Infrastructure as Code Engineer

Jonas Fintech is a growing, profitable SaaS business at the heart of the UK payments market. We operate two established brands, Paygate and London & Zurich, delivering mission-critical Direct Debit and Bacs payment solutions that help businesses collect and manage recurring revenue at scale.

The business has been commercially strong. We know how to sell, how to retain, and how to grow revenue. What we are now doing is matching that commercial engine with the product and technology capability it deserves. We are investing deliberately in modernisation, moving toward a product-driven model, and embedding AI across how we build, operate, and compete.

This role brings our AWS infrastructure under proper code control. You will start by auditing our existing AWS environment, including the current admin web application built by our lead DevOps engineer, to establish a baseline of what is automated, what is manual and, critically, what changes cannot currently be traced back to a cause.

From there you will design and build a modular Terraform codebase, proper CI/CD pipelines, and an on-demand ephemeral environment capability, while training our internal team to own and extend what you build after the engagement ends.

What You'll Be Doing:

• Audit our existing AWS environment, including the current admin web application, and assess what should be preserved, wrapped or retired as part of the target design.
• Design and implement a modular, reusable Terraform codebase covering our core AWS infrastructure (compute, networking, storage, IAM and managed services), replacing manual/console-driven provisioning and the parts of the existing admin tool that fall outside a proper audit trail.
• Set up remote state management with locking (for example S3 and DynamoDB) and encryption at rest, and define access controls so state files are never stored locally or committed to version control.
• Build and integrate CI/CD pipelines that plan, validate and apply Terraform changes automatically, including automated policy and security scanning (Checkov, tfsec) on every pull request.
• Establish version control workflows, module structure and environment separation (dev/staging/prod and demo) so every infrastructure change is peer reviewed, logged and attributable to a person and a pull request.
• Embed our existing compliance obligations into reusable modules and pipeline checks: secure configuration and patch/update tracking relevant to Cyber Essentials Plus, access control and logging relevant to ISO 27001, and change control and data handling discipline relevant to our Bacs Approved Bureau status.
• Sequence the migration plan so it does not put ISO 27001 certification at risk, given our audit falls within this contract window.
• Design and build an on-demand ephemeral environment capability: a full, isolated stack that a developer or QA engineer can spin up on demand, run a complete test pass against, and tear down automatically afterward.
• Ensure any fixture or seed data used in ephemeral test environments is synthetic or properly masked, not copied production data.
• Document architecture decisions, runbooks and module usage so the environment is maintainable after the engagement ends.
• Deliver hands-on training and workshops for the internal CTO, DevOps and infrastructure team, pairing with staff, including the lead DevOps engineer who built the current admin tool, on real migration work.
• Define a phased migration plan that brings existing infrastructure under code without service disruption, prioritising the highest risk manual and unaudited changes first.
• Produce a transition and handoff plan and knowledge transfer materials ahead of contract end, with a clear list of what the internal team owns going forward.

The Candidate Profile:

• Proven hands-on Terraform experience at an enterprise level: module design, state management, workspaces and multi-environment patterns.
• Deep working knowledge of AWS services: EC2, VPC, IAM, RDS/Aurora, ECS/EKS, Lambda, ELB, S3.
• Experience building CI/CD pipelines for infrastructure (GitHub Actions, GitLab CI, Jenkins or CircleCI).
• Experience designing ephemeral/on-demand environments.
• Scripting ability in Python and/or Bash for automation and tooling glue.
• Experience with IaC security and compliance scanning tools (Checkov, tfsec or similar) and secrets management.
• Experience embedding audit trails and change control evidence into infrastructure workflows.
• Working familiarity with UK compliance regimes relevant to us: ISO 27001 controls, Cyber Essentials Plus control areas, and Bacs Approved Bureau requirements.
• Demonstrated experience training, mentoring or upskilling engineering teams.
• Experience leading or contributing to a brownfield migration.
• Strong written documentation skills.

This is a remote contract. There is an expectation to meet in person, around four to five times a year, at all-company town hall events and/or Vesta Group events. Travel expenses for these are covered by the company.

What We Offer:

• A competitive package structured to reflect the seniority of the role and reward the commercial outcomes we expect.
• 25 days annual leave plus a day for your birthday or significant celebration.
• Private Health Insurance.
• Life Assurance at 4x base salary.
• Enhanced company pension contribution.
• Personal Travel Insurance.
• Access to Benefiz benefits platform and a range of opt-in benefits.
• Electric/Hybrid Vehicle scheme and Cycle to Work scheme.
• 10-day rolling sick plan including extended illness pay.
• EAP and Mental Health First Aider support.

We believe that diverse teams build better businesses. Jonas Fintech is committed to an environment where everyone feels valued, heard, and empowered to do their best work. We actively encourage applications from candidates of all backgrounds, including those from underrepresented groups, and are committed to an accessible and inclusive hiring process throughout.

We are open to flexible working arrangements and will consider both full-time and part-time candidates. Please talk to us about what works for you.

Interested candidates should apply in confidence.