Infrastructure Automation with GitLab
here are my 2 cents,


You can use GITLAB to have merge requests for all your security requests like adding users to the groups for every new user or existing users. the Mr can be approved by only your IAM admin. You can use GITLAB CI pipelines to go and perform the operation once the MR is approved. From the users side, the user has to  provide their keys and submit as an MR so that the IAM team can validate and approve it. 
You can deploy your applications easily using Ansible and Gitlab CI. All you need is just source code of your application and some knowledge of YAML. I am sure, your folks already are equipped with that. Ansible can be used for infra provisioning as well so you can just run the show with them. With regards to os updates, I would say ansible can easily do it. Have the SDLC workflow in place for developing playbooks and once the playbook is modularized, it can used in production. 


Let me know if I answered your query and if you have any other questions.