Senior DevOps Engineer

A career with Gravity Payments is an opportunity to be on a collaborative team where creative leadership, passion for progress, and responsibility are paramount. Our team members focus and commit to providing for our clients and our community because we care deeply for others.

Success in this role looks like:

• Within 3 months: You are a required reviewer on infrastructure pull requests and change requests. You work through the team's engineering harness and have codified at least one of our standards into it, so agent work meets that standard by default. You have published a baseline for the team's delivery metrics, and you have taken over at least one in-flight infrastructure project.
• Within 6 months: You have led writing a standard for an application environment, developer environment, or tooling, and CI and AI harness enforce them where possible. Recurring review findings have become deterministic checks, and at least one detection harness combines deterministic rules with agentic analysis in production. Product teams and Security rely on you as an escalation point.
• Within 1 year: You are accelerating the definition and understanding of the standards we hold our application environments, developer environments, and tools to. You demonstrate that direction continuously and clearly to the infrastructure team, to engineering teams, and to leadership, so everyone understands the current standard, what changes next, and why.

Core Responsibilities

• Develop and execute cloud strategies for AWS and Azure. Co-own the architecture of our cloud organization, including account structure, guardrails, and network topology, and review designs with product teams early to provide reusable patterns.
• Own our container and serverless platforms, and optimize resource utilization and cost management in cloud environments, with cost attribution by team and product across cloud and AI spend.
• Automate infrastructure management using Infrastructure as Code (IaC) tools (Pulumi in TypeScript), keep reviewed code as the only path to production, and detect and correct drift.
• Own our GitHub organization and source control practices, including repository lifecycle, access, and privilege best practices.
• Own the CI/CD pipelines every team ships through, including runners, deployment identities, software supply-chain controls, and release controls such as progressive rollout, health-gated promotion, and automated rollback.
• Own infrastructure change control as pipeline policy, with approvals, separation of duties, risk assessment, and emergency-change handling enforced in CI and the harness, and every change traceable.
• Co-own identity and access patterns across our cloud organization, with least-privilege access defined in code.
• Standardize processes and procedures across platforms. Define, document, and continuously raise the standards for application environments, developer environments, and tooling, including which AI tools, models, and platforms we adopt and retire.
• Participate in a 24/7 on-call rotation for incident response, lead infrastructure response during security and availability incidents, and run postmortems that eliminate root causes.
• Analyze network traffic and manage firewall settings and route tables, including WAF rules, security groups, cardholder data environment (CDE) segmentation, and zero-trust network access.
• Deeply understand and ensure adherence to cloud security best practices and provide Security and Compliance with automated evidence that PCI DSS and SOC 2 controls are operating.
• Define and maintain the engineering harness our team works through, codifying our standards into the work our agents do so agent output meets the same expectations we hold human engineers to. Encode standards as rules, skills, permission tiers, and deterministic checks, manage prompts, skills, tools, and evaluation criteria as production code with review and tests, and turn recurring review findings into new checks.
• Build and operate detection harnesses for CI, vulnerabilities, and attack vectors that combine deterministic controls, such as WAF rules and policy as code, with agentic analysis and feed automated blocking and SIEM correlation.
• Apply DevOps standards to production AI workloads in the cloud, including model and agent hosting, agent identity and secrets, network isolation, observability, cost controls, release gates, and rollback.
• Build self-service tooling for engineers and agents, including infrastructure capabilities exposed to agents as scoped, audited tools such as MCP servers.
• Communicate infrastructure direction, changes, and progress to the infrastructure team, engineering teams, and leadership. Plan changes with the teams they affect, publish standards and changes where engineers can find them, and report progress against agreed metrics in the Weekly Business Review.
• Mentor DevOps engineers through code review, pairing, and documentation.

