DevOps engineer (AWS Networking and Security)

Essential experience

• Deep, hands-on AWS networking: VPC and subnet design, routing, security groups
• Delivering network re-architecture on live production platforms with zero downtime
• Controlling egress for serverless and container workloads
• Securing data stores at the network layer

Technologies and tools

• Networking: Amazon VPC, subnets, route tables, NAT gateways, Internet gateways, Transit Gateway (if in use)
• Network security: Security groups, network ACLs, AWS Network Firewall, Route 53 Resolver DNS Firewall
• Private connectivity: VPC endpoints (gateway and interface / PrivateLink)
• Data stores: Amazon OpenSearch Service (VPC domains, access policies)
• Workloads: AWS Lambda (VPC-attached), Amazon ECS (awsvpc networking)
• Observability: VPC Flow Logs, Reachability Analyzer, CloudWatch
• Infrastructure as code: AWS CloudFormation and/or AWS CDK, or Terraform

Desirable

• Amazon OpenSearch Service security configuration
• AWS Network Firewall or equivalent egress filtering
• AWS certification (e.g. Advanced Networking – Specialty)

Job Responsibilities

• Restrict network access to internal Amazon OpenSearch domains using VPC placement, security groups and access policies
• Redesign VPC and subnet layout so Lambda and ECS workloads route through controlled egress points
• Implement egress controls such as NAT gateways, AWS Network Firewall, VPC endpoints (PrivateLink) and route table changes, per the agreed design
• Tighten security groups and network ACLs to least privilege
• Plan and execute zero-downtime migrations: staged cutovers, traffic validation, tested rollback
• Use VPC Flow Logs and Reachability Analyzer to baseline traffic before change and verify it after
• Deliver all network changes as infrastructure as code with peer review
• Produce network diagrams and runbooks for the platform team

Department/Project Description

The Client is one of the majour insurance companies in the UK.
This role supports a high-priority risk reduction programme for the Green Flag MyCro Platform, a complex technology estate built on AWS. Platform SMEs have already designed remediation plans and started putting them into effect. The DevOps engineer we're looking for will lock down subnet-level access to internal OpenSearch indexes and reconfigure the platform's VPC and subnet design so egress from hosted Lambda functions and ECS clusters can be controlled. These are complex, platform-wide network changes that must be delivered with zero downtime. You will join a new squad led by a Platform SME.