Senior Full-Stack Security/GRC Platform Engineer

Role Description

We are hiring a senior engineer to maintain and extend a large full-stack Governance, Risk, and Compliance platform. The product is not a simple scanner wrapper. The current codebase includes:

• A substantial FastAPI backend
• A React/TypeScript frontend
• A PostgreSQL data model
• An async worker system
• Scanner integrations
• An AI provider abstraction
• A compliance framework catalog
• Audit/reporting workflows
• Local/cloud deployment infrastructure

The ideal candidate can work confidently across:

• Backend services
• Frontend workflows
• Database migrations
• Security controls
• AI-assisted analysis
• Scanner ingestion
• Production operations

• Maintain and extend a FastAPI backend with hundreds of registered API routes.
• Build and refine React/TypeScript product workflows across a large frontend surface.
• Design and maintain SQLAlchemy models, Alembic migrations, PostgreSQL queries, and data integrity rules.
• Support scanner integrations, finding normalization, deduplication, evidence workflows, and compliance mapping.
• Maintain AI-assisted features through a centralized provider abstraction rather than direct calls to providers.
• Work across GRC workflows including findings, evidence, SSPs, POA&Ms, RMF, FedRAMP/FISMA, SCRM, ZTA, ISCM, risk acceptance, and reporting.
• Keep local development and test environments healthy using Docker Compose, Redis, PostgreSQL, worker queues, Ollama, observability services, and frontend tooling.
• Maintain quality gates including linting, type checking, OpenAPI drift checks, migration safety, SDK drift, architecture boundaries, and test suites.
• Debug issues across frontend state, API contracts, database state, workers, scanner output, generated SDKs, and deployment configuration.
• Treat documentation as helpful but secondary to the codebase; validate assumptions against source, tests, migrations, and running behavior.

Qualifications

• Minimum of SIX (6) years’ experience with Python backend development.
• Strong FastAPI, Pydantic, SQLAlchemy, Alembic, async Python, and pytest experience.
• Strong React, TypeScript, Vite, React Router, React Query, and component architecture experience.
• PostgreSQL experience, including schema design, migrations, indexes, JSON/JSONB, and relational integrity.
• Experience maintaining large API surfaces and generated frontend API clients.
• Experience with background jobs or async workers using Redis-backed queues.
• Strong security engineering fundamentals: authentication, authorization, RBAC, audit logs, secret handling, dependency risk, and input validation.
• Ability to diagnose source-of-truth issues when documentation, generated code, database schema, and runtime behavior disagree.

Requirements

• Vulnerability findings and remediation workflows.
• Evidence collection and evidence sufficiency.
• SSPs, POA&Ms, control mappings, audit packages, and risk acceptance.
• NIST 800-53, RMF, FedRAMP/FISMA, CMMC, SCRM, ZTA, ISCM, and related compliance concepts.
• Scanner output from tools such as cloud security scanners, vulnerability scanners, SAST/IaC tools, secret scanners, identity/M365 scanners, and web security scanners.
• Provenance, auditability, and defensibility requirements for regulated workflows.

Benefits

• Medical, Rx, Dental & Vision Insurance
• Personal and Family Sick Time & Company Paid Holidays
• Parental Leave
• 401(k) Retirement Plan
• Group Term Life and Travel Assistance
• Voluntary Life and AD&D Insurance
• Health Savings Account, Health Care & Dependent Care Flexible Spending Accounts
• Transit and Parking Commuter Benefits
• Short-Term & Long-Term Disability
• Tuition Reimbursement, Personal Development, Certifications & Learning Opportunities
• Employee Referral Program
• Corporate Sponsored Events & Community Outreach
• Care.com annual membership
• Employee Assistance Program
• Supplemental Benefits via Corestream (Critical Care, Hospital Indemnity, Accident Insurance, Legal Assistance and ID theft protection, etc.)
• Position may be eligible for a discretionary variable incentive bonus