Overview

Seclodian develops secure, reliable, and user-friendly technology products.

Responsibilities

• Data models for frameworks, controls, tests and evidence, so one control can map across SOC 2, ISO 27001 and DPDP without duplicate work.
• Auditor and auditee workflows: engagements, control assignment, evidence upload and review, remediation, and report approval.
• PostgreSQL schemas, migrations and queries for multi-tenant data, where one customer must never see another customer’s data.
• Secure Go APIs (chi, pgx) with authentication and role-based access for auditors, auditees and admins.
• Fast, accessible Next.js and React screens (Tailwind, shadcn/ui) built from our Figma designs.
• Audit trails that record who did what and when, in a form an auditor will accept.
• One product shipped three ways: an on-prem binary on the client’s own server, Docker, and serverless on AWS.
• Work with our AI document-intelligence service, which reads policies and evidence and suggests answers with citations, while people stay in control of what gets accepted.
• Tests, code reviews, production fixes and better monitoring.
• With the founders and compliance experts, turning framework language into clear product behaviour.
• 2+ years of professional software engineering, building and shipping full-stack products.
• Hands-on compliance experience, in at least one of these ways:
• You built features for a compliance, GRC, audit, privacy or regtech product, or
• You worked as an engineer through a SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR or DPDP audit or assessment, producing evidence, fixing findings or putting controls in place.
• Working knowledge of at least one of those frameworks. You know what a control is, what counts as evidence and why auditors ask for it.
• Production backend experience in Go. Strong engineers from Java, C# or TypeScript/Node are welcome if they’re ready to go deep on Go quickly.
• Professional frontend experience with React and Next.js in TypeScript.
• Strong PostgreSQL: schema design, indexes, transactions, constraints and migrations.
• You’ve built authentication, authorization and input validation, and you know the OWASP Top 10.
• You write automated tests and can debug problems you didn’t create.

Nice to have

• Experience in other regulated domains: fintech, healthtech, insurance.
• Privacy features you’ve built: consent capture, data retention and deletion, or data subject requests under GDPR or DPDP.
• Multi-tenant SaaS, audit logging, or append-only or tamper-evident records.
• Integrations that pull evidence automatically from tools like AWS, Google Workspace, GitHub or Jira.
• Docker, AWS, Terraform, CI/CD.
• Background jobs and queues (Redis, SQS), structured logging, metrics and tracing.
• LLM or RAG systems in production.
• A certification or coursework in ISO 27001, CISA, CISSP or similar (not required).
• Shape the core product and architecture as one of the first engineers.
• Work directly with the founders on product and engineering decisions.
• Work on a problem that’s growing fast in India as DPDP Act obligations come into force.