Senior Software Engineer, Warden of the Lambda Gate Node.js Serverless & Container Infrastructure

The Calling

Somewhere tonight, a cold start is creeping through a production function. A memory leak is feeding on a container that nobody has looked at in months. A long-lived credential sits in a forgotten config file, waiting.

Safience builds identity intelligence for the people who find missing children and stop real threats. When an investigator needs an answer, our systems cannot go dark. So we need an engineer who stands the watch.

You will design, build, and operate Node.js services on AWS Lambda and Docker-based containers. Fastify is your blade. Vue.js is your shield. Terraform is your book of wards. You own services end to end: the code, the infrastructure, the pipelines, the lanterns that light every corridor, and the 3 a.m. page when something stirs. You set the direction for serverless and containerized workloads across a multi-account AWS realm, and you make every engineer around you sharper through review, documentation, and mentorship.

Sacred DutiesForging the Weapons (Application Development)

• Forge production Node.js services in TypeScript with Fastify and Vue.js, deployed as Lambda functions (zip and container-image packaging) and as containers on ECS/Fargate.
• Raise event-driven defenses with API Gateway, SQS, SNS, EventBridge, Step Functions, and DynamoDB/Kinesis streams. Messages move like sentries passing the watchword.
• Write idempotent, retry-safe handlers. A message that returns from the dead should find nothing to repeat. You decide what happens in the dead-letter queue, and you report partial batch failures honestly.
• Banish the cold start. Shrink bundles, tune memory and timeouts, and set concurrency and provisioned concurrency so performance and cost both stay in the light.

Raising the Walls (Infrastructure & Containers)

• Inscribe the wards in Terraform: remote state, modular design, and no change goes live without a second pair of eyes.
• Build lean, hardened Docker images with multi-stage builds, pinned base images, deterministic installs, and non-root users. Nothing runs as root in this house.
• Tend the image crypt in Amazon ECR: tagging strategy, vulnerability scanning, and retention policies. Old images are laid to rest on schedule.
• Patrol multiple AWS accounts with cross-account IAM roles and least-privilege policies. No spirit gets a skeleton key.

Sealing the Gates (CI/CD & Release Engineering)

• Own GitHub Actions pipelines for build, test, scan, and deploy, using OIDC federation to AWS. Long-lived credentials are how the darkness gets in.
• Deploy with discipline: Lambda aliases and versions with weighted traffic shifting, ECS rolling or blue/green deployments, and automated rollback on alarm. When the bell rings, we retreat in good order.
• Guard the supply lines with lockfiles, private package registries, and automated vulnerability and license scanning. Nothing enters the camp unexamined.

Keeping Watch (Observability & Operations)

• Instrument everything with structured logging, metrics, and distributed tracing (CloudWatch and/or OpenTelemetry). Shadows hide where logs are missing.
• Define SLOs, alarms, and dashboards. Take your turn on the on-call rotation, lead incident response, and run blameless postmortems. We hunt the cause, never the person.
• Watch the AWS bill for the services you own. Waste is a slow haunting.

Wards and Seals (Security)

• Keep secrets in AWS Secrets Manager and SSM Parameter Store, encrypted with KMS. Secrets are never spoken aloud or written in plain text.
• Secure the network paths for VPC-attached Lambdas and Fargate tasks: subnets, security groups, VPC endpoints, and NAT trade-offs.
• Join security reviews and threat modeling, and close out findings. Name the threat before it names you.

Leading the Order (Leadership)

• Lead technical design for new services and write design docs that face the hard choices squarely (Lambda vs. Fargate, sync vs. async).
• Review code thoroughly and train the mid-level and junior engineers who will stand the watch after you.
• Keep the scrolls current: runbooks, architecture diagrams, and onboarding docs.

Proof of Battle (Required Qualifications)

Years in the field. 6+ years of professional software development. 4+ building and operating production Node.js services. 3+ running production workloads on AWS Lambda and ECS/Fargate. You’ve carried a service from first sketch to launch to the night it tried to fall over, and you were the one who picked up the phone.

Your arsenal.

• Node.js / TypeScript: You know the event loop the way a sailor knows the tide. Async patterns, streams, memory behavior, CommonJS and ESM, and typing that actually protects you.
• Fastify: Designing, building, and migrating APIs onto it.
• Vue.js: Designing, building, and migrating UIs with it.
• AWS Lambda: Handler lifecycle, execution environment reuse, the concurrency model, event source mappings, layers, container-image functions, and runtime upgrades before they become emergencies.
• AWS core services: IAM, API Gateway, SQS, SNS, EventBridge, Step Functions, DynamoDB, S3, CloudWatch, ECR, ECS/Fargate, and VPC fundamentals.
• AWS SDK for JavaScript v3: Modular clients, middleware, pagination, and retry configuration.
• Docker: Multi-stage builds, layer caching, image hardening, and debugging containers both locally and in production.
• Terraform: Real production use, including state management, modules, and workspaces or per-environment layouts.
• CI/CD: GitHub Actions or something comparable, with environment promotion and automated testing gates.
• Testing: Unit, integration, and contract tests (Jest, Vitest, or ava), plus local Lambda emulation with SAM CLI or LocalStack.
• Datastores: Working proficiency with MongoDB or DocumentDB, and ElasticSearch or OpenSearch.

