Senior DevOps Engineer

Gravity Payments is hiring a Senior DevOps Engineer to own and improve its cloud infrastructure, platforms, CI/CD, security controls, and engineering standards. The role also leads infrastructure incident response, supports production AI workloads, builds self-service and detection tooling, and mentors DevOps engineers.

Responsibilities:

• Develop and execute cloud strategies for AWS and Azure. Co-own the architecture of our cloud organization, including account structure, guardrails, and network topology, and review designs with product teams early to provide reusable patterns
• Own our container and serverless platforms, and optimize resource utilization and cost management in cloud environments, with cost attribution by team and product across cloud and AI spend
• Automate infrastructure management using Infrastructure as Code (IaC) tools (Pulumi in TypeScript), keep reviewed code as the only path to production, and detect and correct drift
• Own our GitHub organization and source control practices, including repository lifecycle, access, and privilege best practices
• Own the CI/CD pipelines every team ships through, including runners, deployment identities, software supply-chain controls, and release controls such as progressive rollout, health-gated promotion, and automated rollback
• Own infrastructure change control as pipeline policy, with approvals, separation of duties, risk assessment, and emergency-change handling enforced in CI and the harness, and every change traceable
• Co-own identity and access patterns across our cloud organization, with least-privilege access defined in code
• Standardize processes and procedures across platforms. Define, document, and continuously raise the standards for application environments, developer environments, and tooling, including which AI tools, models, and platforms we adopt and retire
• Participate in a 24/7 on-call rotation for incident response, lead infrastructure response during security and availability incidents, and run postmortems that eliminate root causes
• Analyze network traffic and manage firewall settings and route tables, including WAF rules, security groups, cardholder data environment (CDE) segmentation, and zero-trust network access
• Deeply understand and ensure adherence to cloud security best practices and provide Security and Compliance with automated evidence that PCI DSS and SOC 2 controls are operating
• Define and maintain the engineering harness our team works through, codifying our standards into the work our agents do so agent output meets the same expectations we hold human engineers to. Encode standards as rules, skills, permission tiers, and deterministic checks, manage prompts, skills, tools, and evaluation criteria as production code with review and tests, and turn recurring review findings into new checks
• Build and operate detection harnesses for CI, vulnerabilities, and attack vectors that combine deterministic controls, such as WAF rules and policy as code, with agentic analysis and feed automated blocking and SIEM correlation
• Apply DevOps standards to production AI workloads in the cloud, including model and agent hosting, agent identity and secrets, network isolation, observability, cost controls, release gates, and rollback
• Build self-service tooling for engineers and agents, including infrastructure capabilities exposed to agents as scoped, audited tools such as MCP servers
• Communicate infrastructure direction, changes, and progress to the infrastructure team, engineering teams, and leadership. Plan changes with the teams they affect, publish standards and changes where engineers can find them, and report progress against agreed metrics in the Weekly Business Review
• Mentor DevOps engineers through code review, pairing, and documentation

Requirements:

• Must have access to a wired internet connection and access to at least a 25 megabits per second (mbps) download and 20 mbps upload speed connection
• Track record of taking infrastructure projects from design through rollout, verification, documentation, and decommissioning of the systems they replace
• Track record of creating engineering standards or paved-path tooling that other teams adopted because it made their work easier
• Composure and sound judgment during incidents
• Commitment to secure-by-design principles, with experience in high compliance environments like banks, payments, or healthcare, including producing evidence for PCI DSS or SOC 2 assessors
• Extensive daily experience with coding agents and agent harnesses, including building harnesses that codify engineering standards so agent work meets the same expectations as human engineers' work, and sound judgment about where a standard needs a deterministic check or a human decision
• Experience deploying AI workloads in production with the identity, isolation, observability, release, and cost controls expected of any production service
• Ability to form and communicate a clear point of view on where infrastructure needs to go, its largest risks, and the order of work to get there
• Strong written communication, including design documents and RFCs that define the problem and its value first and explain dependencies and effects on other teams
• Ability to lead without direct authority across engineering teams and to raise team-level issues early
• (5+ years) Expertise in AWS, including multi-account organizations (Organizations or Control Tower, SCPs, IAM Identity Center) and VPC networking. Experience owning an entire AWS footprint, including account creation and organization-level guardrails
• (3+ years) Experience with Infrastructure as Code (IaC) tools like Pulumi or Terraform as the primary way infrastructure is built and changed, including importing hand-built resources and detecting drift
• Pulumi with TypeScript is preferred
• Experience with CI/CD in GitHub Actions, including OIDC federation to AWS, protected environments, reusable workflows, self-hosted runners, supply-chain controls such as SHA pinning, and progressive delivery with automated rollback
• Proficiency in packaging and deploying solutions in a containerized environment
• Strong coding skills in TypeScript and Python, with tested, reviewed code for infrastructure, tooling, and agents
• (2+ years) Hands-on experience building with coding agents and LLM tooling, such as Claude Code or Codex, MCP servers, agent skills, and agent permission models, including encoding team standards into agent rules and skills and integrating agent workflows into CI and code review
• Experience deploying and operating AI workloads in the cloud, such as Amazon Bedrock or model APIs behind a gateway and agents on ECS or Lambda, with scoped identities, secrets management, network isolation, logging, and cost controls
• Experience designing and implementing cloud-based application monitoring, creating relevant metrics, dashboards, and alarms, including SLOs and error budgets, with tools such as Datadog and CloudWatch and log delivery to a SIEM
• Experience with network and edge security, including AWS WAF or Cloudflare, security groups, route tables, Route 53 DNS delegation, TLS and certificate management, and zero-trust network access (Twingate or similar) with Okta as the identity provider
• Strong understanding of cloud security principles and best practices
• Experience with vulnerability management and security audits
• Experience debugging distributed systems in production, from application symptoms down to network and host
• Knowledge and experience with disaster recovery and business resiliency implementations
• Working knowledge of Azure (App Service, Azure SQL, DNS, network security groups)