Senior DevSecOps Engineer

Senior DevSecOps Engineer Help build the future of fair hiring in the AI era. At Arctic Shores, we're creating a world of work where potential matters more than experience. Our market-leading, task-based psychometric assessments help organisations like Amazon, Siemens and Jet2 make fair, evidence-based hiring decisions. We've doubled ARR year-on-year for the past three years and are looking for a Senior DevSecOps Engineer to help secure and scale the next chapter. The opportunity This is a rare chance to provide technical guidance and leadership across our platform, and play a senior hands-on role in shaping our security posture of a purpose-driven scale-up where technical excellence is genuinely important. You'll be a hands-on practitioner sitting at the intersection of platform engineering and information security, working with an event-driven architecture running on Kubernetes and underpinned by AWS. You’ll be embedded within an engineering team that values excellence, aims high, and means it. On the engineering side, you'll own our AWS infrastructure, network and security boundaries, CI/CD security tooling, and platform controls. On the information security side, you'll provide the technical expertise that underpins our ISO 27001 and Cyber Essentials certifications, incident response, and day-to-day governance. If you've always wanted to work somewhere that treats security as a first-class concern rather than an afterthought, and where your work spans hands-on infrastructure and meaningful compliance contribution then this could be the role for you. Why this role might be a great fit for you You might be a cloud or platform engineer who has grown into security. Or a security engineer who is genuinely hands-on with infrastructure. Either way, you'll thrive here if you: Have solid, hands-on AWS experience with a production estate. Comfortable with EKS, VPC, RDS, Lambda, S3, IAM, and CloudWatch Use Terraform as your primary IaC tool and think in version-controlled, automated infrastructure Understand CI/CD security, embedding checks into pipelines, keeping toolchains current, and knowing what good looks like Have real ISO 27001 exposure, not just awareness, but active involvement: evidence gathering, policy maintenance, audit support Have worked through a Cyber Essentials or Cyber Essentials Plus certification cycle Are comfortable with SSO and identity management, including onboarding applications and supporting SAML integrations Are comfortable moving between deep technical work, and adapting to provide clear non-technical communication to stakeholders Are self-directed and able to manage competing priorities across engineering delivery and compliance obligations without constant direction Think about security as something you embed, not bolt on Are curious about applying AI and ensuring it adds value, by making security and platform knowledge available within our business, and ensuring the correct level of information is available to our customers. If most of that resonates, even if your path has been unconventional, we'd love to hear from you. Our Stack Infrastructure & DevOps AWS (EKS, Lambda, RDS/Postgres, DynamoDB, SQS, Kinesis, S3, Cognito, Route53, VPC, EC2) Terraform, Kubernetes, Helm, Ansible, Puppet GitLab CI Observability & Security Prometheus, Grafana, OpenSearch, CloudWatch Okta (SSO / IdP) Vulnerability management, secrets management, penetration test tooling Application layer (context, not expectation) Scala, Kotlin, TypeScript, Python, built by the engineering team; you'll need to navigate the codebase, not own it You don't need experience in every tool, but you should feel confident in modern cloud-native, infrastructure-as-code environments, and you should have genuine hands-on AWS depth. Our Engineering Philosophy We believe in automation, with IaC, and version control at the heart of everything We run Kanban and focus on the smallest effort that delivers meaningful impact We favour simple, maintainable architectures over unnecessary complexity We practice TDD and maintain comprehensive automated test suites We follow functional programming principles We evolve our ways of working through team retrospectives What you’ll do Engineering & Platform Own our AWS infrastructure, ensuring everything is built and maintained using Infrastructure-as-Code principles via Terraform. Maintain and iterate on the network and security boundaries across our infrastructure estate: VPC, ACLs, and related controls. Maintain our Okta SSO integration and certificate management, including onboarding new SSO applications and supporting customer SAML integrations. Ensure our CI/CD toolchain stays current with relevant security checks, keeping pipelines trusted and production deployments stable. Own our platform security controls: vulnerability management, penetration test remediation, secrets management, and least-privilege access. Run our observability and monitoring platforms (Prometheus, Grafana, OpenSearch, CloudWatch), tuning alerts and driving improvements into the delivery pipeline. Continuously review and optimise our AWS infrastructure: Cost monitoring, right-sizing, capacity planning, reporting clearly to the Head of Engineering on where changes are needed. Support the design and architecture of new features with a security-first lens, working alongside software engineering teams. Script for system and server administration and deployments; automate manual operational tasks for developers and non-developers alike. Act as the first point of contact for infrastructure queries across the team, maintaining clear and current documentation accessible to all colleagues. Information Security Provide the technical response to security incidents, including containment, eradication, and recovery, escalating to the CFO and Head of Engineering as required. Conduct DPIA technical reviews for new and existing software tools, working with CFO and Infosec colleagues to provide clear recommendations. Manage day-to-day access control