Infrastructure as Code Engineer

ABOUT US

Jonas Fintech is a growing, profitable SaaS business at the heart of the UK payments market. We operate two established brands, Paygate and London & Zurich, delivering mission-critical Direct Debit and Bacs payment solutions that help businesses collect and manage recurring revenue at scale. Between them they serve a broad and loyal customer base built over more than 20 years of operating in this market.

The business has been commercially strong. We know how to sell, how to retain, and how to grow revenue. What we are now doing is matching that commercial engine with the product and technology capability it deserves. We are investing deliberately in modernisation, moving toward a product-driven model, and embedding AI across how we build, operate, and compete. This is the foundation for increasing the pace of the business's growth.

Jonas Fintech sits within Vesta Software Group, part of Jonas Software and Constellation Software Inc. This means we operate with the speed and focus of a standalone business, while having access to the capital, M&A pipeline, peer network, and long-term orientation of a global group operating across 17 countries. Vesta is a buy-and-hold acquirer of vertical market software businesses, in it for the long term, and Jonas Fintech is part of that family.

A full senior leadership team spanning commercial, product, technology, operations, and compliance is in place. The commercial infrastructure is established. The product investment cycle has started.

THE OPPORTUNITY

This role brings our AWS infrastructure under proper code control. You will start by auditing our existing AWS environment, including the current admin web application built by our lead DevOps engineer, to establish a baseline of what is automated, what is manual and, critically, what changes cannot currently be traced back to a cause.

From there you will design and build a modular Terraform codebase, proper CI/CD pipelines, and an on-demand ephemeral environment capability, while training our internal team to own and extend what you build after the engagement ends.

WHAT YOU'LL BE DOING

• Audit our existing AWS environment, including the current admin web application, and assess what should be preserved, wrapped or retired as part of the target design.
• Design and implement a modular, reusable Terraform codebase covering our core AWS infrastructure (compute, networking, storage, IAM and managed services), replacing manual/console-driven provisioning and the parts of the existing admin tool that fall outside a proper audit trail.
• Set up remote state management with locking (for example S3 and DynamoDB) and encryption at rest, and define access controls so state files are never stored locally or committed to version control.
• Build and integrate CI/CD pipelines that plan, validate and apply Terraform changes automatically, including automated policy and security scanning (Checkov, tfsec) on every pull request.
• Establish version control workflows, module structure and environment separation (dev/staging/prod and demo) so every infrastructure change is peer reviewed, logged and attributable to a person and a pull request.
• Embed our existing compliance obligations into reusable modules and pipeline checks: secure configuration and patch/update tracking relevant to Cyber Essentials Plus, access control and logging relevant to ISO 27001, and change control and data handling discipline relevant to our Bacs Approved Bureau status.
• Sequence the migration plan so it does not put ISO 27001 certification at risk, given our audit falls within this contract window. You are not responsible for managing or liaising on the audit itself, but the phasing, rollback approach and documentation must be aware of that date.
• Design and build an on-demand ephemeral environment capability: a full, isolated stack that a developer or QA engineer can spin up on demand, run a complete test pass against, and tear down automatically afterward.
• Ensure any fixture or seed data used in ephemeral test environments is synthetic or properly masked, not copied production data, given BAB rules on customer data handling and verification.
• Document architecture decisions, runbooks and module usage so the environment is maintainable after the engagement ends.
• Deliver hands-on training and workshops for the internal CTO, DevOps and infrastructure team, pairing with staff, including the lead DevOps engineer who built the current admin tool, on real migration work.
• Define a phased migration plan that brings existing infrastructure under code without service disruption, prioritising the highest risk manual and unaudited changes first.
• Produce a transition and handoff plan and knowledge transfer materials ahead of contract end, with a clear list of what the internal team owns going forward.

THE CANDIDATE PROFILE

Required Skills and Experience

• Proven hands-on Terraform experience at an enterprise level: module design, state management, workspaces and multi-environment patterns, not just tutorial-level familiarity.
• Deep working knowledge of AWS services: EC2, VPC, IAM, RDS/Aurora, ECS/EKS, Lambda, ELB, S3.
• Experience building CI/CD pipelines for infrastructure (GitHub Actions, GitLab CI, Jenkins or CircleCI).
• Experience designing ephemeral/on-demand environments (PR- or job-triggered stack creation and teardown, database seeding from masked snapshots or synthetic fixtures, automated cost/resource cleanup).
• Scripting ability in Python and/or Bash for automation and tooling glue.
• Experience with IaC security and compliance scanning tools (Checkov, tfsec or similar) and secrets management.
• Experience embedding audit trails and change control evidence into infrastructure workflows, able to speak concretely to how Terraform plus CI/CD produces the traceability an unaudited admin script cannot.
• Working familiarity with UK compliance regimes relevant to us: ISO 27001 controls (access control, logging, risk treatment), Cyber Essentials Plus control areas (secure configuration, patch management, access control), and Bacs Approved Bureau requirements around change control and data handling. Direct PCI-DSS experience is not required.
• Demonstrated experience training, mentoring or upskilling engineering teams; teaching ability is a hard requirement here, not a nice to have.
• Experience leading or contributing to a brownfield migration (existing manual/bespoke automation to IaC), including the judgement to assess and diplomatically integrate with tooling already built by internal staff.
• Strong written documentation skills, since your output is only as valuable as what the team can run without you afterward.

This is a remote contract. Please note that as with all of our colleagues across all of our business, there is an expectation to meet in person, around four to five times a year, at all-company town hall events and/or Vesta Group events. Travel expenses for these are covered by the company.

OUR COMMITMENT

We believe that diverse teams build better businesses. Jonas Fintech is committed to an environment where everyone feels valued, heard, and empowered to do their best work. We actively encourage applications from candidates of all backgrounds, including those from underrepresented groups, and are committed to an accessible and inclusive hiring process throughout.

We are open to flexible working arrangements and will consider both full-time and part-time candidates. Please talk to us about what works for you.