Preferred Skills

• Track record of taking infrastructure projects from design through rollout, verification, documentation, and decommissioning of the systems they replace.
• Track record of creating engineering standards or paved-path tooling that other teams adopted because it made their work easier.
• Composure and sound judgment during incidents.
• Commitment to secure-by-design principles, with experience in high compliance environments like banks, payments, or healthcare, including producing evidence for PCI DSS or SOC 2 assessors.
• Extensive daily experience with coding agents and agent harnesses, including building harnesses that codify engineering standards so agent work meets the same expectations as human engineers' work, and sound judgment about where a standard needs a deterministic check or a human decision.
• Experience deploying AI workloads in production with the identity, isolation, observability, release, and cost controls expected of any production service.
• Ability to form and communicate a clear point of view on where infrastructure needs to go, its largest risks, and the order of work to get there.
• Strong written communication, including design documents and RFCs that define the problem and its value first and explain dependencies and effects on other teams.
• Ability to lead without direct authority across engineering teams and to raise team-level issues early.
• (5+ years) Expertise in AWS, including multi-account organizations (Organizations or Control Tower, SCPs, IAM Identity Center) and VPC networking. Experience owning an entire AWS footprint, including account creation and organization-level guardrails.
• (3+ years) Experience with Infrastructure as Code (IaC) tools like Pulumi or Terraform as the primary way infrastructure is built and changed, including importing hand-built resources and detecting drift. Pulumi with TypeScript is preferred.
• Experience with CI/CD in GitHub Actions, including OIDC federation to AWS, protected environments, reusable workflows, self-hosted runners, supply-chain controls such as SHA pinning, and progressive delivery with automated rollback. Proficiency in packaging and deploying solutions in a containerized environment.
• Strong coding skills in TypeScript and Python, with tested, reviewed code for infrastructure, tooling, and agents.
• (2+ years) Hands-on experience building with coding agents and LLM tooling, such as Claude Code or Codex, MCP servers, agent skills, and agent permission models, including encoding team standards into agent rules and skills and integrating agent workflows into CI and code review.
• Experience deploying and operating AI workloads in the cloud, such as Amazon Bedrock or model APIs behind a gateway and agents on ECS or Lambda, with scoped identities, secrets management, network isolation, logging, and cost controls.
• Experience designing and implementing cloud-based application monitoring, creating relevant metrics, dashboards, and alarms, including SLOs and error budgets, with tools such as Datadog and CloudWatch and log delivery to a SIEM.
• Experience with network and edge security, including AWS WAF or Cloudflare, security groups, route tables, Route 53 DNS delegation, TLS and certificate management, and zero-trust network access (Twingate or similar) with Okta as the identity provider.
• Strong understanding of cloud security principles and best practices. Experience with vulnerability management and security audits.
• Experience debugging distributed systems in production, from application symptoms down to network and host.
• Knowledge and experience with disaster recovery and business resiliency implementations.
• Working knowledge of Azure (App Service, Azure SQL, DNS, network security groups). We communicate using Slack, store our code in GitHub repositories, write unit tests and automation, and build new solutions in the cloud (working in AWS and Azure). Our infrastructure is defined in Pulumi, changes reach production through pull requests and change requests, and coding agents work alongside every engineer on the team, held to the same standards.

This job description is a snapshot of the role at this moment in time. As our organization evolves, so do our roles. Responsibilities may shift to meet changing business needs. We seek individuals who are adaptable, proactive, and open to growth as we continue to move forward together.

Additional Requirements

• Must have access to a wired internet connection and access to at least a 25 megabits per second (mbps) download and 20 mbps upload speed connection.

Benefits

• Compensation: Competitive wage with Profit Sharing. Base pay without commissions and a unique opportunity to earn a share in company success.
• Comprehensive Benefits: Medical, dental, and vision coverage.
• Financial Security: 401(k) retirement plan and voluntary life insurance.
• Wellbeing: Time off when you need it, supporting both personal and professional sustainability. Open PTO available after one year.
• Career Growth: Training, mentorship, and development opportunities.
• Support & Stability: Short-term & long-term disability coverage and wellness resources.

The salary for this position is $160,000 - $180,000. We may be open to negotiating outside of this range if the desired salary aligns with the needs of the candidate and the company.

Gravity Payments is an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity/expression, age, disability status, protected veteran status, or any other characteristic protected by law.

Gravity Payments collects and processes personal data in accordance with applicable data protection laws. If you are a California Job Applicant see the privacy notice for further details.