Sr./Staff JavaScript Developer - Web SDK

This role is suitable for a Senior or Staff-level JavaScript/TypeScript engineer with 8+ years of web development experience, including at least 3 years building and maintaining Web SDKs or data-collection libraries.

The candidate should be skilled in browser APIs, cross-browser compatibility, performance optimization, REST APIs, Git, Webpack/Babel/Rollup, CI/CD, and security practices such as privacy protection, encryption, hashing, and obfuscation.

They should be familiar with designing SDKs for device fingerprinting, behavioral analytics, gestures and interaction tracking, fraud or risk detection, automated browser testing, code reviews, technical leadership, and mentoring junior developers.

How would you design a Web SDK architecture for device fingerprinting and behavioral analytics?

I would use a modular, privacy-aware architecture with separate collectors, normalization, fingerprinting, telemetry, and transport layers. The SDK should expose a small stable public API while isolating browser-specific logic and allowing asynchronous, non-blocking data collection.

Which browser signals can be used for device fingerprinting, and how would you make the fingerprint reliable?

Signals may include browser capabilities, screen properties, time zone, language, storage behavior, rendering characteristics, and hardware-related information exposed by the platform. I would normalize values, assign confidence and stability scores, avoid relying on a single signal, and account for privacy protections and changing browser behavior.

How would you collect keyboard, mouse, and gesture behavior without degrading the user experience?

I would register passive, narrowly scoped event listeners, sample or aggregate events, and avoid capturing sensitive content such as actual keystrokes or form values. Data collection should be asynchronous, rate-limited, consent-aware, and disabled or reduced when it affects performance or accessibility.

How would you optimize a JavaScript SDK for minimal bundle size and runtime overhead?

I would use tree-shaking, code splitting, minification, compression, and selective polyfills through a tool such as Rollup or Webpack. At runtime, I would defer noncritical work, cache computed values, batch network requests, and profile CPU, memory, and main-thread usage across representative devices.

How would you ensure cross-browser compatibility for a browser-based SDK?

I would define a supported-browser matrix, detect capabilities rather than relying only on user-agent strings, and provide graceful fallbacks for unavailable APIs. Automated tests would run across major browser engines and mobile environments, with manual validation for privacy-restricted and unusual configurations.

What security measures would you apply when transmitting collected device and behavior data?

I would use HTTPS, strict input validation, authenticated requests, replay protection where appropriate, and short-lived identifiers. Sensitive data should be minimized, hashed or pseudonymized when possible, and protected against tampering without treating obfuscation as a substitute for server-side security.

How would you design the SDK’s REST API integration and failure handling?

The client should use versioned endpoints, compact schemas, request batching, timeouts, retries with exponential backoff, and idempotency where needed. Network failures must fail safely and silently from the user’s perspective, while exposing controlled diagnostics for integrators and observability systems.

How would you build a CI/CD pipeline for a multi-browser Web SDK?

The pipeline should run TypeScript checks, linting, unit tests, integration tests, bundle-size checks, security scanning, and browser automation on every change. Releases should be versioned, reproducible, backward-compatible when possible, and promoted through staged validation with changelogs and rollback capability.

How would you preserve privacy and comply with requirements such as consent and data minimization?

I would collect only signals required for the documented risk use cases, support consent and regional configuration, and avoid collecting raw behavioral content or unnecessary identifiers. The SDK should provide clear controls for disabling categories of collection and enforce retention and deletion policies on the server side.

How would you investigate a production issue where the SDK causes latency or inconsistent fraud signals?

I would correlate SDK version, browser, device, network, and feature-flag data with performance and decisioning metrics, then reproduce the issue using targeted instrumentation and browser tests. I would mitigate quickly through configuration or rollback, identify the root cause, and add regression tests and monitoring before restoring the change.

Oscilar is an AI Risk Decisioning™ company helping banks, fintechs, and digital organizations prevent fraud, manage credit, and strengthen compliance. As a Senior/Staff JavaScript Developer, you’ll lead the design and optimization of a high-performance Web SDK for device fingerprinting, identity verification, and behavioral analytics, while mentoring engineers and driving secure, cross-browser releases. The role is fully remote across Brazil, Canada, the UK, Poland, and India, using JavaScript, TypeScript, browser APIs, REST, Git, Webpack/Babel/Rollup, and modern security practices, with compensation of R$393.8K–R$574.3K plus equity. Apply to shape cutting-edge fraud prevention technology, work with an experienced mission-driven team, and make the internet safer from anywhere.