Team Lead

Team Lead
TypeScript Full Stack Development Architecture and DevOps
About the role
AuditSense is seeking a hands-on Technical Team Lead to own technical architecture, full-stack development, and deployment delivery across Subscription Management, the AuditSense application, and AskAthena, our AI analysis product.
You will guide the technical team, contribute production code, review designs and pull requests, and translate business requirements into scalable, maintainable software. Your scope includes our existing cloud deployments and the development of deployment capabilities for customer on-premises infrastructure and private-cloud environments. You will also own the technical design of subscription and licensing controls across these deployment models.
Technology environment

• Frontend: TypeScript, React, Vite, TanStack Router, and API integration.
• Backend: Node.js, TypeScript, Hono, Express, REST APIs, Zod validation, webhooks, and background processing.
• Databases: PostgreSQL, Prisma ORM, master and tenant database architecture, and SQLite for AI analysis sessions.
• DevOps: Docker, Docker Compose, Linux, nginx, GitHub Actions, Azure Pipelines, and Azure VMs.
• Azure infrastructure: VM provisioning and sizing, virtual networks and subnets, network security groups, managed identities, Key Vault, storage, DNS, load balancing, and monitoring.
• AI and supporting services: Vercel AI SDK, LLM provider integrations, DBOS workflows, Redis, ChromaDB, and document processing.

Deployment capabilities to develop further include hardened customer installation packages, Kubernetes and Helm where appropriate, offline installation bundles, and infrastructure as code using Terraform, Bicep, or Pulumi.
Key responsibilities
Full stack development and architecture

• Lead the design and implementation of React frontends and TypeScript APIs using Hono and Express. Maintain clear API contracts, reusable components, and consistent validation and error handling.
• Define module boundaries and service integration patterns across the three products. Evaluate technical options and recommend improvements that support product growth and maintainability.
• Architect PostgreSQL databases and Prisma schemas, including relationships, constraints, transactions, indexes, generated clients, and migrations. Manage master and tenant database designs, connection pooling, and query performance.
• Design database connection pooling using PgBouncer or a similar proxy. Select transaction or session pooling to suit application behavior, configure Prisma and driver pools, and size the total connection budget against PostgreSQL max_connections across tenants, replicas, workers, and overlapping deployment slots.
• Plan pooling for database-per-tenant deployments and diagnose pool exhaustion, connection leaks, long-running transactions, and excessive connection churn.

Identity and application security

• Design enterprise Single Sign-On (SSO) using OpenID Connect/OAuth 2.0 and SAML where customer identity providers require it, including tenant-specific identity configuration and user access lifecycle.
• Own JWT and session design, MFA, role-based and attribute-based access control (RBAC/ABAC), tenant isolation, and secure service authentication.
• Apply OWASP Top 10 principles to architecture and code reviews. Establish secure handling of customer data, application secrets, and API credentials.
• Implement HMAC-signed webhooks with payload integrity checks, replay protection, key rotation, and reliable delivery handling.

Deployment architecture and DevOps

• Design and maintain deployment approaches for company-managed cloud environments, customer on-premises installations, and private-cloud infrastructure.
• Provision and manage Azure infrastructure, including VM sizing and lifecycle, disks and storage, virtual networks, subnets, network security groups, DNS, load balancers, managed identities, and Key Vault. Plan capacity, availability, backup, access control, and infrastructure costs.
• Package products for customer installation using hardened containers, Docker Compose, and Kubernetes manifests or Helm charts where appropriate. Provide an offline installation bundle for air-gapped environments, including required images and dependencies, installation checks, and upgrade instructions.
• Create repeatable installation, configuration, upgrade, and rollback procedures. Plan networking, TLS certificates, secrets, persistent storage, environment isolation, and infrastructure requirements.
• Own Git-based CI/CD workflows using GitHub Actions and Azure Pipelines, including automated validation, container builds, artifact versioning, and promotion through development, test, and production environments.
• Move infrastructure provisioning and configuration toward version-controlled infrastructure as code using Terraform, Bicep, or Pulumi, with reusable environment definitions and controlled changes.
• Implement blue-green deployment where suitable, including readiness checks, traffic switching, graceful shutdown, database compatibility, and rollback.
• Implement blue-green, rolling, canary, or controlled in-place deployments according to each environment's capacity and availability requirements. Define readiness checks, traffic switching, graceful shutdown, database compatibility, release validation, and rollback for each approach.
• Plan database and application upgrades across customer installations, including version compatibility, migration tracking, backup and restore, and recovery procedures.
• Establish monitoring, structured logging, actionable alerting, and agreed uptime targets for every environment. Define service-level indicators and objectives, dashboards, escalation procedures, and operational ownership appropriate to each installation.

