Sustain GRC is a governance intelligence infrastructure platform for non-financial data. Founded in London in 2022 and endorsed by the UK government as an innovator, we hold risk, internal audit, compliance, resilience, board governance, AI governance and sustainability on a single data model — built as one system rather than assembled through acquisition.
Our customers are mid-to-large enterprises and sovereign entities across EMEA and the GCC, operating under DORA, NIS2, the EU AI Act and equivalent regional supervision. When a regulator or auditor asks them to defend a number, our platform is what makes that number defensible.
The engineering standard follows from that: assurance-grade data, traceable to source, attributable to a person, and able to survive scrutiny years after the fact.
The role You own the engineering function. The services, the architecture, the security model, the production behaviour, and the engineers who build it.
This is hands-on. You write code, you review it, and you raise the standard of a team that is capable but early in its career. Roughly two-thirds engineering, one-third leadership, shifting as the function scales.
It suits someone entrepreneurial — comfortable making decisions without complete information, moving at the pace a platform company at this stage demands, and taking ownership of outcomes rather than tickets. If you need a defined remit handed to you, this will frustrate you.
What you will own Engineering leadership Delivery for the full platform: scope, sequencing, quality, production outcomes A distributed engineering team — hiring, technical direction, code review standards, performance Architectural authority, and the defence of those trade-offs to product, security and the executive team Translating regulatory and customer commitments into engineering constraints before they become rework The practices this stage requires: design review, incident response, on-call, release discipline Backend and platform Scalable backend services in Node.js (Type Script); REST APIs and microservices across the platform End-to-end ownership: design → implementation → deployment → monitoring Architectural risk, edge cases and scalability constraints identified early Clean architecture, SOLID principles, long-term maintainability Security, access control and auditability Authentication and authorisation architecture (JWT, OAuth2, RBAC) Permission models and data access controls for multi-tenant enterprise and sovereign deployments Immutable audit logging and evidence lineage — every action logged, attributable, tamper-evident Data residency and segregation across UK, EU and GCC jurisdictions Control evidence for ISO 27001 and Cyber Essentials Plus surveillance
Data, integrations and performance Postgre SQL schema, query and index design at scale Redis for caching, queues and performance External service integration with reliability and traceability Real-time features where applicable (Socket.io) and S3-compatible object storage
Reliability and platform operations Docker-based containerisation and environment parity CI/CD pipeline ownership (Git Hub Actions or similar) Cloud deployment, GCP-first (GKE, Cloud Run, Cloud SQL, IAM, Cloud Storage); on-premises and VPC patterns for sovereign customers Monitoring, logging, alerting, error tracking Safe deployments, high availability, predictable releases
Required10+ years professional backend engineering, including at least 3 years leading engineers Strong Node.js and Type Script; production experience with Express, Fastify or Nest JSDeep Postgre SQL; hands-on Redis Microservices and distributed systems in production Docker and CI/CD ownership Strong grasp of API security, authentication and RBACDemonstrable ownership of production systems and of the people building them Comfortable making architectural decisions and defending the trade-offs to non-engineers Fluent professional English — you will present to enterprise customers, auditors and partners directly
This role is not suitable for engineers without prior team leadership, or for managers who no longer write code.
Nice to have Enterprise Saa S, compliance, or regulated-industry platforms Exposure to audit, GRC or financial services systems Arabic, in addition to English
What we offer Ownership of infrastructure that enterprises and sovereign entities depend on to satisfy regulators Compensation weighted towards equity — a significant allocation for the right candidate, alongside cash. We are building owners, not staffing a function Fully remote High ownership, low bureaucracy — architectural decisions are made by the people building the system