Senior Cloud Infrastructure & Security Engineer

OTT Pay is a Canadian-headquartered fintech and payments company with a 20-year history and operations in Canada, Hong Kong, and Singapore. We provide merchant acquiring and cross-border payment services, and our platforms support merchant transactions, fund settlement, and cross-border transfers.

As our business grows, we are strengthening the reliability and security of our production systems. We are seeking a hands-on senior engineer to take end-to-end ownership of our production cloud environment.

This role owns the reliability, security configuration, monitoring, and disaster recovery of our production cloud platform and infrastructure. Build an auditable, well-documented operating model that is easy to maintain and hand over, helping ensure our payments business operates continuously and securely.

Key Responsibilities:

Cloud platform & systems: Manage our cloud platform, servers, operating systems, networking, load balancers, storage, domains, and certificates. Maintain the asset inventory, architecture diagrams, and configuration documentation.

Network & infrastructure security: Manage firewalls, cloud security groups, WAF, remote access, and network segmentation. Maintain isolation between production, test, and corporate environments; harden systems and remediate vulnerabilities.

Identity, access & secrets: Enforce MFA, least-privilege access, individual named accounts, and joiner/mover/leaver access controls. Manage privileged access, service accounts, API keys, and certificates, ensuring appropriate authorization, rotation, and auditability.

Reliability, monitoring & incident response: Implement monitoring for availability, capacity, performance, and abnormal behaviour. Resolve production incidents, conduct root-cause analyses, and drive corrective actions. Participate in an agreed on-call and escalation rotation.

Backup & disaster recovery: Implement isolated backups and recovery procedures, and conduct regular restore drills. Establish recovery time objectives (RTOs) and recovery point objectives (RPOs) with business owners, and report on drill results.

Automation & change management: Reduce manual work through scripting, infrastructure as code, and release tooling. Establish change approvals, configuration versioning, pre-release checks, and rollback procedures.

Security collaboration & vendors: Collaborate with the development team and external security firms on security testing, incident response, and remediation. Manage cloud, operations, and security vendors, and optimize costs.

What you bring to the table:

8+ years of relevant experience, including at least 3 years of independently owning the infrastructure and security of a production cloud environment.

Experience in payments, fintech, e-commerce, or another high-availability, regulated environment.

Deep expertise in at least one major cloud platform; expertise across every cloud platform is not required.

Strong skills in Linux, networking, access control, security hardening, backup and restore, and log analysis.

Experience with Python or Shell scripting, as well as infrastructure configuration management or infrastructure as code (IaC).

Hands-on experience with container platforms and database high availability.

Hands-on experience managing production incidents, hardening systems, and conducting recovery drills.

Working knowledge of at least one of the following: PCI DSS, SOC 2, or the operational-risk requirements of Canada's Retail Payment Activities Act (RPAA). Experience supporting security or compliance audits is also required.

Ability to work effectively with engineering, risk & compliance, and business teams, with strong documentation and handover practices.

Fluent in English.

Preferred

Mandarin, given the close collaboration with our engineering team in Shanghai.

Cloud or security certifications (valued, but not a substitute for hands-on experience).

OTT Financial Group is committed to fostering an inclusive and accessible environment where all employees feel valued and respected, and where every employee can realize their potential. We are committed to providing reasonable accommodation, if required, and will work with you to meet your needs. We appreciate all applicants for their interest; however, only those candidates selected for an interview will be contacted.