About us:

StickManCyber is a leading Cybersecurity-as-a-Service company based in Sydney, Australia. StickSecure is our multi-tenant SaaS platform for cybersecurity compliance and risk management — it automates evidence collection, control assessment and risk reporting across a customer’s entire cloud and security estate. It is a real, production platform with real customers: a .NET 9 modular monolith, a React SPA, 26 third-party integration adapters, a containerised scanning engine, and an AI document-processing service.

You would be joining a small, senior, distributed engineering team.

About the role:

This is a hands-on individual contributor role with a high degree of autonomy. You will own features end to end — from a Jira ticket, through design and implementation, to tests, code review, deployment and production verification.

We are deliberately a small team. That means you will have real ownership and very little process, but it also means we need people who can run without close supervision. If you need daily direction to make progress, this is not the right role for you.

What you will actually work on:

- Building and extending features across a .NET 9 modular monolith — five business modules (Compliance, Risk Management, Penetration Testing, SOC, Dashboard) built on clean architecture with CQRS.
- Multi-tenant data access with EF Core 9 and SQL Server — tenant isolation, soft delete, temporal tables, optimistic concurrency and query performance. Tenant isolation is a security boundary in our product, not a convenience.
- Asynchronous processing pipelines — Azure Storage Queues and Hangfire background jobs coordinating scans across containerised services, including idempotency, retries and poison-message handling.
- Integration adapters against third-party security and productivity APIs — Microsoft Graph, Okta, Jira, ServiceNow, AWS, GCP, CrowdStrike, SentinelOne and more. Real-world API problems: pagination, rate limits, partial failures, credential management.
- Diagnosing and fixing production issues in Azure using Application Insights, KQL, structured logs and correlation IDs — often across service boundaries.
- Automated tests (xUnit, Moq)



and architecture fitness tests, plus code review of your peers’ work.
- Report generation — PDF and Excel output for compliance and audit deliverables.

Essential — you must have all of these

- We will screen against every item on this list. Please do not apply if you cannot speak to all of them in detail.
- C# and .NET at senior level — 6+ years professional experience, with substantial recent work on .NET Core / .NET 5 or later. We are on .NET 9.
- ASP.NET Core Web API design — REST API design, API versioning, authentication and authorisation, model validation, and consistent error handling.
- Entity Framework Core in depth — not just CRUD. You understand the change tracker, how LINQ becomes SQL, migrations, query splitting, N+1 problems, and how to diagnose a query that is slow or returns the wrong rows.
- SQL Server and T-SQL — you can write and read non-trivial queries, reason about indexes, and read an execution plan.
- Asynchronous and concurrent programming — async/await used correctly, cancellation tokens, and an understanding of why blocking on async code causes deadlocks.
- Azure development — App Service, Azure Functions, Key Vault, Storage Queues and Blobs, Managed Identity, and application configuration/secrets handling.
- Production diagnostics on Azure — Application Insights, writing KQL queries, structured logging, and tracing a single request across multiple services. You have debugged something in production that you could not reproduce locally.
- Automated testing as a default habit — unit and integration tests. You write them because the code needs them, not because someone asked.
- Git and pull-request discipline — clean commits, meaningful PR descriptions, and giving and receiving code review well.



CI/CD exposure (GitHub Actions or equivalent).
- Robust written English — most collaboration is asynchronous with a team in Australia. Clear written updates, questions and documentation are part of the job, not an extra.
- Independent problem solving — when a requirement is ambiguous, you investigate the codebase first and then come back with a specific question and a proposed answer.

Highly desirable:

- Bachelor’s degree in Computer Science or equivalent practical experience.
- You will not be rejected for missing these, but each one materially strengthens an application.
- Clean / onion architecture, Domain-Driven Design, and CQRS with MediatR.
- Multi-tenant SaaS experience — Finbuckle.MultiTenant or an equivalent tenant-resolution and data-isolation approach.
- Background job frameworks (Hangfire, Quartz) and message-queue patterns — idempotent consumers, retry and dead-letter handling.
- Identity providers — Auth0, or OAuth2/OIDC and JWT generally, plus role-based access control.
- Docker and containerised workloads; Infrastructure as Code (Bicep or Terraform).
- Cybersecurity, compliance or GRC domain knowledge — ISO 27001, NIST CSF, Essential Eight, CVSS.
- Enough React to read the frontend and unblock yourself. You will not own the SPA, but you will occasionally need to trace a bug from the UI into the API.
- Python, Go or PowerShell — our scanner, AI engine and orchestration services use them.

Not required:

- You do not need to be a frontend developer. This is a backend role.
- You do not need to be a penetration tester or security practitioner — we will teach you the domain.
- How we work
- Small senior team, low process, high trust. Work is tracked in Jira; you keep your own tickets current.
- You verify your own work before it lands — run it, test it, and read your own diff before requesting review.
- Blockers are raised early, with the investigation already done and options attached.
- AI-assisted development tooling is encouraged. You remain accountable for everything you ship.

Core overlap with Australian business hours is expected; the rest of your day is yours to organise.

📌 Senior Backend Engineer (India)
🏢 StickmanCyber
📍 India