Senior Full-Stack Security/GRC Platform Engineer

About this role

Job Family : Cyber Engineering (CYS) Travel Required : Up to 10% Clearance Required : None

What You Will Do: We are hiring a senior engineer to maintain and extend a large full-stack Governance, Risk, and Compliance platform. The product is not a simple scanner wrapper. The current codebase includes a substantial FastAPI backend, a React/TypeScript frontend, a PostgreSQL data model, an async worker system, scanner integrations, an AI provider abstraction, a compliance framework catalog, audit/reporting workflows, and local/cloud deployment infrastructure. The ideal candidate can work confidently across backend services, frontend workflows, database migrations, security controls, AI-assisted analysis, scanner ingestion, and production operations. • Maintain and extend a FastAPI backend with hundreds of registered API routes. • Build and refine React/TypeScript product workflows across a large frontend surface. • Design and maintain SQLAlchemy models, Alembic migrations, PostgreSQL queries, and data integrity rules. • Support scanner integrations, finding normalization, deduplication, evidence workflows, and compliance mapping. • Maintain AI-assisted features through a centralized provider abstraction rather than direct calls to providers. • Work across GRC workflows including findings, evidence, SSPs, POA&Ms, RMF, FedRAMP/FISMA, SCRM, ZTA, ISCM, risk acceptance, and reporting. • Keep local development and test environments healthy using Docker Compose, Redis, PostgreSQL, worker queues, Ollama, observability services, and frontend tooling. • Maintain quality gates including linting, type checking, OpenAPI drift checks, migration safety, SDK drift, architecture boundaries, and test suites. • Debug issues across frontend state, API contracts, database state, workers, scanner output, generated SDKs, and deployment configuration. • Treat documentation as helpful but secondary to the codebase; validate assumptions against source, tests, migrations, and running behavior.

What You Will Need: • Minimum of SIX (6) years’ experience with Python backend development. • Strong FastAPI, Pydantic, SQLAlchemy, Alembic, async Python, and pytest experience. • Strong React, TypeScript, Vite, React Router, React Query, and component architecture experience. • PostgreSQL experience, including schema design, migrations, indexes, JSON/JSONB, and relational integrity. • Experience maintaining large API surfaces and generated frontend API clients. • Experience with background jobs or async workers using Redis-backed queues. • Strong security engineering fundamentals: authentication, authorization, RBAC, audit logs, secret handling, dependency risk, and input validation. • Ability to diagnose source-of-truth issues when documentation, generated code, database schema, and runtime behavior disagree.

Security/GRC Domain Skills To Include • Vulnerability findings and remediation workflows. • Evidence collection and evidence sufficiency. • SSPs, POA&Ms, control mappings, audit packages, and risk acceptance. • NIST 800-53, RMF, FedRAMP/FISMA, CMMC, SCRM, ZTA, ISCM, and related compliance concepts. • Scanner output from tools such as cloud security scanners, vulnerability scanners, SAST/IaC tools, secret scanners, identity/M365 scanners, and web security scanners. • Provenance, auditability, and defensibility requirements for regulated workflows.

AI/LLM Product Skills To Include • Experience building AI-assisted product features, preferably in security, compliance, document review, or workflow automation. • Understanding of RAG, embeddings, document extraction, prompt/context design, and evidence citation. • Ability to enforce scoped context, provenance, guardrails, and human-review boundaries. • Comfort maintaining provider abstractions across local and cloud AI providers.

Infrastructure And Operations Skills To Include • Docker Compose for local development. • AWS-style production operations: containers, managed databases, caches, object storage, CDN, IAM, logs, and deployment pipelines. • Terraform or similar infrastructure-as-code experience. • CI/CD debugging and release discipline. • Observability, logs, health checks, and operational runbooks.

What Would Be Nice To Have: • Prior experience with GRC, audit automation, security consulting tools, vulnerability management, FedRAMP/FISMA, or SSP/POA&M workflows. • Experience with generated OpenAPI SDKs. • Experience producing PDF, Excel, DOCX, PowerPoint, or audit package exports. • Experience with immutable audit logs, provenance chains, multi-tenant permissions, or evidence workflows.

The annual salary range for this position is $86,500.00-$129,900.00. Compensation decisions depend on a wide range of factors, including but not limited to skill sets, experience and training, security clearances, licensure and certifications, and other business and organizational needs. What We Offer: Guidehouse offers a comprehensive, total rewards package that includes competitive compensation and a flexible benefits package that reflects our commitment to creating a diverse and supportive workplace.

Benefits include: • Medical, Rx, Dental & Vision Insurance

• Personal and Family Sick Time & Company Paid Holidays

• Parental Leave

• 401(k) Retirement Plan

• Group Term Life and Travel Assistance

• Voluntary Life and AD&D Insurance

• Health Savings Account, Health Care & Dependent Care Flexible Spending Accounts

• Transit and Parking Commuter Benefits

• Short-Term & Long-Term Disability

• Tuition Reimbursement, Personal Development, Certifications & Learning Opportunities

• Employee Referral Program

• Corporate Sponsored Events & Community Outreach

• Care.com annual membership

• Employee Assistance Program

• Supplemental Benefits via Corestream (Critical Care, Hospital Indemnity, Accident Insurance, Legal Assistance and ID theft protection, etc.)

• Position may be eligible for a discretionary variable incentive bonus

About Guidehouse Guidehouse is an Equal Opportu

Similar jobs

• Senior Full Stack Engineer, Cloud Platform — Ridealso · Palo Alto
• Senior Full Stack Software Engineer, Platform — Intrinsicrobotics · Mountain View, California
• Senior Fullstack Engineer — Copilot Money · New York City
• Senior Fullstack Engineer — Allica Bank · Remote
• Senior Fullstack Engineer — Jukeboxhealth · Remote
• Senior Fullstack Engineer — Clera · Remote
• Senior Fullstack Engineer — Symbotic · USA Wilmington, MA - HQ
• Senior Fullstack Engineer — Orchestra Bio · San Francisco