Honors of Distinction (Preferred Qualifications)

• AWS Certified Developer Associate, Solutions Architect Associate or Professional, or DevOps Engineer Professional.
• Experience with AWS Organizations and multi-account landing zones.
• Identity-aware proxies or zero-trust access (Pomerium or equivalent). Trust nothing at the door.
• OpenTelemetry across both Lambda and container workloads.
• Container supply-chain tooling: SBOM generation, image signing, Trivy, Grype, or Amazon Inspector.
• Migrating workloads between Lambda and containers, or dragging legacy hosts into the serverless age.
• Time in regulated or security-sensitive environments such as SOC 2, PCI, or gaming and casino compliance.
• Some fluency in the other tongues of our stack: Java/Scala, Python, or Go.

The Warden’s Code (Core Competencies)

Ownership. Production health, cost, and security are your watch. Nobody else’s.

Pragmatic judgment. The simplest architecture that does the job, and you can explain why.

Communication. Clear design docs, PR descriptions, and incident reports. You can explain a decision to someone who has never seen a terminal.

Collaboration. You work well with product, QA, security, and every other engineering team.

Mentorship. You leave the team stronger than you found it.

The First Six Moons (Success Measures)

Expected Outcomes

30 days: Keys to the gate in hand. First production change shipped through the full pipeline. Existing Lambda and container services reviewed and their weak points written down.

90 days: You own one or more services end to end, including on-call. At least one improvement delivered to observability, deployment safety, or cost.

6 months: You lead the design and delivery of a new service or a major refactor, and you set or raise a team standard (a Lambda project template, a base Docker image, a Terraform module).

Must have

• 6+ years of professional software development.
• 4+ years building and operating production Node.js services in TypeScript.
• 3+ years running production workloads on AWS Lambda and ECS/Fargate.
• Owned at least one service from design through launch and on-call.
• Node.js internals: event loop, async patterns, streams, memory behavior, CommonJS and ESM.
• Fastify: built production APIs and migrated existing APIs to it.
• Vue.js: built production UIs and migrated existing UIs to it.
• AWS Lambda: handler lifecycle, execution environment reuse, concurrency model, event source mappings, layers, container-image functions, runtime upgrades.
• Production use of IAM, API Gateway, SQS, SNS, EventBridge, Step Functions, DynamoDB, S3, CloudWatch, ECR, ECS/Fargate, and VPC networking.
• AWS SDK for JavaScript v3: modular clients, middleware, pagination, retry configuration.
• Event-driven design: idempotent handlers, retry safety, dead-letter queues, partial batch failure reporting.
• Docker: multi-stage builds, layer caching, pinned base images, non-root users, debugging containers locally and in production.
• Terraform in production: remote state, modules, per-environment layouts.
• GitHub Actions or equivalent: test gates, environment promotion, OIDC federation to AWS with no long-lived credentials.
• Safe deploys: Lambda aliases with weighted traffic shifting, ECS rolling or blue/green, automated rollback on alarm.
• Testing: unit, integration, and contract tests (Jest, Vitest, or ava); local Lambda emulation with SAM CLI or LocalStack.
• MongoDB or DocumentDB, plus Elasticsearch or OpenSearch.
• Secrets in AWS Secrets Manager or SSM Parameter Store with KMS.
• Observability: structured logging, metrics, distributed tracing, SLOs, alarms, dashboards.
• On-call participation, incident leadership, and blameless postmortems.
• Writes design docs with explicit trade-offs (Lambda vs. Fargate, sync vs. async).
• Reviews code and mentors mid-level and junior engineers.

Preferred

• AWS certification: Developer Associate, Solutions Architect Associate or Professional, or DevOps Engineer Professional.
• AWS Organizations and multi-account landing zones.
• Identity-aware proxy or zero-trust access (Pomerium or equivalent).
• OpenTelemetry across Lambda and container workloads.
• Container supply-chain tooling: SBOM generation, image signing, Trivy, Grype, or Amazon Inspector.
• Migrated workloads between Lambda and containers, or from legacy hosts to serverless.
• Worked under SOC 2, PCI, or gaming/casino compliance.
• Java/Scala, Python, or Go.