DevSecOps Engineer in City of London

DevSecOps Engineer - FlatPlan

UK-based remote model

Work hours: 10am–6pm GMT, Monday to Friday

Summary

FlatPlan is the leading Apple News technology and strategy provider, working with 230+ consumer publishers including The Atlantic, The Athletic, Vox Media and the Premier League. We're a preferred provider to Apple, helping the world's biggest publishers reach hundreds of millions of readers through Apple News and beyond. We're profitable, growing, and scaling sanely: a sharp team doing meaningful work at pace.

The Role:

We're hiring a DevSecOps Engineer to support our growth in building out and harden the foundations our platform runs on whilst having a close eye and mindset about security.

This is a hands-on engineering role with a security mindset at its core. You'll own how we build, deploy, run and secure our platform: support the build of our future pipelines that ship our code, the cloud services it runs on, the way we keep it reliable, and the way we keep it safe. Security at FlatPlan is a shared responsibility and we want the whole team writing secure code, but you are the person who owns the standard, keeps us honest, and is accountable for it.

We are looking for somebody to help us grow our pipelines, automation and cloud tooling deliberately as we scale, so there's real room to shape how we do it. When there's focused security or hardening work to do, you lead it: assessing what we run, closing the risks that matter, and raising the baseline. When that's in good shape, you keep adding value on the robustness, performance and reliability of the platform our publishers depend on.

We expect you to be fluent with AI development tools (Claude Code, Cursor, Copilot, or equivalent) and to use them daily, for writing and reviewing code, automating work, and finding ways to ship faster and safer.

What you'll own will include a mix of:

• CI/CD pipelines and deployment: building, automating and improving how our code ships
• Cloud infrastructure on AWS: configuration, automation, and sensible, secure operations
• Security across the platform: secure coding standards, the OWASP Top 10, hardening, secrets, and staying on top of vulnerabilities and updates
• Reliability and robustness: observability, alerting, and a steady pair of hands when an incident needs handling
• Making secure, reliable practices part of how the whole team builds
• Bringing AI assisted approaches into how we build, automate, harden and ship

How we're setup

We build primarily with JavaScript and TypeScript, using Node.js. We use a JSON format called Apple News Format for Apple News delivery, which we will provide training on. Our data runs on MongoDB, and we use AWS for our cloud services.

We are building out our pipelines, automation and infrastructure as we grow, so you'll have genuine ownership to shape how we do it rather than inheriting a fixed estate. We're always open to innovation and opinions on the tooling and approaches that will serve us best, and you'll be supported by a team with a strong understanding of our current product and great ideas for the future.

Why you should apply

FlatPlan is a small, lean team with backgrounds at Stripe, New York Times Company and Apple. We're fully remote but intentional about connection: randomised social 1:1s, Friday socials, a virtual office and optional UK meet ups four time a year. We share knowledge openly and regularly, and genuinely care about each other.

We are a profitable company, formed in 2019 and backed by TinySeed. Our relationship with Apple runs deep: we are Apple's preferred provider for Apple News, and following a period of assessment, a direct supplier to Apple. We want this team to reflect the breadth of the publishers and audiences we serve. We strongly encourage applicants from underrepresented backgrounds to apply. All qualified candidates will be considered regardless of race, gender, identity, orientation, disability or background.

Requirements

Must-haves:

• Significant commercial DevOps experience: building and running CI/CD pipelines, deployment, and cloud infrastructure in production
• Strong AWS: configuration, automation, and the security basics done well, including IAM, secrets handling and least privilege
• A genuine security mindset: fluent in secure coding practices and the OWASP Top 10, and able to spot and fix real risk across code and infrastructure
• Comfortable automating with infrastructure as code and scripting, and keeping systems robust, observable and up to date
• MongoDB, ideally Atlas, with a sense of how to secure, configure and operate it safely
• Able to read and work in a JavaScript and TypeScript codebase well enough to review it, secure it, and support the engineers building it
• Sound instincts for reliability and incident response: monitoring, alerting, and staying calm when something breaks
• Comfortable making technical decisions with minimal oversight, and bringing the rest of the team along with you
• Daily, practical use of AI tooling in your workflow
• Comfortable in git workflows and agile teams
• UK based, able to work core hours 10am–6pm GMT

Nice-to-haves:

• Formal security exposure such as threat modelling, penetration testing awareness, or a security certification
• Specific tooling experience such as Terraform, Docker, Kubernetes or GitHub Actions
• Experience mentoring or reviewing other engineers' work
• Publishing or media background
• Exposure to Apple News Format (we'll train you regardless)

#J-18808-Ljbffr