Senior Full Stack Engineer

This role is suitable for a Senior Full Stack Engineer with 3+ years of deep expertise in JavaScript, particularly React.js, Node.js, and TypeScript, with Go, DevOps, developer tools, or open-source experience being advantageous.

The candidate should be familiar with designing, building, optimizing, and maintaining secure, scalable platform features, as well as working across secrets management, PKI, PAM, KMS, cloud integrations, and AI-enabled security infrastructure.

They should be comfortable communicating directly with enterprise customers, making decisions under uncertainty, moving quickly in a startup environment, and collaborating effectively while working US hours from an eligible region.

How would you design a secure secrets-management API using Node.js and TypeScript?

I would define strict TypeScript models, validate all inputs at the API boundary, enforce authentication and authorization, and encrypt secrets both at rest and in transit. I would also implement audit logging, rate limiting, careful error handling, and avoid exposing secret values in logs or responses.

How would you structure a React application for managing secrets, projects, and environments?

I would separate reusable UI components from feature-specific modules and use typed API clients with predictable server-state management. Access controls, loading states, validation, error handling, and prevention of accidental secret disclosure would be treated as first-class concerns.

What strategies would you use to implement reliable secret rotation?

I would model rotation as an idempotent workflow with explicit states, retries, deadlines, and audit events. The system should create and validate the replacement credential before revoking the old one, while supporting rollback or overlap periods when the target provider allows it.

How would you design a dynamic secrets integration for databases or cloud services?

I would use short-lived credentials generated through a provider-specific adapter, with scoped permissions and configurable TTLs. The service would securely revoke or expire credentials, handle provider failures, and expose clear lifecycle and audit information to users.

How would you secure and scale a Node.js service that handles billions of secrets?

I would keep application instances stateless, use horizontal scaling, and isolate cryptographic and storage concerns behind well-defined services. Caching would only be used with strict controls, while database indexing, connection pooling, queue-based background work, observability, and key-management practices would support reliability without weakening security.

What are the main challenges in implementing PKI features such as certificate issuance and renewal?

Important concerns include secure private-key handling, certificate authority hierarchy, policy enforcement, renewal timing, revocation, and preventing unauthorized issuance. I would make issuance workflows auditable and automate renewal with idempotent jobs and strong protection for CA keys.

How would you approach implementing an EST or KMIP protocol integration?

I would begin by following the relevant protocol specifications and building conformance-focused tests for encoding, authentication, error responses, and lifecycle operations. The implementation should isolate protocol handling from the underlying key and certificate services, with strict validation and comprehensive interoperability testing.

When would you choose Go over Node.js for a security infrastructure component?

Go can be a strong choice for high-concurrency services, agents, command-line tools, or components that benefit from a small static binary and predictable runtime behavior. Node.js remains effective for API and product development, so I would choose based on operational requirements, ecosystem support, and team maintainability.

How would you safely add AI capabilities to a secrets-management platform?

I would prevent raw secret values from being sent to models unless there is an explicit, strongly controlled requirement, and would apply redaction, least-privilege access, tenant isolation, and audit logging. AI features should initially focus on metadata, policy analysis, anomaly detection, or guided workflows with human confirmation for sensitive actions.

How would you investigate and resolve a security issue reported by an enterprise customer?

I would first reproduce and contain the issue, determine its scope and impact, and communicate clearly with the customer while preserving evidence. I would then implement a narrowly scoped fix, add regression and security tests, review the change with peers, and document remediation and follow-up actions.

Infisical is an open-source security infrastructure company building secrets management, certificates, and privileged access management for the AI era. As a Senior Full Stack Engineer, you’ll develop platform features, expand Infisical PKI, PAM, and KMS, work directly with enterprise customers, and explore AI applications in security. The role uses React, Node.js, and TypeScript, with Go and DevOps experience welcomed, and is primarily remote across the Americas, UK, EU, India, and Brazil while working US hours. Apply for competitive salary, equity options, a work setup budget, and the opportunity to shape critical security products alongside an exceptional engineering team.