DevOps Engineer

Music is Universal

It’s the passionate and dedicated team at Universal Music who help make us the world’s leading music company. From A&R to finance, legal to digital, sales to marketing, Universal Music is the place to grow and develop your career within a truly commercial and innovative business that leads in everything it does.

Everyone is welcome to apply for our roles, and we are determined to ensure that no applicant or employee receives less favourable treatment because of gender, race, disability, sexual orientation, religion, belief, age, marital status, background, pregnancy, or caring responsibilities. We also recognise the importance of diversity of thought within our teams and are fully committed to embracing the talents of people with autism, dyslexia, ADHD, and other forms of neurocognitive variation.

We will always seek to make appropriate adjustments to recruitment, workplaces, and work processes to be fully inclusive to people with different needs and working styles. If you need us to make any reasonable adjustments for you from application onwards, including alternatives to the online form or to disclose a neurocognitive condition, please email UniversalMusicCareers@umusic.com.

Department Description

With a global footprint, the Universal Music Group Royalty and Copyright Product Team designs, develops, delivers and maintains a number of technical solutions to calculate royalty accountings in a timely and accurate manner to our valued artists. We’re also providing them with an extent and detailed visibility of these earning from various sources of digital incomes.

The team continuously collaborates with our international business teams to deliver innovative solutions as well as supporting best practices and new processes for a better royalty flow.

The Role

We are looking for an experienced Senior DevOps / AWS Platform Engineer to join the Royalty and Copyright tech team.

This is a hands-on role responsible for the reliability, deployment, infrastructure and operational support of UMG application platform across AWS environments. The role combines AWS platform engineering, Kubernetes, infrastructure as code, CI/CD, observability, data-platform infrastructure and production support.

You will work closely with software engineers, data engineers, QA and support teams to ensure the platform remains secure, resilient, observable and straightforward to deploy and operate.

Key Responsibilities

• •Infrastructure as Code - manage infrastructure through Terraform Enterprise, including infrastructure changes, deployments, environment consistency and ongoing maintenance. Experience with AWS CDK and AWS CloudFormation.
• •Kubernetes / EKS operations - support UMG application workloads running on EKS, including deployments, scaling, CronJobs, resource management, pod failures and cluster/platform upgrades or migrations.
• •CI/CD and deployments - maintain and improve GitHub Actions and deployment pipelines for application, infrastructure and database releases, and support release/deployment activities.

Access and security - coordinate with the central UMG DevOps team and manage IAM permissions, roles, secrets (AWS Secrets Manager and Vault) and access to AWS resources, as well as support vulnerability remediation, patch management and general platform security activities for Windows and Linux OS.

Monitoring and observability - monitor UMG applications infrastructure and application health through CloudWatch and Kubernetes monitoring and identify performance or capacity issues. Work with the central Observability team to integrate with Dynatrace and BigPanda.

Production support and incident management - investigate and resolve infrastructure, networking, Kubernetes, database and application availability issues, including root-cause analysis and follow-up actions.

Data-platform infrastructure support - support AWS services used for ingestion and processing, including AWS Lambda, KMS, Glue, Application Load Balancers (ALB and NLB), EC2, Systems Manager, Step Functions, S3, Aurora Postgres, Redshift and OpenSearch.

Developer support - work with engineering, data, QA and support teams on infrastructure, environment, deployment, access and troubleshooting requirements.

Networking and connectivity - troubleshoot VPC/networking, WAF (Imperva and CloudFlare), VPN, DNS and connectivity issues affecting application services and integrations. Good working knowledge of AWS VPC Transit Gateway, PrivateLink, Subnets, Security Groups, Route Tables and DHCP option sets.

Resilience and recovery - support backups, recovery processes, platform resilience and high-availability requirements.

Automation - automate repetitive operational, infrastructure and deployment activities to reduce manual effort and improve reliability.

Documentation and operational procedures - maintain deployment procedures, infrastructure documentation and support/incident processes and publish them in Atlassian Confluence.

Streaming - support and administer Confluent Cloud and AWS MSK. Assist application teams with Kafka connectivity and permissions.

ITSM - use Atlassian Jira, ServiceNow and CMDB or similar enterprise products; support incident, problem, change request and configuration management processes; maintain accurate infrastructure and service information within the CMDB; and participate in Change Advisory Board (CAB) processes.

Domain management - manage enterprise public internet domains and internal hosting and DNS services, including registration, renewals, delegation, hosted zones and DNS records. Administer DNS using AWS Route 53, CSC and other enterprise DNS/domain-management platforms.

Certificate management - manage the SSL/TLS certificate lifecycle, including request, validation, deployment, renewal, replacement and retirement. Manage AWS certificates through AWS Certificate Manager (ACM) and support enterprise certificate/PKI solutions such as Keyfactor.

IAM - maintain AWS IAM roles, policies, permission boundaries and service identities following least-privilege principles. Support integration with Active Directory, federated identity, SSO and enterprise authentication services, including OAuth requirements for applications and APIs.

Experience developing automation using Python, PowerShell, Bash, .NET Framework or similar scripting languages.

Skills and Experience required

Must have

• •Strong hands-on AWS infrastructure experience, including EKS/Kubernetes, Lambda, Glue, Step Functions, S3, EC2, Systems Manager, Aurora PostgreSQL, Redshift, OpenSearch, KMS and load balancing.
• •Strong Infrastructure as Code experience with Terraform Enterprise; working knowledge of AWS CDK and CloudFormation.
• •Experience maintaining GitHub Actions and CI/CD pipelines for application, infrastructure and database deployments.
• •Strong AWS networking knowledge, including VPCs, Transit Gateway, PrivateLink, subnets, Security Groups, route tables, DNS, VPN and WAF technologies.
• •Experience with IAM, Secrets Manager/Vault, least-privilege access, federated identity/SSO, OAuth and platform security.
• •Experience with monitoring and observability using CloudWatch and Kubernetes monitoring; exposure to enterprise observability tooling such as Dynatrace and BigPanda.
• •Production support and incident/root-cause analysis experience across infrastructure, Kubernetes, networking, databases and application availability.
• •Experience with enterprise ITSM practices and tools such as Jira, ServiceNow, CMDB and CAB/change management.
• •Experience with Confluent Cloud / AWS MSK and Kafka connectivity and permissions.

Nice to have

• •Experience with scripting/automation using Python, PowerShell, Bash, .NET Framework or similar.
• •Windows and Linux patching/operations experience and familiarity with vulnerability remediation.
• •Working knowledge of Chef.

Key Behavioural/Personality Traits

The successful candidate will:

Be comfortable takin