DevOps engineer (AWS Networking and Security)

DevOps engineer (AWS Networking and Security)

Essential experienceDeep, hands-on AWS networking: VPC and subnet design, routing, security groupsDelivering network re-architecture on live production platforms with zero downtimeControlling egress for serverless and container workloadsSecuring data stores at the network layerTechnologies and toolsNetworking: Amazon VPC, subnets, route tables, NAT gateways, Internet gateways, Transit Gateway (if in use)Network security: Security groups, network ACLs, AWS Network Firewall, Route 53 Resolver DNS FirewallPrivate connectivity: VPC endpoints (gateway and interface / PrivateLink)Data stores: Amazon OpenSearch Service (VPC domains, access policies)Workloads: AWS Lambda (VPC-attached), Amazon ECS (awsvpc networking)Observability: VPC Flow Logs, Reachability Analyzer, CloudWatchInfrastructure as code: AWS CloudFormation and/or AWS CDK, or TerraformDesirableAmazon OpenSearch Service security configurationAWS Network Firewall or equivalent egress filteringAWS certification (e.g. Advanced Networking - Specialty)Job ResponsibilitiesRestrict network access to internal Amazon OpenSearch domains using VPC placement, security groups and access policiesRedesign VPC and subnet layout so Lambda and ECS workloads route through controlled egress pointsImplement egress controls such as NAT gateways, AWS Network Firewall, VPC endpoints (PrivateLink) and route table changes, per the agreed designTighten security groups and network ACLs to least privilegePlan and execute zero-downtime migrations: staged cutovers, traffic validation, tested rollbackUse VPC Flow Logs and Reachability Analyzer to baseline traffic before change and verify it afterDeliver all network changes as infrastructure as code with peer reviewProduce network diagrams and runbooks for the platform teamDepartment/Project DescriptionThe Client is one of the majour insurance companies in the UK.This role supports a high-priority risk reduction programme for the Green Flag MyCro Platform, a complex technology estate built on AWS. Platform SMEs have already designed remediation plans and started putting them into effect. The DevOps engineer we're looking for will lock down subnet-level access to internal OpenSearch indexes and reconfigure the platform's VPC and subnet design so egress from hosted Lambda functions and ECS clusters can be controlled. These are complex, platform-wide network changes that must be delivered with zero downtime. You will join a new squad led by a Platform SME.