administration, applying agreed standards, supporting privileged access reviews, and maintaining SSO/IdP configuration. Review and contribute accurate, contextual content to RFP and customer security questionnaire responses using our pre-approved content library. Support the ISO 27001 ISMS programme, gathering and presenting evidence for internal audit and management review cycles. Support the Cyber Essentials and Cyber Essentials Plus certification cycle, evidence gathering and assessor liaison. Maintain the corporate information security risk register and prepare updates for CFO review. Keep information security policies current and flag overdue reviews, operating under direction from the CFO. Scan the regulatory horizon for developments in NIS2, DORA, and evolving CE+ scope, flagging implications to the CFO. Support the ISMS Steering Committee with technical input and prepared material. Support breach notification obligations under UK GDPR, liaising with the Data Protection Officer and legal counsel as required. Produce clear, jargon-free security guidance and runbooks for non-technical colleagues. What you’ll get at Arctic Shores Competitive salary - £55-65k depending on experience. Share Options scheme 28 days holiday + public holidays (plus extra for length of service) Private medical and mental health cover 2 mental wellbeing days per year Aviva pension (3% employer / 5% employee) Hybrid working and core hours flexibility Enhanced parental leave Fertility support Company sick pay Own Days (one day every month dedicated to your development) Cycle2Work scheme Length of service awards Central Manchester office location A supportive team and a meaningful mission The closing date for applications is Monday 31 August 2026 Our values Make a difference We can’t change everything. But we can contribute to a world of work that’s truly fair and inclusive. Grow together We invest in our ability, learn from setbacks, and celebrate the people behind our progress. Explore, always Curiosity, drive and bravery help us break new ground and rethink how potential is measured. Applying for the role If this role excites you but you don’t tick every box - we’d still love to hear from you. Our hiring process includes but is not limited to: Short application form A job related preview Our task-based assessment (you’ll receive instant feedback) “Get to know you” conversations Technical assessment and technical interview We’re interested in how you think, how you lead, and how you build, not just the logos on your CV. Using AI in your application Feel free to use AI tools to help structure your thinking or prepare but we want to see the real you. Equal Opportunities At Arctic Shores, giving people a fair chance is what we do — and that starts with hiring. We welcome people of any background, gender identification, race, religion, national origin, sexual orientation, ability level, age, size, marital status, style, or music taste. If you need adjustments at any stage of the process, let us know — we’ll do everything we can to support you. Compliance ISO 27001 Cyber Essentials compliant Department Technology Locations Manchester - Registered Office Remote status Hybrid Manchester - Registered Office Why Arctic Shores? A place to belong You'll join a team that's as driven as they are kind, focusing on one shared mission – to make hiring fairer, faster and (frankly) better. Dream of making a difference? You’ll be in good company. A product to believe in Our platform exists to give candidates of all backgrounds fair, equal access to the opportunities they'd otherwise miss. So far, we’ve helped almost 3m candidates land exactly where they should be. Help us take it further. A culture of freedom No two trailblazers work the same. That's why, at Arctic Shores, you'll enjoy all the flexibility and autonomy you need to get stuff done. Plus, you'll take an Own Day each month – a day for you to work on a personal project, to read, research, or develop new skills. However you want to work and grow, do it here. Company benefits 28 days holiday per year, plus public holidays. You'll also get an additional day for every year's service at Arctic Shores, up to four years. Private medical and mental health cover with Vitality for all our Explorers, as well as 2 mental wellbeing days each year. Aviva pension scheme, offering 3% employer and 5% employee contributions (calculated on full salary). Pension Salary Sacrifice scheme Hybrid working and core working hours Enhanced Parental Leave Fertility support programme Company Sick pay Share Options scheme Length of service awards Own Days – one day every month dedicated to your professional development. Whether you’re setting time aside for a personal project, some research, a course… it’s entirely up to you Cycle2Work scheme We’re always looking for new ways to celebrate our Explorers. You’ll be no different. Flexible & remote working We believe in giving you the autonomy to work in a way that suits you. Our hybrid model allows flexibility while ensuring collaboration. How often you are required in the office will be department dependent. We've got hubs in central London and Manchester, and they're there for you to make the most of. You can also shape work around your life at Arctic Shores, with our Core Hours. Whether you're fitting in a spin class or the school run, you'll have the flexibility for whatever matters most. Lastly, you'll get everything you need to do your work well. That means a laptop, monitor, and anything else you need to work comfortably and productively. About Arctic Shores Arctic Shores creates award-winning technologies that help companies make better people choices, and people better career choices. Since starting up in 2014, our pioneering task-based assessments have improved diversity, reduced time-to-hire and slashed recruitment costs at hundreds of organisations, including PwC, Siemens and the Ministry of Justice. Arctic Shores has also provided a unique, stress-free and unbiased experience to over 3m candidates.