DevOps & Infrastructure Engineer (m/f/d) — Reliability & Compliance

DevOps & Infrastructure Engineer (m/f/d) — Reliability & Compliance

Frankfurt, Germany
· On-site

Who are we?

We are Exaloan, a FinTech based in Frankfurt, Germany, specializing in AI-based credit analytics. We provide professionally managed access to diversified portfolios of loans originated by FinTech and alternative lenders across Specialty Finance, SME and Consumer sectors. We operate a global digital lending marketplace at the intersection of asset management, software development, machine learning and generative AI, with the ambition to drive innovation in one of the fastest-growing sectors in finance. And we are unstoppable to reach our goals.

Location — please read before applying

This is a full-time, on-site role based in our office in the heart of Frankfurt. You must already live within commuting distance of Frankfurt, or be genuinely ready to relocate here before you start, and you must be authorized to work in Germany. We work together in the office; this is not a remote or majority-remote position. Please apply only if an on-site Frankfurt role is what you are looking for.

Who are we looking for?

We are looking for a DevOps and Infrastructure Engineer to own the systems and processes that let us scale safely. As our platform grows, so does the number of services, pipelines and lending integrations behind it — and the standard to which a regulated, institutionally-backed business is held. Your job is to raise the whole estate to a consistent, well-documented, audit-ready baseline: reliable AWS infrastructure, uniform CI/CD, and the security and compliance controls that our investors, auditors and clients expect.

We are a small team, so this is a hands-on role: much of your time will go to the immediate operational issues that keep a growing platform running. The upside is breadth — you will see, and be responsible for, many different parts of the stack rather than a narrow slice of it. You will work closely with the founding team, who set the standard and back your judgment, and take on more ownership as you establish it. If you like bringing order to a fast-moving estate — and writing it down so it stays ordered — this is your role.

Your role

You will collaborate directly with founding partners who are seasoned experts across the domains integral to our work: capital markets, portfolio management, banking law, software engineering, machine learning and generative AI.

From your first day, you will own our AWS infrastructure and our CI/CD standard, and drive the operational side of our ISO 27001 and DORA work — the controls, the evidence, and the documentation that make our engineering demonstrably sound.

AWS (ECS, Lambda, S3, CloudWatch, IAM), AWS CDK, Docker, Bitbucket Pipelines, Python, ArangoDB. Our reference services already run a full gated pipeline — tiered tests, a coverage floor, a supply-chain dependency audit and a review gate; your job is to make that the norm across the estate, not the exception.

Key responsibilities

• Own AWS infrastructure and Infrastructure as Code. Account structure, deployment, networking, secrets, and cost across the estate — provisioned as code (IaC), not by hand.
• Raise the CI/CD baseline across a growing estate we’re scaling and standardizing. Our reference pipeline sets the bar; you will bring more of our services onto consistent pipelines — PR gates, tests in CI, coverage floors, supply-chain audits — in priority order, so our engineering standard scales with us.
• Own reliability: monitoring, logging, alerting, backup and recovery, and the operational health of the platform. The unglamorous, load-bearing work that keeps a financial platform trustworthy.
• Operationalize security and compliance. Drive the day-to-day of ISO 27001 and DORA: change-management evidence, access controls, and audit artifacts. Coordinate external security testing — introduce SAST/DAST tooling on the code we build ourselves, and help scope and schedule independent penetration testing — and turn findings into tracked, remediated work. You need not be a career security specialist, but you can operationalize a control and produce the evidence for it.
• Own operational resilience and incident response — ICT incident management and reporting, resilience testing, and business-continuity readiness. This is the operational core of DORA: we must both withstand disruption and be able to evidence that we can.
• Document the estate. Runbooks, deployment and recovery procedures, architecture decisions, onboarding guides. Turn tribal knowledge into repeatable, written process — this is a first-class deliverable of the role, not an afterthought.
• Support the engineering team with the infrastructure, pi