Senior Go (Golang) + PostgreSQL Backend Engineer – Secure, Auto-Scaling Fintech Platform

We are building a card and wallet platform. It has a Go API backed by PostgreSQL. The auth and admin foundations are already in place: Argon2id, TOTP 2FA, sessions, rate limiting, an append-only audit log, and an admin API with role-based permissions and approval for sensitive changes. We need a senior engineer to take this to production grade. The next parts are wallets, a double-entry ledger, KYC, and card issuance. Security and correctness matter more to us than speed. What you will do Design and build REST APIs in Go, using clean architecture and thin handlers. Design the PostgreSQL schema: normalised tables, constraints, indexes, and partitioning for high-volume tables. Build a double-entry, append-only ledger. Money is stored as integer minor units, with idempotency keys, row locking, and safe retries. Write safe, reversible migrations that work with zero downtime. Build background workers and queues for webhooks, notifications, and reconciliation. Integrate KYC, card-issuing, and payment providers. This includes signature-verified webhooks, retries, and a dead-letter queue. Add logging, metrics, and tracing so we can see problems before users do. Containerise the app and set up CI/CD so it can scale horizontally. Write unit and integration tests, and review the code of the people you work with. Required skills Go 4+ years of production Go: net/http, chi or gin, context, goroutines and channels, graceful shutdown, errgroup. pgx v5 and sqlc, golang-migrate or goose. Testing with table-driven tests, testcontainers, and the race detector (-race). PostgreSQL Transactions and isolation levels, SELECT … FOR UPDATE and SKIP LOCKED, advisory locks. Indexing, EXPLAIN ANALYZE, partial indexes, declarative partitioning, and keyset pagination. Connection pooling (PgBouncer), read replicas, backups with point-in-time recovery, and replication. Row-level security, least-privilege roles, and append-only tables enforced by triggers. Fintech and architecture Idempotency, the outbox pattern, sagas, and reconciliation. Event-driven design, using NATS, Kafka, or Redis Streams. Rate limiting, caching with Redis, and designing for high availability. Security (we will test this in the interview) Authentication and authorisation: Argon2id or bcrypt, OAuth2/OIDC, JWT or opaque sessions, TOTP and WebAuthn, RBAC, and step-up auth. OWASP Top 10 and the OWASP ASVS and API Security Top 10. Encryption: TLS 1.2+, AES-256-GCM field encryption, key rotation, and KMS or Vault for secrets. Input validation, parameterised queries only, SSRF and replay protection, and HMAC webhook verification. Audit logging, with personal and card data kept out of logs. Compliance awareness: PCI DSS (tokenise card data and never store the PAN or CVV), SOC 2, GDPR, AML/KYC, and PSD2/SCA. DevOps and scaling Docker, Kubernetes with Horizontal Pod Autoscaler, Terraform, GitHub Actions. AWS or GCP: managed Postgres (RDS or Cloud SQL), load balancers, WAF, secrets managers. Observability: Prometheus, Grafana, OpenTelemetry, Loki or ELK, Sentry, and alerts. Load testing with k6 or vegeta. Stateless services, health and readiness probes. Security tooling we expect in the pipeline gosec, staticcheck, govulncheck. Trivy for container scanning, Semgrep, and Dependabot. Gitleaks for secret scanning. go test -race and fuzzing. Nice to have Experience with card issuing (Marqeta, Stripe Issuing, Lithic, Galileo) or KYC (Didit, Onfido, Sumsub). Experience with a regulated fintech or banking system. Domain-driven design experience. Experience moving an existing Laravel/PHP app to Go. Deliverables Working, tested code merged through pull requests. Nothing goes in unreviewed. A schema and ER diagram, plus migration scripts that can be reversed. An OpenAPI spec for every endpoint. Runbooks: deployment, rollback, backup restore, and incident response. A short threat-model document for each major feature. Load test results showing the target throughput. Working agreement We work in small pull requests with tests and a written description. No secrets in the repo, ever. You will sign an NDA. We may ask for a security-focused code review before the final payment. You work from our repo and cloud accounts. We keep ownership of all code.