DevOps engineer (AWS Networking and Security)

Essential experience

Deep, hands-on AWS networking: VPC and subnet design, routing, security groups

Delivering network re-architecture on live production platforms with zero downtime

Controlling egress for serverless and container workloads

Securing data stores at the network layer

Technologies and tools

Networking: Amazon VPC, subnets, route tables, NAT gateways, Internet gateways, Transit Gateway (if in use)

Network security: Security groups, network ACLs, AWS Network Firewall, Route 53 Resolver DNS Firewall

Private connectivity: VPC endpoints (gateway and interface / PrivateLink)

Data stores: Amazon OpenSearch Service (VPC domains, access policies)

Workloads: AWS Lambda (VPC-attached), Amazon ECS (awsvpc networking)

Observability: VPC Flow Logs, Reachability Analyzer, CloudWatch

Infrastructure as code: AWS CloudFormation and/or AWS CDK, or Terraform

Desirable

Amazon OpenSearch Service security configuration

AWS Network Firewall or equivalent egress filtering

AWS certification (e.g. Advanced Networking – Specialty)

Job Responsibilities

Restrict network access to internal Amazon OpenSearch domains using VPC placement, security groups and access policies

Redesign VPC and subnet layout so Lambda and ECS workloads route through controlled egress points

Implement egress controls such as NAT gateways, AWS Network Firewall, VPC endpoints (PrivateLink) and route table changes, per the agreed design

Tighten security groups and network ACLs to least privilege

Plan and execute zero-downtime migrations: staged cutovers, traffic validation, tested rollback

Use VPC Flow Logs and Reachability Analyzer to baseline traffic before change and verify it after

Deliver all network changes as infrastructure as code with peer review

Produce network diagrams and runbooks for the platform team

Department/Project Description

The Client is one of the majour insurance companies in the UK.

This role supports a high-priority risk reduction programme for the Green Flag MyCro Platform, a complex technology estate built on AWS. Platform SMEs have already designed remediation plans and started putting them into effect. The DevOps engineer we're looking for will lock down subnet-level access to internal OpenSearch indexes and reconfigure the platform's VPC and subnet design so egress from hosted Lambda functions and ECS clusters can be controlled. These are complex, platform-wide network changes that must be delivered with zero downtime. You will join a new squad led by a Platform SME.