Were looking for a Lead Full-Stack Engineer to own the application layer of an enterprise SaaS platform backend API, relational database, and React frontend. Youll take a working prototype to production: server-enforced authorization, encrypted sensitive fields, SSO, and a live API-backed SPA replacing client-only demo state.

Architecture Youll Work In

Browser (React SPA)

HTTPS / JWT session

Express API (Node.js)

per-request tenant context + transaction

PostgreSQL (RLS-enforced, org-scoped)

envelope encryption for sensitive fields

KMS AES-GCM sidecar storage

Auth: Okta OIDC (Auth Code + PKCE) server-issued JWT

Deploy: GitLab CI/CD (OIDC) Docker ECR ECS Fargate

Frontend host: S3 + CloudFront

Database: RDS PostgreSQL 15 + RDS Proxy (SSL)

Poly-repo layout: separate repositories for API, web SPA, SQL migrations, and infrastructure (Terraform). Release order: migrations API frontend infra.

Multi-Tenancy & Authorization Model

Each HTTP request sets org context in a DB transaction; row-level security policies enforce access the client cannot widen scope.

Server-enforced RBAC with role-scoped data (group assignment, management chain, field-level stripping for certain roles, aggregate-only views for executives). Separation of duties: no self-review or self-approval.

Tech Stack

Layer

Technologies

Runtime

Node.js 20 (ES modules), Docker (node:20-alpine)

Backend

Express 4, CORS, Morgan, dotenv

Database

PostgreSQL 15, pg driver, RLS, RDS Proxy, versioned SQL migrations

Auth

JWT, bcryptjs, Okta OIDC (Auth Code + PKCE), group role mapping

Encryption





AWS KMS, AES-GCM, per-tenant DEK wrapping, encrypted field sidecar tables

Frontend

React 18, Vite 5, JSX

UI & viz

lucide-react, Recharts, xlsx export

Cloud

ECS Fargate, ALB, ECR, RDS, S3, CloudFront, KMS, Secrets Manager

CI/CD

GitLab CI/CD with OIDC (no long-lived AWS keys)

IaC

Terraform 1.5 (coordination with platform engineer, not primary ownership)

Responsibilities

- Design and implement the production REST API routing, middleware, error handling, transaction management

- Build PostgreSQL schema and migrations tables, indexes, RLS policies, tenant context functions

- Implement server-enforced RBAC role-scoped queries, field-level visibility rules, management-chain derivation, audit logging

- Own authentication and sessions OIDC callback flow, JWT issuance/validation, session rotation, JWKS verification

- Build field-level encryption KMS envelope encryption, encrypt/decrypt service, sidecar storage pattern

- Develop the React SPA complex forms, role-based navigation, client-server state sync, live API cutover from demo/local storage

- Implement domain lifecycle endpoints create, submit, approve, calibrate (with reason + audit trail), export





- Maintain Docker images and coordinate ECS deployments via GitLab pipelines

- Write API documentation and contribute to security/compliance evidence (RBAC matrix, data-flow descriptions)

- Collaborate with integrations engineer on API surfaces for external sync and OAuth token storage

- Collaborate with platform engineer on RDS, KMS keys, secrets, and deploy health

Requirements Must Have

- 5+ years building production web applications with meaningful backend and frontend ownership

- Strong Node.js / Express REST design, middleware, DB transactions

- Deep PostgreSQL migrations, RLS, connection pooling, query optimization

- Robust React complex state, role-scoped UI, form workflows beyond simple CRUD

- Security-first approach never trust client for authorization; encrypt sensitive data; audit mutations

- JWT + OIDC/OAuth 2.0 experience (Okta, Auth0, Entra ID, or equivalent)

- Docker, containerized deploys, CI/CD (GitLab or equivalent)

- Comfortable working independently in a poly-repo with minimal process

Requirements Strongly Preferred

- AWS application development: ECS, RDS, KMS, Secrets Manager, S3/CloudFront

- Multi-tenant SaaS with org-scoped data isolation

- Envelope encryption / KMS-wrapped DEK patterns

- Enterprise SaaS with complex RBAC and separation of duties

- Terraform literacy

Nice to Have

- SOC 2 or enterprise security review experience

- HR/people-systems domain knowledge

- LLM API integration in production apps

","

📌 Lead Full Stack Engineer (Karnataka)
🏢 Winspire Tech
📍 Karnataka