Subscription management across deployment models

• Architect subscription and licence management for cloud-hosted, on-premises, and private-cloud customers.
• Design installation registration, activation, renewal, expiry, suspension, cancellation, and module entitlement controls, including user limits and usage tracking where applicable.
• Define how customer installations communicate with central subscription services, including authenticated APIs, signed webhooks, retries, synchronization, and reconciliation.
• Design licensing behavior for restricted-connectivity or disconnected installations where required, including signed licence artifacts, renewal processes, agreed grace periods, and auditability.
• Ensure installation identity and tenant identity are handled consistently, and define how subscription changes are enforced across application modules and supported versions.
• Work with business stakeholders to translate commercial licensing policies into clear technical rules and customer support procedures.

Technical leadership and code review

• Lead technical planning, estimation, task allocation, mentoring, and delivery coordination. Communicate dependencies and tradeoffs clearly to stakeholders.
• Review code and architecture for correctness, readability, security, performance, testability, and consistency with project conventions.
• Establish practical development standards, automated checks, testing practices, API documentation, and architecture decision records.
• Provide technical guidance during implementation and production support, and help technical team members strengthen their full-stack and DevOps capabilities.

Required expertise

• Strong hands-on expertise in TypeScript, JavaScript, React, Node.js, Hono, and Express, with the ability to design and troubleshoot complete application flows.
• Strong PostgreSQL and Prisma expertise, including data modelling, schema architecture, migrations, transactions, indexing, tenant isolation, and performance tuning.
• Hands-on database pooling expertise: PgBouncer transaction and session modes or a comparable proxy, Prisma and driver pool settings, PostgreSQL connection-budget sizing, database-per-tenant pooling, and diagnosis of connection exhaustion and leaks.
• Practical DevOps experience with Docker, Docker Compose, Linux, nginx, GitHub Actions, and Azure Pipelines, including blue-green and other deployment strategies.
• Hands-on Azure infrastructure experience provisioning and operating VMs, networking, storage, identity, secrets, monitoring, and backup, with attention to reliability and cost.
• Experience delivering software into customer-managed on-premises or private-cloud environments, including installation, upgrades, configuration, and operational handover.
• Experience with SaaS or enterprise subscription licensing, entitlement enforcement, service integrations, or comparable commercial access-control systems.
• Experience implementing enterprise SSO, JWT and session management, MFA, RBAC/ABAC, secrets management, OWASP Top 10 controls, and HMAC webhook signing.
• Demonstrated ability to lead technical team members, review production code, make architecture decisions, and deliver software through a complete release lifecycle.
• Experience with unit, integration, and end-to-end testing, automated quality checks, observability, and incident troubleshooting.

Preferred experience

• Licensing in restricted-network or offline environments, signed licence files, and synchronization between central services and customer installations.
• Kubernetes and Helm, or another proven approach to packaging and maintaining air-gapped customer installations.
• Infrastructure as code using Terraform, Azure Bicep, or Pulumi, and repeatable customer deployment automation.
• AI application integration, streaming responses, document ingestion, vector search, and LLM usage and cost management.
• Redis, DBOS, ChromaDB, Microsoft Graph, and enterprise audit or approval workflows.

Expected outcomes
Establish a clear architecture and delivery roadmap across the three products; define supported cloud, on-premises, and private-cloud deployment patterns; build a consistent subscription-control model across installations; and lead a team that delivers maintainable features with reliable releases and clear operational ownership.
AuditSense | 1