Senior Full-Stack AI/Software Engineer

Level: Senior · Type: Full-time, hands-on Primary stack: Python · FastAPI · PostgreSQL · LLM APIs · React/TypeScript

The role

A senior, hands-on engineer who owns backend architecture, database-level security, and LLM/AI systems — and reviews this code to a high bar. You set the patterns, make the technical decisions, and are the last line of defense on the highest-risk code.

This is an AI-assisted build: AI coding tools generate most of the implementation. Your value is engineering judgment — architecture, technical decisions, rigorous code review, edge cases, and unblocking — not lines typed. Because generation is fast, review is the bottleneck, and reviewing security and data-isolation code is the most critical thing you do.

The depth requirements below are deliberately specific. We expect you to have hands-on, production-grade command of most of them and the ability to reason from first principles about the rest.

Technical depth we expectPython (expert)

• Idiomatic modern Python (3.11+): type hints, dataclasses/pydantic models, generics, protocols.
• Async: asyncio event loop model, async/await, structured concurrency, the blocking-call-in-async-context trap, asyncio.gather vs TaskGroup, cancellation and timeouts.
• Performance: profiling (cProfile/py-spy), where the GIL matters and where it doesn’t, when to reach for processes vs threads vs async, memory profiling for long-running services.
• Packaging and dependency hygiene; pinned, reproducible builds.

FastAPI / API design (expert)

• Dependency-injection system, request lifecycle, middleware ordering, background tasks, lifespan events.
• Pydantic v2 models for request/response validation; custom validators; serialization edge cases.
• Server-Sent Events (SSE) and streaming responses — backpressure, client disconnects, partial-failure mid-stream, keep-alives.
• Auth integration: JWT (signing, verification, key rotation, exp/nbf/aud claim validation, clock-skew handling), API-key schemes (hashing, prefixing, one-time display, immediate revocation), OAuth/third-party identity providers.
• Rate limiting, idempotency keys, consistent error envelopes, pagination, request tracing.
• OpenAPI generation and contract discipline (versioned, backward-compatible changes).

PostgreSQL (deep)

• Schema design, normalization trade-offs, constraints, and migration discipline (zero-downtime migrations, expand/contract pattern).
• Indexing: B-tree vs GIN vs GiST, partial and composite indexes, covering indexes, when an index won’t be used.
• EXPLAIN (ANALYZE, BUFFERS) — reading query plans, spotting seq scans, nested-loop blowups, and bad row estimates.
• Row-Level Security (RLS): CREATE POLICY, USING vs WITH CHECK, FORCE ROW LEVEL SECURITY, policy interaction with roles, the SET ROLE / session-variable patterns for multi-tenant scoping, and how RLS composes with joins and views.
• Transactions and isolation levels (read-committed vs serializable), locking, deadlocks, SELECT … FOR UPDATE, advisory locks.
• Connection pooling (PgBouncer, transaction vs session pooling and what breaks in each), pgvector for embedding storage and ANN search (HNSW/IVFFlat trade-offs, recall vs latency).
• JSONB usage and its indexing/perf trade-offs; partitioning for large tables.

Security & multi-tenant data isolation (deep — non-negotiable)

• Threat-model multi-tenant systems; reason rigorously about whether any given query path can leak data across a tenant/permission boundary.
• Enforce isolation at the database layer (RLS), not just in application code; understand why app-layer filtering alone is insufficient.
• Permission-before-retrieval discipline: design so restricted data is never fetched and then discarded — the check precedes the query.
• Append-only / immutable audit trails (REVOKE UPDATE/DELETE, trigger-based history, tamper-evidence).
• Secrets handling, encryption at rest/in transit, PII minimization, timing-attack awareness in auth paths.
• Common web vulns (OWASP Top 10) and their concrete mitigations in this stack.

LLM / AI engineering (production-grade)

• Retrieval and context assembly: chunking strategies, embedding models, similarity search, re-ranking, and assembling context under a hard token budget (counting tokens, prioritization, compression/truncation strategies, graceful degradation when over budget).
• Prompt engineering as a discipline: system/role structuring, few-shot vs zero-shot tr…