Abdul Rafay Admin

Astroum AI

Level: Principal/Staff &middot; Type: Full-time, hands-on Primary stack: Python &middot; FastAPI &middot; PostgreSQL &middot; LLM APIs &middot; React/TypeScriptThe role: (End to end delivery responsibility - Mandatory 5+ years experience in software development)A Principal/Staff, hands-on engineer who owns backend architecture, database-level security, and LLM/AI systems &mdash; and reviews this code to a high bar. You set the patterns, make the technical decisions, and are the last line of defense on the highest-risk code.This is an AI-assisted build: AI coding tools generate most of the implementation. Your value is engineering judgment &mdash; architecture, technical decisions, rigorous code review, edge cases, and unblocking &mdash; not lines typed. Because generation is fast, review is the bottleneck, and reviewing security and data-isolation code is the most critical thing you do.The depth requirements below are deliberately specific. We expect you to have hands-on, production-grade command of most of them and the ability to reason from first principles about the rest.Technical depth we expectPython (expert)<ul><li>Idiomatic modern Python (3.11+): type hints, dataclasses/pydantic models, generics, protocols.</li><li>Async: asyncio event loop model, async/await, structured concurrency, the blocking-call-in-async-context trap, asyncio.gather vs TaskGroup, cancellation and timeouts.</li><li>Performance: profiling (cProfile/py-spy), where the GIL matters and where it doesn't, when to reach for processes vs threads vs async, memory profiling for long-running services.</li><li>Packaging and dependency hygiene; pinned, reproducible builds.</li></ul>FastAPI / API design (expert)<ul><li>Dependency-injection system, request lifecycle, middleware ordering, background tasks, lifespan events.</li><li>Pydantic v2 models for request/response validation; custom validators; serialization edge cases.</li><li>Server-Sent Events (SSE) and streaming responses &mdash; backpressure, client disconnects, partial-failure mid-stream, keep-alives.</li><li>Auth integration: JWT (signing, verification, key rotation, exp/nbf/aud claim validation, clock-skew handling), API-key schemes (hashing, prefixing, one-time display, immediate revocation), OAuth/third-party identity providers.</li><li>Rate limiting, idempotency keys, consistent error envelopes, pagination, request tracing.</li><li>OpenAPI generation and contract discipline (versioned, backward-compatible changes).</li></ul>PostgreSQL (deep)<ul><li>Schema design, normalization trade-offs, constraints, and migration discipline (zero-downtime migrations, expand/contract pattern).</li><li>Indexing: B-tree vs GIN vs GiST, partial and composite indexes, covering indexes, when an index won't be used.</li><li>EXPLAIN (ANALYZE, BUFFERS) &mdash; reading query plans, spotting seq scans, nested-loop blowups, and bad row estimates.</li><li>Row-Level Security (RLS): CREATE POLICY, USING vs WITH CHECK, FORCE ROW LEVEL SECURITY, policy interaction with roles, the SET ROLE / session-variable patterns for multi-tenant scoping, and how RLS composes with joins and views.</li><li>Transactions and isolation levels (read-committed vs serializable), locking, deadlocks, SELECT ... FOR UPDATE, advisory locks.</li><li>Connection pooling (PgBouncer, transaction vs session pooling and what breaks in each), pgvector for embedding storage and ANN search (HNSW/IVFFlat trade-offs, recall vs latency).</li><li>JSONB usage and its indexing/perf trade-offs; partitioning for large tables.</li></ul>Security &amp; multi-tenant data isolation (deep &mdash; non-negotiable)<ul><li>Threat-model multi-tenant systems; reason rigorously about whether any given query path can leak data across a tenant/permission boundary.</li><li>Enforce isolation at the database layer (RLS), not just in application code; understand why app-layer filtering alone is insufficient.</li><li>Permission-before-retrieval discipline: design so restricted data is never fetched and then discarded &mdash; the check precedes the query.</li><li>Append-only / immutable audit trails (REVOKE UPDATE/DELETE, trigger-based history, tamper-evidence).</li><li>Secrets handling, encryption at rest/in transit, PII minimization, timing-attack awareness in auth paths.</li><li>Common web vulns (OWASP Top 10) and their concrete mitigations in this stack.