Senior Backend & Platform Security Engineer

About SustainGRC

SustainGRC is governance intelligence infrastructure for non-financial data. We hold risk, internal audit, compliance, resilience, board governance, AI governance and sustainability on a single data model. It was built as one system, not assembled through acquisition.

Our customers are enterprises and sovereign entities across EMEA and the GCC, operating under DORA, NIS2, the EU AI Act and regional equivalents. When a regulator asks them to defend a number, our platform makes it defensible. That sets our engineering standard: data traceable to source, attributable to a person, and able to survive scrutiny years later.

The role

You will own core backend services, security architecture and production reliability for regulated enterprise workloads. This is not a feature-delivery role. You will be accountable for how the system behaves in production.

The platform works, but it needs hardening. Your first priority is moving it to a typed, validated and tested standard without stalling delivery. If that sounds like the interesting part, read on.

What you'll own

• Backend services in Node.js and TypeScript, from design through deployment and monitoring
• API architecture and module boundaries, enforcing clean, maintainable structure
• Authentication and authorisation (OAuth2, JWT, RBAC) and multi-tenant data isolation
• Immutable, tamper-evident audit logging and evidence lineage
• Data residency and segregation across UK, EU and GCC deployments
• PostgreSQL schema design and performance, Redis for caching and queues, and S3-compatible storage
• CI/CD, containerisation and observability on GCP, plus on-premises and VPC patterns for sovereign customers
• Control evidence for ISO 27001 and Cyber Essentials Plus

What you'll bring

• 7+ years of backend engineering, including real ownership of production systems
• Strong Node.js and TypeScript, with production experience in Express, Fastify or NestJS
• Deep PostgreSQL and hands-on Redis
• A strong grasp of API security, input validation and access control
• Docker and CI/CD
• Judgement to make architectural decisions and defend the trade-offs

Nice to have

• GCP, GKE or Cloud Run
• Observability tooling (Sentry, Prometheus, Grafana)
• Experience in regulated, GRC, audit or financial services platforms

What we offer

• A founding role with meaningful equity, vesting over four years with a one-year cliff
• Equity and performance incentives for the first three months, then a competitive salary alongside equity
• Ownership of infrastructure that enterprises and sovereign entities rely on to satisfy regulators
• Architectural decisions made by the people building the system
• A clear path to Head of Engineering as the team grows