Job description
We are looking for a Senior DevOps Engineer to join our team!
You will own and evolve Mailtrap's production infrastructure — a multi-region AWS platform powering high-volume email sending and testing. You will keep it reliable, secure, and cost-efficient day to day.
You will also lead a key strategic initiative: planning and executing a partial migration of selected workloads from AWS to rented bare-metal / colocation infrastructure to cut costs — a hybrid-by-design effort, not a full cloud exit.
You will decide what moves and what stays, design the target platform (likely Kubernetes or a similar orchestrator on bare metal), and own the migration end to end, from business case to cutover.
Our engineering team thrives in an agile, continuously improving, and automation-oriented environment. We value ongoing evolution, objective evaluation of our processes, and taking action to make things better.
Must have skills
5+ years DevOps/platform (senior), production ownership
Deep AWS (VPC, ECS, IAM, RDS/ElastiCache or equivalents, networking)
Terraform at scale (modules, remote state / Terraform Cloud)
CI/CD with GitHub Actions, including automated deploys to production (e.g. blue/green deployments)
Containers (Docker); comfortable operating services on ECS or K8s
Strong Linux networking (DNS, TLS, load balancing, firewalls, VPN/hybrid)
Proven experience planning and executing migration to on-prem, colo, or private cloud (partial/hybrid OK — full exit not required)
Comfortable owning a multi-quarter infra initiative: TCO, design, vendors, cutover, rollback
Comfortable automating operational tasks with shell and/or Python
Fluent English (both spoken and written)
Strongly preferred
Colo/bare-metal ops: IPAM (NetBox), Ansible, image-based provisioning (Packer or equivalent), HAProxy/Nginx
Replacing managed AWS services with self-hosted (Postgres HA, Redis/Valkey, Kafka, OpenSearch)
Email infrastructure (MTA, SMTP, IP reputation, DKIM/SPF/DMARC) — Halon or similar
Cloudflare (DNS/WAF/Access)
Observability beyond CloudWatch (Prometheus/Grafana/Loki or equivalent)
Prior work with multi-region SaaS or EU data residency
Cost-driven architecture / FinOps mindset
Would be a plus
GCP (BigQuery/certificates)
Comfortable reading Ruby or Go (used in our services and tooling)
AWS Certificates
Responsibilities day-to-day
Operate and evolve AWS multi-account / multi-region infra
Terraform modules/workspaces
Ensure safe infrastructure changes across network, storage, and services, with zero-downtime deployments.
ECS services, blue/green deploys, Docker image pipelines
Reliability: CloudWatch/PagerDuty/Sentry, capacity, cost tags
Security baseline: IAM, secrets (SSM), Cloudflare edge rules
Partner with engineers on release automation and production readiness
Maintain the hybrid estate (AWS and rented bare metal) as one operable platform
Migration leadership
Build the business and technical case for what moves off AWS vs what stays
Design the rented bare-metal / colo landing zone (compute, network, storage, observability, secrets)
Produce migration waves, dependency maps, cutover/rollback plans
Stand up hybrid connectivity and dual-run periods; shift traffic safely (e.g. via Cloudflare)
Replace or re-home managed services where it pays off (compute, queues, search, cache, MTA nodes)
Coordinate colo/vendors, timelines, and eng teams; report progress and risk
Originally posted on Himalayas
Who can apply
The source lists worldwide eligibility. Accepted UTC offsets: UTC-11, UTC-10, UTC-9.5, UTC-9, UTC-8, UTC-7, UTC-6, UTC-5, UTC-4, UTC-3.5, UTC-3, UTC-2, UTC-1, UTC+0, UTC+1, UTC+2, UTC+3, UTC+3.5, UTC+4, UTC+4.5, UTC+5, UTC+5.5, UTC+5.75, UTC+6, UTC+6.5, UTC+7, UTC+8, UTC+8.75, UTC+9, UTC+9.5, UTC+10, UTC+10.5, UTC+11, UTC+12, UTC+12.75, UTC+13, UTC+14. Review the full description for employer-specific work authorization, residency and schedule requirements.