless services (Lambda, API Gateway, DynamoDB, S3, IAM, KMS, Cognito, CloudWatch, CloudFormation).
• Strong infrastructure as code practice in Terraform and/or AWS CDK, including module design, state management and drift control.
• Hands-on ownership of CI/CD tooling (GitHub Actions, GitLab CI, AWS CodePipeline, Azure DevOps or equivalent) beyond consuming pipelines built by others.
• Practical experience embedding code quality and security scanning into pipelines, including SAST, SCA, secret scanning and coverage enforcement.
• Scripting and automation in Python, TypeScript/Node.js or Go.
• Container and orchestration fundamentals (Docker, ECS or Kubernetes).
• Observability tooling in anger: CloudWatch plus at least one of Datadog, Grafana, OpenTelemetry, ELK.
• Incident management discipline, including leading response under pressure and running blameless post-incident review.
• Experience working with and holding to account third party delivery partners and managed service suppliers.
• Clear written communication, capable of producing documentation and operational reporting for both engineering and non-technical audiences.
• Professional English. [French desirable given office locations.]
• Track record of delivering to fixed term contract milestones with clean handover.
• Available to start at short notice and to work with minimal ramp-up support.

Desirable

• Multi-tenant SaaS platform operations, particularly per-tenant identity and data isolation.
• Mobile CI/CD and app store release management (Fastlane, App Store Connect, Google Play Console).
• FinOps practice, cloud commitment modelling and vendor consumption analysis.
• Regulated or audited environments, data protection and data residency constraints (GDPR, Swiss FADP).
• Endpoint and workload security tooling deployment (EDR, log forwarding, SIEM integration).
• Salesforce or Microsoft 365 platform integration touchpoints.
• AWS certification at Solutions Architect Associate level or above, or DevOps Engineer Professional.

Ways of working

• Bias to automation. Manual repetition is treated as a defect.
• Documentation is part of delivery, not an afterthought.
• Change is evidenced: no untracked production change, no unversioned infrastructure.
• Direct, factual reporting of platform state, including bad news early.
• Collaboration across product, architecture, security, service desk and external partners.
• Nothing is left in one person's head. Every deliverable is transferable at contract end.