Senior DevSecOps Engineer

Arctic Shores; Manchester; Hybrid; GBP 55,000 - 65,000; Full time

Benefits offered by this job

Share Options

Hybrid working

Private medical

Pension

Manchester office

Job summary

Arctic Shores in Manchester is seeking a Senior DevSecOps Engineer to secure and scale our AI-powered hiring platform. You’ll own AWS infrastructure, network and security boundaries, CI/CD security tooling, and platform controls, while bridging engineering and information security with a security-first mindset.

You'll collaborate across teams to implement ISO 27001 and Cyber Essentials controls, support incident response, and ensure secure, scalable deployments in a cloud-native,

Qualifications

• Hands-on AWS experience with production estate (EKS, VPC, RDS, Lambda, S3, IAM, CloudWatch).
• Terraform-focused IaC and automated infrastructure mindset.
• Experience embedding CI/CD security checks into pipelines and tooling.
• Active involvement in ISO 27001 exposure, policy maintenance, audit support.
• Experience through Cyber Essentials/Cyber Essentials Plus cycles.
• SSO/IdP management incl. onboarding apps and SAML integrations.

Responsibilities

• Own AWS infrastructure and maintain IaC with Terraform.
• Maintain network and security boundaries (VPC, ACLs, controls).
• Manage Okta SSO integration and certificate management, including SAML.
• Ensure CI/CD toolchain includes security checks and trusted pipelines.
• Own platform security controls: vulnerability management, secrets, least privilege access.
• Operate observability/monitoring: Prometheus, Grafana, OpenSearch, CloudWatch; tune alerts.
• Continuously optimise AWS infrastructure: cost, capacity, reporting to Head of Engineering.
• Support security-focused feature design with engineering teams.
• Script for deployments and automate repetitive tasks.
• Maintain documentation for infrastructure queries across team.

Skills

AWS

Kubernetes

Terraform

CI/CD Security

Security Incident Response

ISO 27001

Cyber Essentials

SAML / SSO

Networking

Tools

Terraform

Kubernetes

GitLab CI

Prometheus

Grafana

OpenSearch

CloudWatch

Okta

Job description

Help build the future of fair hiring in the AI era.

At Arctic Shores, we're creating a world of work where potential matters more than experience.

Our market-leading, task-based psychometric assessments help organisations like Amazon, Siemens and Jet2 make fair, evidence-based hiring decisions. We've doubled ARR year-on-year for the past three years and are looking for a Senior DevSecOps Engineer to help secure and scale the next chapter.

The opportunity

This is a rare chance to provide technical guidance and leadership across our platform, and play a senior hands-on role in shaping our security posture of a purpose-driven scale-up where technical excellence is genuinely important.

You’ll be a hands-on practitioner sitting at the intersection of platform engineering and information security, working with an event-driven architecture running on Kubernetes and underpinned by AWS. You’ll be embedded within an engineering team that values excellence, aims high, and means it. On the engineering side, you'll own our AWS infrastructure, network and security boundaries, CI/CD security tooling, and platform controls. On the information security side, you'll provide the technical expertise that underpins our ISO 27001 and Cyber Essentials certifications, incident response, and day-to-day governance.

If you've always wanted to work somewhere that treats security as a first-class concern rather than an afterthought, and where your work spans hands-on infrastructure and meaningful compliance contribution then this could be the role for you.

Why this role might be a great fit for you

You might be a cloud or platform engineer who has grown into security. Or a security engineer who is genuinely hands-on with infrastructure. Either way, you'll thrive here if you:

• Have solid, hands-on AWS experience with a production estate. Comfortable with EKS, VPC, RDS, Lambda, S3, IAM, and CloudWatch
• Use Terraform as your primary IaC tool and think in version-controlled, automated infrastructure
• Understand CI/CD security, embedding checks into pipelines, keeping toolchains current, and knowing what good looks like
• Have real ISO 27001 exposure, not just awareness, but active involvement: evidence gathering, policy maintenance, audit support
• Have worked through a Cyber Essentials or Cyber Essentials Plus certification cycle
• Are comfortable with SSO and identity management, including onboarding applications and supporting SAML integrations
• Are comfortable moving between deep technical work, and adapting to provide clear non-technical communication to stakeholders
• Are self-directed and able to manage competing priorities across engineering delivery and compliance obligations without constant direction
• Think about security as something you embed, not bolt on
• Are curious about applying AI and ensuring it adds value, by making security and platform knowledge available within our business, and ensuring the correct level of information is available to our customers.

If most of that resonates, even if your path has been unconventional, we'd love to hear from you.

