Senior Backend Engineer

About Citizen

Citizen is the #1 safety app in the U.S. Every day, thousands of videos are captured live at the scene of real incidents and distributed in real time to people in every major American city. No other consumer product has this. It is a live network, a newsroom, and a safety tool at once, and it is growing again.

Underneath it is a real-time system: ingest from 911 radio, CAD feeds, user video, and partner feeds; detection, verification, and geolocation; distribution to millions of devices in seconds; the live video infrastructure that carries the scene to the app; and the enterprise products and API that deliver the same intelligence to cities, hospitals, campuses, and private security. You will own core pieces of that system and ship them with a small team of engineers, human and agent.

You will also build for the people inside Citizen who run the city. Our Mission Control and real-time operations team lives in ProtectOS and Regulator, our internal operating tools, all day. A meaningful share of backend work is tooling for them, and they are the most demanding users you will have.

Why Now

Citizen is being rebuilt as an AI-native company, and the backend is where most of the rebuild happens. AI now sits in the pipeline itself, detecting and verifying incidents and deciding what people see, and the system has to get faster, more accurate, and cheaper per incident while it does. The enterprise business is working and needs to scale on the same platform. That is a very large amount of interesting work for a very small number of people who use agents to carry it.

How We Work

Every role at Citizen is two things: the craft, and the operation of AI to multiply it.

You are a backend engineer first. Distributed systems judgment, taste in code, and the instinct to know where a real-time system will break before it does. You are also the person who runs agents to write, review, test, and operate the code alongside you. You propose where agents run alone; production gates are policy, because this is a safety product. You hold the bar on correctness and you keep the hard calls for yourself. If in month three you are still hand-writing CRUD, migrations, or runbooks, something has gone wrong.

How work is organized. Engineering runs on a driver and builder model. Every initiative is a drive with one accountable driver who owns scope, sequencing, and tradeoffs, and a small set of builders who ship it with them. Drivers are not assigned by seniority; they are the people who want the decision and the responsibility that comes with it. You will build on other people's drives and you will drive your own, early.

On-call. Citizen runs around the clock and so does the backend. On-call is a rotational program: roughly one week every two months, and when you carry the pager you are available 24/7 for the most urgent emergencies, with resolution expected in hours, not days. Everyone on the team carries it. Say now if that is not for you.

What You Will Own

We are not hiring a caretaker for the whole backend. We are hiring someone dedicated, who wants ownership and can carry it, over a real piece of the core system, chosen by the team's need first and your interest second, and who is equally willing to own new ideas and new services where they move the company's growth and current focus. The pieces on the table today:

The real-time pipeline. Ingest from 911 radio, CAD feeds, user video, and partner feeds; detection, verification, geolocation, and distribution to millions of devices in seconds. Correctness, latency, and cost per incident are the three numbers.

Live video infrastructure. Ingest from the phone, the restreamer, and delivery through Mux to every viewer. One of the largest cost and latency lines in the company.

AI in the pipeline. The services that put models and agents into the path from raw signal to published incident: evaluation, provenance, guardrails, and the staged path from human-in-the-loop to autonomous operation behind audited gates.

Internal operator tooling. The backend behind ProtectOS and Regulator, the tools Mission Control uses to verify, write, and publish incidents. When these are slow or wrong, the city hears about it late.

Enterprise, API, MCP, and partners . The services behind the enterprise consoles; developing and supporting the public API and MCP access, which is how enterprise customers and agents will consume Citizen data; and partner integrations that put Citizen inside the systems cities already run, including our integration with Axon.

Infrastructure and cost . Go and Python services on Kubernetes (GKE) in Google Cloud, Pub/Sub, MySQL and Postgres, BigQuery, and the observability that lets a small team run a large system.

Whichever piece you take, two things come with it:

Instrumentation . Registering Segment events with the data team, checking them in BigQuery, and making sure the numbers leadership sees are the numbers the system produced.

The agent loop. The agents that draft, review, test, and operate backend code at Citizen. You extend and operate them, you propose where they run alone, and you raise the output bar. You work daily with iOS and Android on the contracts, with ML on the models, with Data on events, and with Mission Control as your primary internal user.

Your First 90 Days

• Days 1–30. Read the code. Use the product every day in New York. Sit on the Mission Control floor through a live incident and watch how ProtectOS and Regulator are actually used. Ship to production in week one. Join the on-call rotation as a shadow. Identify the three things that will break first and start on the first.

• Days 31–60 . Drive your first initiative end to end. Land one measurable improvement in latency, correctness, or cost. Take your first solo on-call week. Extend the agent loops already wired into the backend repo and propose the first one to run without a human, in test generation, review, or on-call triage.

• Days 61–90. Ship the first AI-in-pipeline capability, video improvement, or enterprise service to real users. Present the roadmap for the systems you own, with the numbers behind it.

How Success is Measured

• Time from signal to verified, published alert, improving

• Uptime and latency during the largest incidents of the year, not the average day

• Live video start time, reliability under load, and cost per viewer-hour

• False positives and missed incidents in the systems you own, both falling as AI carries more of the load

• Infrastructure cost per incident handled, falling quarter over quarter

• Enterprise and API reliability against the commitments Sales makes

• On-call: time to resolution on the incidents you carry

• Cycle time from idea to production on the systems you own, falling as the agent loops you run carry more of the work

Who You Are

• You have built and run backend systems at consumer scale, real-time or event-driven, and you can point to the services you personally owned and what happened when they broke.

• You are fluent in Go, comfortable in Python for the ML and data pipelines, and at home on Kubernetes and a modern cloud stack: message queues, relational and analytical stores, observability.

• You have carried a pager for a system people depended on, and you have a story about the worst night.

• You have worked on live video or streaming infrastructure, or you want to and can show you learn systems like it fast.

• You have put ML models or LLMs into a production path and you know the difference between a demo and a system with evaluation, fallbacks, and audit.

• You build with AI already. You have replaced whole parts of your own workflow with agents, you have opinions about where they fail, and you are paying attention to what is next. This