Part-time DevOps / Platform Engineer — AWS, Terraform, EKS (15–20 h/week, ongoing, EU hours)

About the role We are a European B2B marketplace and knowledge platform in the agri-food sector, with a small in-house engineering team (backend, frontend and data). We are building our next-generation platform on AWS while keeping the current marketplace running, and we need one hands-on DevOps engineer to own our infrastructure end to end. Part of this work is currently done by an external managed-services provider. You will take it over and become our single point of accountability for cloud, CI/CD, security hygiene and cost, reporting directly to the engineering manager. What you will look after The existing marketplace — one shared AWS account, a single EKS cluster (production, staging and UAT namespaces), Terraform, GitHub Actions with self-hosted runners. Maintenance mode: resolve Terraform drift, move CI from stored access keys to OIDC, enable state locking, audit access and enforce MFA, take over root and billing custody, cut cost, write the runbooks, and handle incidents during agreed hours. The new platform organisation — a fresh multi-account AWS Organization (management, security, shared services, dev, staging, production) for a Python/FastAPI platform with PostgreSQL (pgvector) and long-running agentic workers. You build it in Terraform from a near-blank slate against an agreed architecture: private VPCs, EKS with Pod Identity, RDS Multi-AZ, Secrets Manager with external-secrets, ALB/ACM, GitOps with Argo CD or Flux (staging automatic, production behind approval), Kustomize, zero-downtime rollout patterns for workers, Cloudflare Access and tunnels instead of a VPN, SSM instead of SSH, and an observability baseline a five-person team can live with. You also keep the CI for a Python monorepo green and keep the team's local Docker Compose stack honest against production. Must have AWS Organizations, SCPs, IAM Identity Center, CloudTrail/GuardDuty/Config, budgets — you have built at least one multi-account landing zone from scratch. Terraform on live systems: modules, remote state with locking, importing existing resources, drift remediation, safe refactoring. EKS in production: upgrades, Pod Identity/IRSA, ALB ingress, autoscaling, PDBs, external-secrets, Kustomize. GitOps (Argo CD or Flux) and GitHub Actions with OIDC, reusable workflows, path filters, image scanning. RDS PostgreSQL operations: Multi-AZ, backups/PITR, extensions, pooling, migration strategies. Private VPC design, egress control, Route 53, ACM, Cloudflare (DNS, Access, Tunnels), least-privilege IAM. Observability: Prometheus/Grafana or equivalent, OpenTelemetry, sensible alerting. Linux, Bash and Python for automation. Everything as code, everything through a pull request, decisions and runbooks written down. Clear written English; we work mostly asynchronously. You have taken over an estate from a previous engineer or vendor without breaking production. Nice to have LLM proxy/router operations (e.g. LiteLLM, OpenRouter); Supabase or similar managed auth behind your own API; Databricks on AWS; Temporal or another durable-workflow engine; PHP/Laravel or headless CMS hosting; FinOps experience; AWS Professional or CKA/CKS certifications. Arrangement 15–20 hours per week, ongoing hourly contract via Upwork. At least four hours of daily overlap with Central European Time; otherwise flexible, with occasional agreed maintenance windows. Fully remote; EU or adjacent time zones preferred. Paid, scoped first task (access review and risk register) as the trial. Start as soon as possible.