About the role
An engineer who takes over someone else's code after an audit, closes security and correctness findings, and gets the product to pilot without a rewrite. Half the work is the Python backend, half is TypeScript (frontend or a Node platform).
Format: full-time, Kyiv or remote within Ukraine. English B1+ for reading documentation and joining technical calls with the client.
Stack
- Python. Must have: 3.11+, Django/DRF, FastAPI or Starlette, async, pytest, uv/poetry, ruff. Nice to have: pandas, numpy, scipy; optimisation problems.
- TypeScript. Must have: React, modern TS, Vitest/Jest, Playwright. Nice to have: Node backend, Next.js.
- Data. Must have: PostgreSQL (schema, migrations with Django and Alembic, indexes, tenant isolation), Redis. Nice to have: pgvector, partitioning, Celery.
- Security. Must have: OAuth2/OIDC, JWT and JWKS, roles and permissions, OWASP Top 10, secrets handling. Nice to have: audits, Cyber Essentials, ISO 27001.
- AI. Must have: OpenAI or Anthropic API, tool calling, embeddings. Nice to have: MCP servers, LangSmith, answer-quality evaluation.
- Infrastructure. Must have: Docker, docker compose, GitLab CI. Nice to have: AWS (ECS, RDS), Kubernetes/k3s, Terraform.
Responsibilities
- Work through inherited code: read it, reproduce bugs locally, write a test before the fix.
- Close audit findings: secrets in the repository, permission and tenant checks, calculation correctness, concurrent runs.
- Build multi-tenant features: several sites per customer, roles, OAuth login.
- Integrate LLMs into the product: MCP tools, embedding search, checking results against the source.
- Build the e-commerce PoC on Medusa and the compliance layer: age verification, shipping restrictions, excise, payments.
- Set up CI gates, reproducible builds, and dependency checks.
- Review code for the client's team and our own developers.
Must have
- 5+ years of commercial development, including 3+ with Python in production and 2+ with TypeScript.
- Experience with a mid-size codebase written by others (100+ files) with no original authors around.
- Real experience with multi-tenancy or a complex permission model, not just CRUD.
- Writes tests as part of the task; knows the difference between unit, integration, and e2e tests.
- Understands how an OAuth flow works and what to check in a JWT.
- Can explain a technical decision to a non-technical person.
What we offer
- Flexible working hours.
- Paid vacation and sick leave.
- Professional development and learning opportunities.
- Collaboration with international teams and clients.