Principal Engineer

Responsibilities:

• Parachute engineering. Take the gnarliest cross-team problems performance cliffs, data-integrity scares, migration landmines, one-tenant-only prod mysteries and drive them to root cause and closure, hands on keyboard.
• Zero-to-one prototypes. Turn the CTO's what-ifs into a working spike in days, not quarters: internal platforms, security primitives, AI-powered workflows. Some get killed. That's the point.
• Technical due diligence. Run build-vs-buy and vendor/OSS evaluations (PAM tooling, observability, AI platforms, databases) and write the decision memo that survives both engineering scrutiny and an auditor.
• Security and compliance engineering. Threat-model features before they ship, respond to CVEs and advisories across the fleet, and design controls that satisfy RBI and SOC 2 auditors without strangling developer velocity.
• AI leverage. Push our agentic-coding rollout, LLM MR-review pipelines, and self-hosted model experiments further. Measure honestly. Kill what doesn't earn its cost.
• Architecture pressure-testing. Review designs for multi-tenancy, session and token security, BFF-layer hardening, and PostgreSQL at scale (Patroni, PgBouncer, replication and lock behaviour) before problems become incidents.
• Stand in for the CTO. Client security reviews, incident bridges, internal design debates when he can't be in the room; you are the room.

Requirements:

• Principal-grade depth typically 8+ years shipping and operating production systems, with the scar tissue to prove it.
• Genuine polyglot fluency. Production work in at least four of: PHP (Laravel), TypeScript, Python, Go, Rust, Lua. You pick up a new language over a weekend, and it shows in code review on Monday.
• Deep Linux and infrastructure chops. Kubernetes (EKS) and container internals, Docker Swarm realities, HAProxy/OpenResty, Cloudflare Zero Trust, and the ability to debug from strace all the way up to Grafana dashboards.
• PostgreSQL beyond CRUD. Replication topologies, connection pooling behaviour, lock contention, and what actually happens under load.
• A security instinct. OWASP is table stakes. You can reason about mTLS, token binding, IDOR/BOLA, key custody, and crucially what an RBI or SOC 2 auditor will ask about your design.
• An AI-native workflow. You already use agentic coding tools daily, know precisely where they break, and can teach others to get leverage without losing rigour.
• Sharp technical writing. RFCs, decision memos, postmortems. Half this job is making hard decisions legible to engineers, auditors, and the board.
• Ownership under ambiguity. You can be handed a question, not a ticket, and return with the answer, the fix, and the prevention.

Nice to have:

• BFSI or fintech domain depth: loan origination, credit underwriting flows, payments, or core banking integrations.
• Fleet-scale CI/CD on self-hosted GitLab; supply-chain security (SBOMs, dependency tracking, CERT-In reporting).
• Hands-on experience self-hosting LLMs or building evaluation harnesses for AI in production.
• Open-source contributions anywhere in our stack.