Novata is pioneering the way in ESG (Environmental, Social, and Governance) data management and analytics, empowering private market firms to enhance transparency with stakeholders. Our platform simplifies the collection and analysis of critical ESG metrics.

Are you passionate about developer tools, k8s and Typescript? Come work with me in our platform squad and be responsible for delivering a first class Developer Experience to our colleagues and team members in other squads.

You will focus on coaching engineers to better improve their understanding of the "Ops" side of their skillset, improving tools & processes, documentation, and support channels to make the development journey smoother and more enjoyable.

Apply: https://wrkbl.ink/gj3k2rd

Hybrid in our case means come in when you feel it would be useful, there is no x days per week mandate.

We are also hiring for a bunch of other roles both in London, UK and New York, US: - Data Engineers - Support Engineers - Mid and Senior Full Stack

Full list: https://wrkbl.ink/4MyPLK8

As part of our team, you'll engage in unique and high-impact projects, tackling security challenges on a scale not typically seen in the tech world. You will design and implement new approaches for system security, apply trusted computing, and track cutting-edge security technologies.

We're hiring for: Site Reliability Engineers - Singapore: https://job.toutiao.com/s/i2chcXA

Site Reliability Lead - Sydney, Australia: https://job.toutiao.com/s/i2vTUqD

Site Reliability Engineer - Sydney, Australia: https://job.toutiao.com/s/i2c8kSV

Comments URL: https://news.ycombinator.com/item?id=35265097

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=34426317

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=34411711

Points: 1

# Comments: 0

If you have a localised blog for multiple regions you will probably have your main blog set up to be indexed and your regional blogs set up to be no-indexed so that Google isn't indexing the same stuff twice.

- Ensure full disk encryption

- Time limit on how long people can defer OS upgrades

- Report on software installed and versions

- Enforce somewhat complex password

- Enforce password after screen has become locked

- Allow us to remote wipe the machine if lost/stolen

It didn't stop you from installing / uninstalling anything - even itself. Although if your machine stopped phoning home for a certain amount of time we had some alerts set up for the IT support team to follow up.

I'm hoping things are better now - I think Canonical have some sort of MDM for Ubuntu but I couldn't figure out how to pay for it.

- MDM for laptops/phones, don't let people use their own devices. The point of MDM isn't to stop people installing their favourite IDE, the point of it is to make sure the device is patched and running latest OS. If you have a VPN (even AWS Client VPN supports this...) tie MDM together with device attestation so only patched machines can connect to your VPN.

- Unified login, for a start up you can use Google workspace or even GitHub as your identity provider (this gets weird if you have non-devs but you can push it for a bit). Don't have more than one account/password for things, you just log into your google account then use OIDC/SAML to auth against internal apps. If you do this you probably don't need VPN. Use this to auth into AWS too.

- Don't share accounts on SaaS services (e.g domain registrar), this will make rotating stuff when someone leaves a nightmare. If a service doesn't support teams or you don't want to pay for the enterprise version then it's OK for the CTO and 1 other person to have their own login.

- Minimise/avoid static credentials for your infra (e.g. web server talking to postgres) prefer to use AWS Instance roles with short lived dynamic credentials.

- Make sure network isolation is set up correctly, your Mongo db shouldn't be listening on the internet

- Use 2fa but make sure it's WebAuthn/FIDO. Issue everyone with 2x security keys. People wipe / screw up their phones/TOTP authenticator apps far too much.

- Centralised logging, make sure your apps can output logs to opensearch/datadog/whatever. Whenever a user performs an action make sure this gets logged.

- Don't let people manage prod infrastructure without using Infrastructure as code tools (CDK/Pulumi/Terraform), best thing would be not to give people prod access and all changes have to go through CI

- Make sure you know your product is down before your users start calling/emailing. Set up healhchecks.io / pingdom whatever.