At Arctic Shores, we're creating a world of work where potential matters more than experience.
Our market-leading, task-based psychometric assessments help organisations like Amazon, Siemens and Jet2 make fair, evidence-based hiring decisions. We've doubled ARR year-on-year for the past three years and are looking for a Senior DevSecOps Engineer to help secure and scale the next chapter.
This is a rare chance to provide technical guidance and leadership across our platform, and play a senior hands-on role in shaping our security posture of a purpose-driven scale-up where technical excellence is genuinely important.
You'll be a hands-on practitioner sitting at the intersection of platform engineering and information security, working with an event-driven architecture running on Kubernetes and underpinned by AWS. You’ll be embedded within an engineering team that values excellence, aims high, and means it. On the engineering side, you'll own our AWS infrastructure, network and security boundaries, CI/CD security tooling, and platform controls. On the information security side, you'll provide the technical expertise that underpins our ISO 27001 and Cyber Essentials certifications, incident response, and day-to-day governance.
If you've always wanted to work somewhere that treats security as a first-class concern rather than an afterthought, and where your work spans hands-on infrastructure and meaningful compliance contribution then this could be the role for you.
You might be a cloud or platform engineer who has grown into security. Or a security engineer who is genuinely hands-on with infrastructure. Either way, you'll thrive here if you:
Have solid, hands-on AWS experience with a production estate. Comfortable with EKS, VPC, RDS, Lambda, S3, IAM, and CloudWatch
Use Terraform as your primary IaC tool and think in version-controlled, automated infrastructure
Understand CI/CD security, embedding checks into pipelines, keeping toolchains current, and knowing what good looks like
Have real ISO 27001 exposure, not just awareness, but active involvement: evidence gathering, policy maintenance, audit support
Have worked through a Cyber Essentials or Cyber Essentials Plus certification cycle
Are comfortable with SSO and identity management, including onboarding applications and supporting SAML integrations
Are comfortable moving between deep technical work, and adapting to provide clear non-technical communication to stakeholders
Are self-directed and able to manage competing priorities across engineering delivery and compliance obligations without constant direction
Think about security as something you embed, not bolt on
Are curious about applying AI and ensuring it adds value, by making security and platform knowledge available within our business, and ensuring the correct level of information is available to our customers.
If most of that resonates, even if your path has been unconventional, we'd love to hear from you.
Infrastructure & DevOps
AWS (EKS, Lambda, RDS/Postgres, DynamoDB, SQS, Kinesis, S3, Cognito, Route53, VPC, EC2)
Terraform, Kubernetes, Helm, Ansible, Puppet
GitLab CI
Observability & Security
Prometheus, Grafana, OpenSearch, CloudWatch
Okta (SSO / IdP)
Vulnerability management, secrets management, penetration test tooling
Application layer (context, not expectation)
Scala, Kotlin, TypeScript, Python, built by the engineering team; you'll need to navigate the codebase, not own it
You don't need experience in every tool, but you should feel confident in modern cloud-native, infrastructure-as-code environments, and you should have genuine hands-on AWS depth.
We believe in automation, with IaC, and version control at the heart of everything
We run Kanban and focus on the smallest effort that delivers meaningful impact
We favour simple, maintainable architectures over unnecessary complexity
We practice TDD and maintain comprehensive automated test suites
We follow functional programming principles
We evolve our ways of working through team retrospectives
Engineering & Platform
Own our AWS infrastructure, ensuring everything is built and maintained using Infrastructure-as-Code principles via Terraform.
Maintain and iterate on the network and security boundaries across our infrastructure estate: VPC, ACLs, and related controls.
Maintain our Okta SSO integration and certificate management, including onboarding new SSO applications and supporting customer SAML integrations.
Ensure our CI/CD toolchain stays current with relevant security checks, keeping pipelines trusted and production deployments stable.
Own our platform security controls: vulnerability management, penetration test remediation, secrets management, and least-privilege access.
Run our observability and monitoring platforms (Prometheus, Grafana, OpenSearch, CloudWatch), tuning alerts and driving improvements into the delivery pipeline.
Continuously review and optimise our AWS infrastructure: Cost monitoring, right-sizing, capacity planning, reporting clearly to the Head of Engineering on where changes are needed.
Support the design and architecture of new features with a security-first lens, working alongside software engineering teams.
Script for system and server administration and deployments; automate manual operational tasks for developers and non-developers alike.
Act as the first point of contact for infrastructure queries across the team, maintaining clear and current documentation accessible to all colleagues.
Information Security
Provide the technical response to security incidents, including containment, eradication, and recovery, escalating to the CFO and Head of Engineering as required.
Conduct DPIA technical reviews for new and existing software tools, working with CFO and Infosec colleagues to provide clear recommendations.
Manage day-to-day access control administration, applying agreed standards, supporting privileged access reviews, and maintaining SSO/IdP configuration.
Review and contribute accurate, contextual content to RFP and customer security questionnaire responses using our pre-approved content library.
Support the ISO 27001 ISMS programme, gathering and presenting evidence for internal audit and management review cycles.
Support the Cyber Essentials and Cyber Essentials Plus certification cycle, evidence gathering and assessor liaison.
Maintain the corporate information security risk register and prepare updates for CFO review.
Keep information security policies current and flag overdue reviews, operating under direction from the CFO.
Scan the regulatory horizon for developments in NIS2, DORA, and evolving CE+ scope, flagging implications to the CFO.
Support the ISMS Steering Committee with technical input and prepared material.
Support breach notification obligations under UK GDPR, liaising with the Data Protection Officer and legal counsel as required.
Produce clear, jargon-free security guidance and runbooks for non-technical colleagues.
Competitive salary - £55-65k depending on experience.
Share Options scheme
28 days holiday + public holidays (plus extra for length of service)
Private medical and mental health cover
2 mental wellbeing days per year
Aviva pension (3% employer / 5% employee)
Hybrid working and core hours flexibility
Enhanced parental leave
Fertility support
Company sick pay
Own Days (one day every month dedicated to your development)
Cycle2Work scheme
Length of service awards
Central Manchester office location
A supportive team and a meaningful mission
Make a difference
We can’t change everything. But we can contribute to a world of work that’s truly fair and inclusive.
Grow together
We invest in our ability, learn from setbacks, and celebrate the people behind our progress.
Explore, always
Curiosity, drive and bravery help us break new ground and rethink how potential is measured.
If this role excites you but you don’t tick every box - we’d still love to hear from you.
Our hiring process includes but is not limited to:
Short application form
A job related preview
Our task-based assessment (you’ll receive instant feedback)
“Get to know you” conversations
Technical assessment and technical interview
We’re interested in how you think, how you lead, and how you build, not just the logos on your CV.
Feel free to use AI tools to help structure your thinking or prepare but we want to see the real you.
At Arctic Shores, giving people a fair chance is what we do — and that starts with hiring.
We welcome people of any background, gender identification, race, religion, national origin, sexual orientation, ability level, age, size, marital status, style, or music taste.
If you need adjustments at any stage of the process, let us know — we’ll do everything we can to support you.
ISO 27001
Cyber Essentials compliant
