Senior Full-Stack Security/GRC Platform Engineer

Guidehouse • Murray, UT

3d • $86,500 - $129,900 • Remote

About The Position

We are hiring a senior engineer to maintain and extend a large full-stack Governance, Risk, and Compliance platform. The product is not a simple scanner wrapper. The current codebase includes a substantial FastAPI backend, a React/TypeScript frontend, a PostgreSQL data model, an async worker system, scanner integrations, an AI provider abstraction, a compliance framework catalog, audit/reporting workflows, and local/cloud deployment infrastructure. The ideal candidate can work confidently across backend services, frontend workflows, database migrations, security controls, AI-assisted analysis, scanner ingestion, and production operations.

Requirements

• Minimum of SIX (6) years’ experience with Python backend development.
• Strong FastAPI, Pydantic, SQLAlchemy, Alembic, async Python, and pytest experience.
• Strong React, TypeScript, Vite, React Router, React Query, and component architecture experience.
• PostgreSQL experience, including schema design, migrations, indexes, JSON/JSONB, and relational integrity.
• Experience maintaining large API surfaces and generated frontend API clients.
• Experience with background jobs or async workers using Redis-backed queues.
• Strong security engineering fundamentals: authentication, authorization, RBAC, audit logs, secret handling, dependency risk, and input validation.
• Ability to diagnose source-of-truth issues when documentation, generated code, database schema, and runtime behavior disagree.
• Security/GRC Domain Skills To Include Vulnerability findings and remediation workflows.
• Evidence collection and evidence sufficiency.
• SSPs, POA&Ms, control mappings, audit packages, and risk acceptance.
• NIST 800-53, RMF, FedRAMP/FISMA, CMMC, SCRM, ZTA, ISCM, and related compliance concepts.
• Scanner output from tools such as cloud security scanners, vulnerability scanners, SAST/IaC tools, secret scanners, identity/M365 scanners, and web security scanners.
• Provenance, auditability, and defensibility requirements for regulated workflows.
• AI/LLM Product Skills To Include Experience building AI-assisted product features, preferably in security, compliance, document review, or workflow automation.
• Understanding of RAG, embeddings, document extraction, prompt/context design, and evidence citation.
• Ability to enforce scoped context, provenance, guardrails, and human-review boundaries.
• Comfort maintaining provider abstractions across local and cloud AI providers.
• Infrastructure And Operations Skills To Include Docker Compose for local development.
• AWS-style production operations: containers, managed databases, caches, object storage, CDN, IAM, logs, and deployment pipelines.
• Terraform or similar infrastructure-as-code experience.
• CI/CD debugging and release discipline.
• Observability, logs, health checks, and operational runbooks.

Nice To Haves

• Prior experience with GRC, audit automation, security consulting tools, vulnerability management, FedRAMP/FISMA, or SSP/POA&M workflows.
• Experience with generated OpenAPI SDKs.
• Experience producing PDF, Excel, DOCX, PowerPoint, or audit package exports.
• Experience with immutable audit logs, provenance chains, multi-tenant permissions, or evidence workflows.

Responsibilities

• Maintain and extend a FastAPI backend with hundreds of registered API routes.
• Build and refine React/TypeScript product workflows across a large frontend surface.
• Design and maintain SQLAlchemy models, Alembic migrations, PostgreSQL queries, and data integrity rules.
• Support scanner integrations, finding normalization, deduplication, evidence workflows, and compliance mapping.
• Maintain AI-assisted features through a centralized provider abstraction rather than direct calls to providers.
• Work across GRC workflows including findings, evidence, SSPs, POA&Ms, RMF, FedRAMP/FISMA, SCRM, ZTA, ISCM, risk acceptance, and reporting.
• Keep local development and test environments healthy using Docker Compose, Redis, PostgreSQL, worker queues, Ollama, observability services, and frontend tooling.
• Maintain quality gates including linting, type checking, OpenAPI drift checks, migration safety, SDK drift, architecture boundaries, and test suites.
• Debug issues across frontend state, API contracts, database state, workers, scanner output, generated SDKs, and deployment configuration.
• Treat documentation as helpful but secondary to the codebase; validate assumptions against source, tests, migrations, and running behavior.

Benefits

• Medical, Rx, Dental & Vision Insurance
• Personal and Family Sick Time & Company Paid Holidays
• Parental Leave
• 401(k) Retirement Plan
• Group Term Life and Travel Assistance
• Voluntary Life and AD&D Insurance
• Health Savings Account, Health Care & Dependent Care Flexible Spending Accounts
• Transit and Parking Commuter Benefits
• Short-Term & Long-Term Disability
• Tuition Reimbursement, Personal Development, Certifications & Learning Opportunities
• Employee Referral Program
• Corporate Sponsored Events & Community Outreach Care.com annual membership
• Employee Assistance Program
• Supplemental Benefits via Corestream (Critical Care, Hospital Indemnity, Accident Insurance, Legal Assistance and ID theft protection, etc.)

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed