Senior Database Administrator - SQL Server, PostgreSQL & Security

You will own the security, availability and performance of our SQL Server and PostgreSQL estate across AWS, Heroku and Railway.

We are an FCA-regulated business handling customer personal data and payment-related information, so data protection is the first priority in everything this role does.

You will harden access, enforce least privilege, maintain audit trails and make sure we can evidence compliance to auditors and regulators. You will also keep the platforms healthy day to day and work closely with infrastructure, development and security colleagues.

KEY RESPONSIBILITIES

Database security - primary focus

• Design and enforce least-privilege access. Replace shared human logins with individual, role-based access, and give each application or service its own appropriately restricted identity.

• Manage authentication across platforms, including Entra ID or Windows authentication for SQL Server, IAM database authentication on supported AWS database services, and SCRAM for PostgreSQL where supported.

• Implement and maintain encryption at rest, including TDE and KMS-backed storage where applicable, and enforce TLS for database connections.

• Configure and review auditing using SQL Server Audit, pgAudit, CloudTrail and RDS logs as appropriate, with alerting on privileged or anomalous activity.

• Manage secrets and credential rotation using AWS Secrets Manager and appropriate platform configuration mechanisms. Remove hard-coded credentials from source code and application configuration.

• Identify and protect personal and cardholder data through classification, masking, row-level security and data minimisation where appropriate.

• Run regular vulnerability scanning, patching and configuration benchmarking against applicable CIS benchmarks.

• Support incident response and forensic investigation, including determining what data was accessed and by whom.

• Provide evidence for applicable audits and assessments, including PCI DSS, Cyber Essentials, ISO 27001, UK GDPR and FCA operational resilience requirements.

Database administration

• Install, configure, upgrade and maintain SQL Server and PostgreSQL instances.

• Own backup, restore and disaster recovery, with documented recovery point and recovery time objectives and regular tested restores.

• Monitor and tune performance, including query plans, indexing, statistics, vacuum and autovacuum, and wait analysis.

• Manage high availability and replication, including Multi-AZ, read replicas, Always On availability groups, streaming replication and logical replication where appropriate.

• Review and deploy schema changes through controlled change management.

• Maintain accurate documentation, runbooks and an inventory of every database, its owner and who has access to it.

Cloud and platform management

• AWS: Work with RDS, RDS Custom for SQL Server, Aurora PostgreSQL, SQL Server on EC2, parameter groups, snapshots, KMS, Secrets Manager and CloudWatch, according to the services in use.

• Heroku: Manage Heroku Postgres plans, credentials and attachments, follower databases, continuous protection and rollback capabilities, and Heroku Shield or Private Spaces where required and supported.

• Railway: Manage PostgreSQL services, private networking, volumes and backups, environment variables and access control.

• Assess the security posture of PaaS-hosted databases and recommend consolidation or migration where risk or cost justifies it.

• Manage cost and capacity across all three platforms.

Infrastructure - beneficial

• Secure database network exposure using VPCs, private subnets, security groups, NACLs, VPNs and private connectivity. Avoid public endpoints without documented justification.

• Work with the infrastructure team on Windows and Linux server builds, hardening and patching.

• Contribute to infrastructure as code using Terraform or CloudFormation, and automation using PowerShell, Python or Bash.

• Support integration with backup, monitoring and SIEM tooling., * A complete inventory of every database across AWS, Heroku and Railway, with data classification and named owners.

• Shared human accounts replaced with individual access, and service identities restricted by least privilege, supported by audit data.

• Appropriate encryption, TLS enforcement and auditing in place on all production databases.

• Documented and tested backup and disaster recovery for each platform, meeting agreed recovery objectives.

• Database evidence packs ready for applicable PCI DSS, Cyber Essentials and annual audits.

• At least five years of DBA experience, with production experience of both Microsoft SQL Server and PostgreSQL.

• Strong T-SQL and SQL skills; confident using SSMS, psql and pgAdmin.

• Hands-on administration of databases in AWS, particularly RDS and SQL Server on EC2.

• Practical experience securing databases, including role and permission design, auditing, encryption, TLS and secrets management.

• Proven backup and recovery experience, including restoring under pressure.

• Performance tuning and troubleshooting on both database engines.

• Working knowledge of UK GDPR and handling personal data in a regulated environment.

• Scripting for automation in at least one of PowerShell, Python or Bash.

• Clear written documentation and the ability to explain risk to non-technical stakeholders.

DESIRABLE SKILLS AND CERTIFICATIONS

• Experience with Heroku Postgres and Railway, or similar PaaS database platforms.

• Experience in financial services, insurance or another FCA-regulated sector.

• Exposure to PCI DSS, ISO 27001 or Cyber Essentials Plus audits.

• AWS networking experience, including VPC design, Transit Gateway, Client VPN and Direct Connect.

• Microsoft 365 and Entra ID administration, including Privileged Identity Management.

• Infrastructure as code using Terraform or CloudFormation.

• CI/CD for database changes using tools such as Flyway, Liquibase or SSDT.

• Database activity monitoring or SIEM integration, such as Microsoft Sentinel or Splunk.

• Data warehousing, ETL or SSIS experience.

• Relevant Microsoft database, AWS security or EDB/PostgreSQL certifications; CompTIA Security+; or progress towards CISSP or CISM.

PERSONAL ATTRIBUTES

• A security-first mindset: assumes breach, questions default settings and treats access as something to be justified.

• Methodical and audit-minded, leaving an evidence trail for changes.

• Calm and decisive during incidents.

• Comfortable constructively challenging developers and suppliers on insecure practices.

• Takes ownership and works well in a small team with broad responsibilities.

£80,000-£100,000 per year, depending on experience

Full-time, permanent

Edinburgh House, 170 Kennington Lane, London SE11 5DP

Office-based, five days per week - not hybrid or remote, Appointment is subject to a Basic DBS check and satisfactory references.

Occasional out-of-hours work will be required for maintenance windows and incident response.

This role is based in our Kennington office five days per week.

Pay: £80,000.00-£100,000.00 per year