DevOps Engineer

Responsibilities

• Multi-Account AWS Architecture: Administer and harden a multi-account AWS Organization (production, development, and monitoring accounts) with least-privilege IAM, proper root/administrative credential hygiene, and durable secrets management (moving off ad-hoc password storage onto a modern secrets manager).
• Compute & Scaling: Manage EC2 fleets behind Application Load Balancers, Auto Scaling Groups, and launch templates backed by a golden-AMI deployment pipeline. Modernize legacy standalone instances toward containerized (ECR/ECS) or more resilient patterns where appropriate.
• Databases: Administer Amazon Aurora MySQL clusters (multi-database, multi-tenant schemas), including read replica strategies, credential scoping (moving application traffic off shared/master database users onto least-privilege service accounts), and CDC-based real-time data pipelines (Epsio) feeding BI and marketing systems.
• Networking & Access: Operate a Tailscale-based zero-trust network (ACLs, subnet routers, tagged service identities) as the primary access layer, including migrating legacy DNS off an outdated registrar onto modern DNS/CDN infrastructure (Cloudflare / Route 53).
• CI/CD: Own and improve GitLab CI/CD pipelines (OIDC-based AWS role assumption, environment-scoped deploys, secrets-as-CI-variables) across a PHP monolith and a Laravel application. Drive the migration of hardcoded application secrets into properly managed CI/CD variables and parameter stores.
• Observability & Incident Response: Build out robust monitoring where gaps exist today (CloudWatch Logs/Alarms/Synthetics, external uptime monitoring, WAF logging), define on-call/runbook practices, and lead production incident response, including root-cause writeups (RCAs).
• Security Posture: Manage AWS WAF rules, resolve longstanding dependency/Composer security advisories, own certificate lifecycle management (TLS, Apple Pay/payment-processing certs), and proactively reduce accumulated operational risk across historically under-resourced infrastructure.
• Cross-Team Support: Work directly with a small in-house engineering team and outside contractors, interfacing with third-party MSPs supporting sibling properties.

Qualifications

• 5+ years in a DevOps, SRE, or Infrastructure role with deep, hands-on AWS experience (configuring IAM policies, debugging Aurora replication, tuning Auto Scaling, and writing CloudFormation or Terraform from scratch).

Required Skills

• Proven production incident experience: A track record of diagnosing live outages under pressure, identifying true root causes, and implementing comprehensive permanent fixes (across config, image/AMI, and CI/CD) rather than temporary workarounds.
• Strong Linux systems administration fundamentals: In-depth knowledge of filesystems, systemd, log management, disk/volume operations, and recovering host access when standard channels (SSH key, SSM agent) are unavailable.
• CI/CD pipeline expertise: Solid experience designing CI/CD pipelines (GitLab CI/CD strongly preferred) and implementing secure secrets management patterns.
• Pragmatic approach across legacy & modern stacks: Comfort supporting and progressively modernizing a 10+ year-old PHP codebase while simultaneously building reliability tooling for modern Laravel applications.
• Sound production risk judgment: Excellent instincts regarding when to move fast, when to require peer review, and how to communicate operational status clearly to non-technical stakeholders.

Preferred Skills

• Experience with CDC/real-time data replication tools (Debezium, Epsio, or similar).
• Experience with Tailscale or another zero-trust/mesh VPN platform.
• Payment processing or PCI-adjacent infrastructure experience.
• Prior experience as the first dedicated DevOps hire at a company, building engineering standards and practices from the ground up.
• Experience integrating modern AI coding/ops tools (e.g., Claude Code or similar) into your daily workflow for incident diagnostics, code reviews, and infrastructure automation.

Required Skills

Our Tech Stack

• AWS Infrastructure: EC2, Aurora MySQL (RDS), Application Load Balancers (ALB), Auto Scaling Groups (ASG), S3, Storage Gateway, ElastiCache (Memcached), CloudWatch (Logs, Alarms, Synthetics, Internet Monitor), Systems Manager (Session Manager, Parameter Store), IAM & AWS Organizations, SES, WAFv2, CloudFormation.
• Application Layers: Legacy PHP (no framework) & Laravel (PHP framework); Apache/PHP-FPM & NGINX; Composer dependency management.
• Data & BI: Aurora MySQL, Epsio (CDC/real-time materialized views), Sigma (BI), Metabase (legacy BI, being retired).
• Networking & Security: Tailscale (Zero-Trust mesh VPN, ACL policy management), Cloudflare (DNS/CDN), Route 53 / legacy DNS providers.
• CI/CD & Tooling: GitLab CI/CD, OIDC-based cloud role assumption, PhpStorm/JetBrains tooling, LastPass (transitional—secrets manager migration planned).
• Third-Party Integrations: Payment processing (CardPointe/CardConnect, Apple Pay, Google Pay, PayPal), SMS/messaging (Twilio, Plivo), CRM/marketing (HubSpot), accounting exports.