</li></ul>LLM / AI engineering (production-grade)<ul><li>Retrieval and context assembly: chunking strategies, embedding models, similarity search, re-ranking, and assembling context under a hard token budget (counting tokens, prioritization, compression/truncation strategies, graceful degradation when over budget).</li><li>Prompt engineering as a discipline: system/role structuring, few-shot vs zero-shot trade-offs, output-format enforcement (JSON-mode/structured outputs), and prompt-injection awareness.</li><li>Handling non-determinism: temperature/sampling effects, retries, validation-and-repair loops, idempotency around model calls.</li><li>Hallucination control and evaluation: grounding/citation strategies, eval harnesses, regression testing of prompt changes, measuring quality rather than eyeballing.</li><li>Cost/latency engineering: model selection per task, caching, streaming, batching, token accounting.</li><li>Familiarity with at least one major LLM API (Anthropic/OpenAI/Google) at the level of tool-use/function-calling, structured outputs, and streaming.</li></ul>Frontend (working proficiency via AI tooling)<ul><li>React + TypeScript: hooks, state management, rendering/performance pitfalls, and consuming streaming (SSE) APIs in the UI.</li><li>Able to read, debug, and review front-end code and judge data-dense UI behavior &mdash; you'll direct AI tools to build it rather than hand-craft it.</li></ul>Engineering practice<ul><li>Test strategy: unit/integration/contract tests, testing async and DB code, fixtures and factories, deterministic tests around non-deterministic systems.</li><li>Git discipline, small reviewable PRs, and the ability to review AI-generated code critically &mdash; spotting subtly wrong concurrency, security, and edge-case handling that looks plausible.</li><li>Observability instincts: structured logging, tracing, and metrics that make failures diagnosable.</li></ul>Core tasks<ul><li>Design and own the backend services, APIs, and data model.</li><li>Design and enforce the multi-tenant isolation and permission model at the database layer; be primary reviewer for anything touching it.</li><li>Build the retrieval/context-assembly and extraction pipelines and the prompt/eval discipline around them.</li><li>Direct AI coding tools with precise, constraint-rich prompts; review every PR against binary, testable acceptance criteria.</li><li>Own edge cases, failure paths, and the interface contracts other components depend on.</li></ul>RequirementsMust-have<ul><li>8+ years production backend engineering in Python, primarily on PostgreSQL, with FastAPI or an equivalent async framework.</li><li>Demonstrable database-security depth (RLS, multi-tenant isolation, audit patterns) with the ability to defend isolation guarantees under questioning.</li><li>Production LLM/RAG experience with real shipped systems &mdash; context assembly under token budgets, prompt engineering, eval, hallucination control.</li><li>Proven, high-standard code-review ability.</li><li>Working React/TypeScript proficiency.</li></ul>Nice-to-have<ul><li>pgvector / vector databases and ANN tuning.</li><li>Graph/DAG data modeling and traversal algorithms.</li><li>Regulated-domain experience (fintech/legal-tech/healthcare) with strict isolation and auditability.</li><li>Experience working in an AI-pair-programming / AI-assisted build.</li></ul>How we'll screenBoth core competencies are tested directly:<ul><li>Live RLS / isolation review: given a schema and a set of policies, find the path that leaks data across a boundary and fix it.</li><li>Context-assembly design: design retrieval + assembly under a fixed token ceiling, including what to drop and how to degrade.</li><li>AI-code review: critique a plausible-but-subtly-wrong AI-generated PR (concurrency or permission bug).</li></ul>A candidate strong in only one of {database security, LLM systems} is not a fit &mdash; both depths are required.Pay: ₹380,818.56 - ₹2,035,215.20 per yearWork Location: In person

Staff/Principal Full-Stack AI/Software Engineer

Join Astroum AI and explore 1   exciting career opportunities. They're hiring for various roles with options for remote or on-site work. Apply today and become part of their innovative team.

Astroum AI

About Company

Staff/Principal Full-Stack AI/Software Engineer