Senior Backend Engineer

Base pay range

$/yr - $/yr

Senior Engineering Manager / Director of Engineering

Hybrid: NC, MA, NY

Full-Time, Exempt

Due to the nature of our work with federal government clients and compliance with applicable regulations, this position requires U.S. citizenship. Dual citizenship is not permitted for this role. Candidates must be able to provide documentation verifying sole U.S. citizenship status as part of the background check process.

Integrations, AI/ML, Compliance Automation, Infrastructure Analysis

You’ll be the backend powerhouse responsible for building KnoxAI’s core compliance engine—integrating with third‑party services, implementing AI‑driven analysis, and automating the complex workflows required for FedRAMP and DISA authorizations. Your work will directly impact federal agencies’ ability to assess and authorize SaaS applications securely and efficiently.

This role is ideal for a senior engineer who loves solving hard integration problems, working with cutting‑edge AI/ML technologies, and building systems that must be both highly reliable and auditable for government compliance.

Core Platform Development

• KSI Compliance Engine: Build automated validation for Key Security Indicators across 26+ KSI families (CNA, IAM, SVC, MLA, etc.) with hybrid automated + AI‑driven scoring
• Integration Pipelines: Develop and maintain integrations with FedRAMP‑authorized services
• Security: Crowd Strike (SIEM, EDR, CNAPP), AWS Security Hub, Guard Duty, Inspector, Cloud Trail
• IAM/PAM: Okta, Keeper (via CLI/SDK for just‑in‑time access, session metadata, audit logs)
• Operations: Jira (CAB approvals), Service Now (ITSM), Pager Duty (incident response)
• Training/Awareness: KnowBe4 (security awareness metrics)
• Infrastructure Analysis: Parse and analyze Terraform/Cloud Formation to identify NIST SP 800‑53 control alignment and misconfigurations
• DAST Implementation: Enhance and product ionize OWASP ZAP integration for dynamic application security testing of customer SaaS applications
• Document Repository: Build secure, controlled repository for customer‑specific documentation with AI‑powered SSP overlay generation

AI/ML Integration

• Model Orchestration: Implement multi‑model workflows combining OpenAI (GPT‑4o), Anthropic (Claude), Google (Gemini), and Groq for compliance reasoning
• Model Context Protocol: Build MCP tools exposing platform capabilities to AI agents (user management, findings retrieval, KSI analysis)
• Fine‑Tuning Pipeline: Collaborate on QWEN fine‑tuning using Knox’s decade of FedRAMP/DISA assessment data
• Prompt Engineering: Design and optimize prompts for compliance analysis, risk scoring, and remediation recommendations
• Vector Search: Implement RAG (Retrieval‑Augmented Generation) for policy/control lookup using Open Search or dedicated vector DB

Data Layer & Scalability

• Database Design: Extend Prisma schema for new features; optimize complex queries across 35+ models
• Caching Strategies: Implement Redis caching for frequently accessed compliance data and KSI results
• Event‑Driven Architecture: Build SQS‑based job queues for long‑running compliance evaluations and bulk imports
• API Performance: Ensure API response times 80% code coverage on critical paths
• Documentation: Maintain up‑to‑date API documentation (OpenAPI), architecture decision records (ADRs), and runbooks

Technical Skills

• 5+ years backend development with Type Script/Node.js; deep understanding of async patterns, streams, and event loops
• NestJS or similar frameworks (Express, Fastify, Koa) with dependency injection and modular architecture
• Postgre
  
  SQL expertise: Complex joins, CTEs, window functions, indexing strategies, query optimization
• Prisma ORM or similar (TypeORM, Sequelize) with migrations and schema management
• AWS services: S3, Lambda, SQS, Dynamo
  
  DB, Open Search, Secrets Manager, IAM policies
• AI/ML APIs: Hands‑on experience integrating OpenAI, Anthropic, Google Gemini, or similar (not just basic prompts—complex workflows, streaming, function calling)

Integration & Automation

• Third‑party API integration: OAuth2, SAML, webhooks, retry logic, API versioning, SDK usage
• In…