DevOps Engineer (AWS)

About us

Ancileo is a Singapore-headquartered B2B InsurTech specialising in travel insurance technology across Asia-Pacific. Following its Series A, Ancileo is in an accelerated growth phase with a tech-first mandate. The company runs two business units: LEA, an AI-powered claims ecosystem used by insurers and claims partners, and Distribution, insurance middleware connecting airlines, OTAs and insurers across around 30 markets. The Malaysia entity is a key operational hub.


About the role

The DevOps Engineer is the single DevOps owner across both business units, LEA and Distribution. You own how Ancileo infrastructure is built and deployed: infrastructure defined in Terraform, applications shipped through automated pipelines, and the same standards applied to both business units. You support the CloudOps engineer on releases and production operations. The role also carries real security and compliance ownership: the AWS security baseline, application protection, recovery plans proven to work, the technical lead if attacked, and a healthy Drata score. This is a hands-on engineering role. You will spend most of your time in AWS, Terraform and GitHub Actions, not in spreadsheets.


Key responsibilities

1. DevOps across LEA and Distribution (45%)

Infrastructure as code

• Write, review and maintain Terraform for AWS infrastructure: reusable modules, remote state, multiple environments and drift detection.

• Bring resources still managed from the console into Terraform, with security baselines built into the modules.

• Provision new environments from code, so any environment can be rebuilt from Terraform.

CI/CD pipelines

• Build and maintain deployment pipelines with GitHub Actions and AWS CodeDeploy for ECS and EC2 workloads.

• Own the container release flow: Docker builds, ECR, image scanning, versioning and promotion between environments.

• Build security into the pipelines: dependency, image, secrets and Terraform scanning, and GitHub OIDC to AWS instead of long-lived access keys.

• Set up safe deployments with health checks and automated rollback (rolling or blue/green).

Shared standards across both business units

• Build one set of Terraform modules and pipeline templates used by both LEA and Distribution.

• Align environments, naming, tagging and deployment practices across the two business units.

• Cover Azure (AKS) as well as AWS while the remaining LEA workloads move to AWS, and support that migration.

• Help LEA and Distribution developers adopt the shared pipelines and fix their deployment issues.

2. CloudOps support (15%)

• Support the CloudOps engineer on LEA and Distribution releases: pre-release checks, deployment and rollback readiness.

• Help troubleshoot production incidents: ECS task failures, database connectivity, networking and log analysis.

• Keep monitoring and alerting in good shape: CloudWatch alarms, log retention and alert routing to Slack.

• Write runbooks for recurring issues and fixes.

3. Cloud security (30%)

Security baseline

• Run and tune the AWS security stack: GuardDuty, Security Hub, Inspector, Config, CloudTrail and IAM Access Analyzer.

• Secure access to ECS, EC2 and RDS: SSM Session Manager instead of SSH, no public endpoints, Secrets Manager, KMS encryption and security group reviews.

• Own IAM Identity Center: permission sets, least privilege and quarterly access reviews.

• Operate Huntress (detections, isolation, policy tuning) and run phishing campaigns and security awareness training.

Application protection

• Make sure every LEA and Distribution application, API and database is protected against attack: WAF, DDoS protection, rate limiting, TLS and no exposed admin interfaces.

• Review new features and architecture changes for security before release.

Recovery and incident response

• Make sure backups cover all critical systems and are protected against ransomware (immutable or isolated copies), and test restores against agreed RTO and RPO targets.

• Take the lead on the technical response if Ancileo is attacked: contain the threat, isolate workloads, rotate credentials and preserve evidence.

• Run the post-incident review and improve detection and alerting after each incident.

4. Compliance operations (10%)

• Own the Drata score: weekly triage of failing tests, fix issues on the cloud side and keep evidence current.

• Maintain information security policies and run the annual review and staff acknowledgements.

• Provide technical evidence to auditors (SOC 2, PCI DSS) when requested.

Requirements

• 4 to 7 years in DevOps, cloud or infrastructure engineering, including 3+ years hands-on AWS in production.

• Strong Terraform in production: you wrote and maintained modules, remote state and multi-environment setups yourself.

• CI/CD pipelines built and maintained with GitHub Actions and AWS CodeDeploy (or similar), deploying to ECS or EC2.

• Hands-on operation and troubleshooting of ECS, EC2 and RDS, plus Docker and ECR.

• Production release experience: pre-release checks, deployment and rollback.

• Solid AWS security fundamentals: IAM, VPC, security groups, KMS, Secrets Manager, GuardDuty, Security Hub.

• Backup and disaster recovery experience, including restore testing.

• Linux administration, networking basics (NACLs, WAF, DNS) and scripting in Python or Bash.

Benefits

• Direct reporting line to the CTO and real ownership of infrastructure, pipelines and cloud security for both business units.

• Hands-on work on production AWS environments serving airlines, OTAs and insurers across Asia-Pacific.

• A small, collaborative engineering team with no heavy hierarchy.

• Hybrid working: 3 days per week in the PJ office.

• Learning budget and support for certifications, including AWS DevOps Engineer - Professional and AWS Security - Specialty.

• Competitive salary benchmarked to the Malaysian tech market.