Engineering Manager — Backend & Platform (Node.js)

SustainGRC is a governance intelligence infrastructure platform for non-financial data. Founded in London in 2022 and endorsed by the UK government as an innovator, we hold risk, internal audit, compliance, resilience, board governance, AI governance and sustainability on a single data model — built as one system rather than assembled through acquisition.

Our customers are mid-to-large enterprises and sovereign entities across EMEA and the GCC, operating under DORA, NIS2, the EU AI Act and equivalent regional supervision. When a regulator or auditor asks them to defend a number, our platform is what makes that number defensible.

The engineering standard follows from that: assurance-grade data, traceable to source, attributable to a person, and able to survive scrutiny years after the fact.

Role overview

You will own the backend and platform engineering function — the services, the security architecture, the production behaviour, and the engineers who build it.

This is a hands-on role. You are expected to write code, review it, and hold architectural authority, while building the practices that let a small team ship regulated software predictably. Roughly two-thirds engineering, one-third leadership, shifting as the function scales.

It suits engineers who have already led backend teams in production, think in platforms rather than endpoints, and treat security and auditability as design constraints rather than later additions.

Engineering leadership

• Own delivery for backend and platform: scope, sequencing, quality, and production outcomes
• Lead a small team of backend engineers — hiring, technical direction, code review standards, performance
• Hold architectural authority and defend the trade-offs to product, security and the executive team
• Translate regulatory and customer commitments into engineering constraints before they become rework
• Build the engineering practices this stage requires: design review, incident response, on-call, release discipline

Backend and platform

• Design, build and own scalable backend services in Node.js (TypeScript)
• Architect and maintain REST APIs and microservices across the platform
• End-to-end ownership: design → implementation → deployment → monitoring
• Identify architectural risk, edge cases and scalability constraints early
• Enforce clean architecture, SOLID principles and long-term maintainability

Security, access control and auditability

• Own authentication and authorisation architecture (JWT, OAuth2, RBAC)
• Design permission models and data access controls for multi-tenant enterprise and sovereign deployments
• Implement immutable audit logging and evidence lineage — every action logged, attributable and tamper-evident
• Support data residency and segregation requirements across UK, EU and GCC jurisdictions
• Own control evidence for ISO 27001 and Cyber Essentials Plus surveillance

Data, integrations and performance

• Design and optimise PostgreSQL schemas, queries and indexing
• Use Redis for caching, queues and performance
• Integrate external services with reliability and traceability
• Support real-time features where applicable (Socket.io) and S3-compatible object storage

Platform reliability and DevOps

• Docker-based containerisation and environment parity
• Own CI/CD pipelines (GitHub Actions or similar)
• Cloud deployments, GCP-first (GKE, Cloud Run, Cloud SQL, IAM, Cloud Storage); on-premises and VPC patterns for sovereign customers
• Monitoring, logging, alerting and error tracking
• Safe deployments, high availability, predictable releases

Required experience

• 6+ years professional backend engineering, including 2+ years leading engineers
• Strong Node.js and TypeScript expertise; production experience with Express, Fastify or NestJS
• Deep PostgreSQL; hands-on Redis
• Microservices and distributed systems in production
• Docker and CI/CD ownership
• Strong grasp of API security, authentication and RBAC
• Demonstrable ownership of production systems and of the people building them
• Comfortable making architectural decisions and defending the trade-offs to non-engineers

This role is not suitable for engineers without prior team leadership, or for managers who no longer write code.

Nice to have

• Google Cloud Platform, hands-on; Kubernetes (GKE) or managed container platforms
• Observability tooling (Prometheus, Grafana, Sentry, GCP Monitoring)
• Enterprise SaaS, compliance, or regulated-industry platforms
• Exposure to audit, GRC or financial services systems

What we offer

• Ownership of infrastructure that enterprises and sovereign entities depend on to satisfy regulators
• Fully remote, initially
• Competitive compensation, structured as base plus equity and performance-linked incentives
• High ownership, low bureaucracy — architectural decisions are made by the people building the system
• A direct path to Head of Engineering as the function scales