Our Stack

Infrastructure & DevOps

• AWS (EKS, Lambda, RDS/Postgres, DynamoDB, SQS, Kinesis, S3, Cognito, Route53, VPC, EC2)
• Terraform, Kubernetes, Helm, Ansible, Puppet
• GitLab CI

Observability & Security

• Prometheus, Grafana, OpenSearch, CloudWatch
• Okta (SSO / IdP)
• Vulnerability management, secrets management, penetration test tooling

Application layer (context, not expectation)

• Scala, Kotlin, TypeScript, Python, built by the engineering team; you’ll need to navigate the codebase, not own it

You don't need experience in every tool, but you should feel confident in modern cloud-native, infrastructure-as-code environments, and you should have genuine hands-on AWS depth.

Our Engineering Philosophy

• We believe in automation, with IaC, and version control at the heart of everything
• We run Kanban and focus on the smallest effort that delivers meaningful impact
• We favour simple, maintainable architectures over unnecessary complexity
• We practice TDD and maintain comprehensive automated test suites
• We follow functional programming principles
• We evolve our ways of working through team retrospectives

What you’ll do

Engineering & Platform

• Own our AWS infrastructure, ensuring everything is built and maintained using Infrastructure-as-Code principles via Terraform.
• Maintain and iterate on the network and security boundaries across our infrastructure estate: VPC, ACLs, and related controls.
• Maintain our Okta SSO integration and certificate management, including onboarding new SSO applications and supporting customer SAML integrations.
• Ensure our CI/CD toolchain stays current with relevant security checks, keeping pipelines trusted and production deployments stable.
• Own our platform security controls: vulnerability management, penetration test remediation, secrets management, and least-privilege access.
• Run our observability and monitoring platforms (Prometheus, Grafana, OpenSearch, CloudWatch), tuning alerts and driving improvements into the delivery pipeline.
• Continuously review and optimise our AWS infrastructure: Cost monitoring, right-sizing, capacity planning, reporting clearly to the Head of Engineering on where changes are needed.
• Support the design and architecture of new features with a security‑first lens, working alongside software engineering teams.
• Script for system and server administration and deployments; automate manual operational tasks for developers and non-developers alike.
• Act as the first point of contact for infrastructure queries across the team, maintaining clear and current documentation accessible to all colleagues.

Information Security

• Provide the technical response to security incidents, including containment, eradication, and recovery, escalating to the CFO and Head of Engineering as required.
• Conduct DPIA technical reviews for new and existing software tools, working with CFO and Infosec colleagues to provide clear recommendations.
• Manage day-to-day access control administration, applying agreed standards, supporting privileged access reviews, and maintaining SSO/IdP configuration.
• Review and contribute accurate, contextual content to RFP and customer security questionnaire responses using our pre-approved content library.
• Support the ISO 27001 ISMS programme, gathering and presenting evidence for internal audit and management review cycles.
• Support the Cyber Essentials and Cyber Essentials Plus certification cycle, evidence gathering and assessor liaison.
• Maintain the corporate information security risk register and prepare updates for CFO review.
• Keep information security policies current and flag overdue reviews, operating under direction from the CFO.
• Scan the regulatory horizon for developments in NIS2, DORA, and evolving CE+ scope, flagging implications to the CFO.
• Support the ISMS Steering Committee with technical input and prepared material.
• Support breach notification obligations under UK GDPR, liaising with the Data Protection Officer and legal counsel as required.
• Produce clear, jargon-free security guidance and runbooks for non-technical colleagues.

What you’ll get at Arctic Shores

• Competitive salary - £55-65k depending on experience.
• Share Options scheme
• 28 days holiday + public holidays (plus extra for length of service)
• Private medical and mental health cover
• 2 mental wellbeing days per year
• Aviva pension (3% employer / 5% employee)
• Hybrid working and core hours flexibility
• Enhanced parental leave
• Fertility support
• Company sick pay
• Own Days (one day every month dedicated to your development)
• Cycle2Work scheme
• Length of service awards
• Central Manchester office location
• A supportive team and a meaningful mission

The closing date for applications is Monday 31 August 2026

Our values

Make a difference
We can’t change everything. But we can contribute to a world of work that’s truly fair and inclusive.

Grow together
We invest in our ability, learn from setbacks, and celebrate the people behind our progress.

Explore, always
Curiosity, drive and bravery help us break new ground and rethink how potential is measured.

Applying for the role

If this role excites you but you don’t tick every box - we’d still love to hear from you.

Our hiring process includes but is not limited to:

• Short application form
• A job related preview
• Our task-based assessment (you’ll receive instant feedback)
• “Get to know you” conversations
• Technical assessment and technical interview

We’re interested in how you think, how you lead, and how you build, not just the logos on your CV.

Using AI in your application

Feel free to use AI tools to help structure your thinking or prepare but we want to see the real you.

Equal Opportunities

At Arctic Shores, giving people a fair chance is what we do — and that starts with hiring.

We welcome people of any background, gender identification, race, religion, national origin, sexual orientation, ability level, age, size, marital status, style, or music taste.

If you need adjustments at any stage of the process, let us know — we’ll do everything we can to support you.

Compliance

ISO 27001

Cyber Essentials compliant