Project: Multi-Tenant AI & GRC Platform

Location: Remote / Hybrid

Employment Type: Full time

Experience Level: Senior / Lead (5+ years)

Industry: Information Security / SaaS / Enterprise Software

About the Role

We are building an enterprise-grade, multi-tenant Governance, Risk, and Compliance (GRC) platform designed to eliminate compliance fatigue across global and regional frameworks (including ISO 27001, NIST CSF 2.0, DORA, NIS2, SAMA, and India’s DPDP Act).

We are looking for a Senior Full-Stack Product Engineer / Tech Lead with deep expertise in PostgreSQL data modeling, multi-tenant architecture, and applied AI/RAG systems . You will own the technical execution end-to-end—translating our comprehensive architecture blueprint into a secure, audit-ready, high-performance SaaS platform.

What You Will Build

- Unified Control Framework (UCF) Engine: Implement crosswalk data models that map one universal questionnaire response across overlapping compliance benchmarks (NIST, CIS, ISO, SOC 2, DORA, DPDP).
- Strict Multi-Tenant Database Architecture: Build zero-leakage tenant isolation using native PostgreSQL Row-Level Security (RLS) and custom session claims.
- Point-in-Time Temporal Tracking: Design append-only versioning mechanisms (valid_from / valid_to) to allow enterprise clients and auditors to reconstruct historical compliance posture on demand.
- Autonomous AI Remediation Engine (RAG): Construct retrieval-augmented generation pipelines using pgvector and structured LLM outputs (Pydantic) to evaluate gaps and draft actionable remediation steps, CLI scripts, and policy clauses.
- Enterprise-Grade Evidence Vault:



Implement direct client-to-storage presigned uploads (Cloudflare R2/S3) with client-side cryptographic hashing (SHA-256) to ensure tamper-proof audit artifacts.
- Dynamic Risk Register: Build a real-time risk engine linking questionnaire evaluations to dynamic residual risk calculations and interactive heatmaps.

Key Requirements1. Backend & Data Modeling (Core Strength)
- PostgreSQL Mastery: Extensive hands-on experience with native Row-Level Security (RLS) , session-variable hydration, recursive CTEs, JSONB manipulation, and indexing strategies.
- Temporal Data Modeling: Proven experience designing append-only, audit-proof event tracking and historical time-travel snapshot querying.
- Python Backend: Strong production experience with FastAPI , Pydantic (v2), SQLAlchemy/asyncpg, and async worker architectures (Redis/Celery).

1. Applied AI & RAG Pipelines

- Hands-on experience implementing Retrieval-Augmented Generation (RAG) using vector databases (specifically pgvector with HNSW indexing).

- Experience orchestrating LLM tool calling and forcing structured JSON schemas (Pydantic/function calling).
- Familiarity with data sanitization/redaction pipelines (e.g., Microsoft Presidio, secret filtering)



to protect sensitive tenant data before sending context to LLMs.

1. Modern Frontend Architecture

- High proficiency in Next.js (App Router, TypeScript) and Tailwind CSS .
- Experience building complex, data-heavy enterprise UIs using shadcn/ui and TanStack Table (handling virtualized rows, dynamic filtering, multi-step wizards, and auto-saving states).

1. Enterprise Security &

• Infrastructure

- Solid understanding of authentication and enterprise SSO protocols (SAML 2.0, OIDC via Okta/Azure AD) and Role-Based Access Control (RBAC).
- Experience with object storage workflows using presigned PUT URLs (Cloudflare R2 / AWS S3).

Nice-to-Haves
- Prior experience developing B2B GRC, cybersecurity, fin-tech, or regulatory compliance tools.
- Familiarity with major cybersecurity frameworks (ISO 27001, SOC 2, NIST CSF, DORA, GDPR, DPDP).
- Experience designing systems subject to strict regional data residency regulations (EU, Middle East, India).

Interview Process
1. Initial Fit &

• Architectural Screen (30 mins):

High-level discussion of past projects, multi-tenancy approaches, and technical philosophy.
2. Technical Deep-Dive &

• System Design (60 mins):

We will walk through our existing architecture blueprint. You'll explain how you would structure PostgreSQL RLS policies, execute point-in-time temporal queries, and build an hallucination-free RAG remediation worker.
3. Hands-On Code Walkthrough / Practical Review (45 mins): Discussion of production code, data schema design patterns, or a short domain-specific exercise.
4. Offer &

• Kickoff.

📌 Senior Full-Stack Engineer / Technical Lead (New Delhi)
🏢 techmier
📍 New Delhi