Senior DevOps Engineer

Bamboo Card runs its digital gifting platform on AWS .NET services, React portals, SQL Server, and partner APIs used by suppliers and marketplaces in 80+ countries. Our infrastructure is defined as code, our repositories live in GitHub, and every deployment goes through GitHub Actions. You will be the owner of all three. That means keeping our AWS environments secure, reliable, and cost-efficient, running our GitHub organisation properly, and giving engineers fast, safe pipelines they can trust. This is an ownership role, not a ticket queue. AWS Infrastructure & Infrastructure as Code Own all AWS infrastructure as code (CloudFormation / CDK / Terraform); no manual changes in production. Design and maintain multi-account AWS environments: VPC networking, ECS/Lambda, RDS SQL Server, S3, CloudFront, Route 53, SES, and API Gateway. Manage IAM and IAM Identity Center with least-privilege access across accounts and teams. Build reusable IaC modules and templates so new services follow a standard, reviewed baseline. Detect and eliminate configuration drift between environments. GitHub Organisation & Source Control Own the GitHub organisation: repositories, teams, permissions, rulesets, branch protection, and CODEOWNERS. Define and enforce branching, pull request, and release conventions across all teams. Manage secrets, environments, and dependency and code scanning (Dependabot, GitHub Advanced Security). Keep repositories clean, documented, and auditable. CI/CD with GitHub Actions Design, build, and maintain CI/CD pipelines in GitHub Actions for .NET, React, and infrastructure repositories. Create shared reusable workflows and composite actions so pipelines are consistent across the organisation. Use OIDC federation to AWS instead of long-lived access keys. Implement environment approvals, safe deployment strategies (blue/green, canary), and fast rollback. Manage self-hosted or larger runners where needed, balancing speed and cost. Reliability, Observability & Incident Response Set up monitoring, logging, and alerting with CloudWatch and related tooling; make sure alerts are actionable. Participate in on-call and lead infrastructure incident response and post-mortems. Own backup, disaster recovery, and restore testing for critical systems and databases. Security, Cost & Continuous Improvement Work closely with the Security Lead on hardening: WAF, GuardDuty, Security Hub, KMS, CloudTrail, and secrets management. Track and reduce AWS spend through right-sizing, tagging, and reserved capacity. Document infrastructure, runbooks, and pipelines so the team is never dependent on one person. Automate repetitive work and continuously improve developer experience. 6+ years in DevOps, SRE, or platform engineering, with at least 4 years running production workloads on AWS. Deep, hands-on infrastructure-as-code experience (CloudFormation, CDK, or Terraform) across multi-account AWS setups. Strong GitHub administration experience: organisations, rulesets, CODEOWNERS, secrets, and security features. Proven experience building and maintaining complex GitHub Actions pipelines, including reusable workflows and OIDC to AWS. Solid networking and security fundamentals: VPCs, DNS, TLS, IAM, and secrets management. Scripting in Bash, Python, or PowerShell; experience with Docker and ECS (Kubernetes/EKS is a plus). Experience supporting .NET and SQL Server workloads on AWS is a strong advantage. Ownership & Communication Takes full ownership of systems, from design through to 3 a.m. incidents. Documents clearly and shares knowledge so others can operate what you build. Able to push back on unsafe shortcuts and explain trade-offs to engineers and leadership. AWS certifications (DevOps Engineer Professional, Solutions Architect) and fintech or payments experience are a plus.