Senior Full-Stack Engineer — AI Systems

We build connected AI operating systems for retail and ecommerce brands — and we're looking for a contract engineer to build one with us. The current engagement is an AI operating system for a premium Australian fashion brand: a governed foundation (data layer, brand-rules engine, evaluation) with a suite of AI agents on top, running inside the client's own cloud. It's an eight-week sprint at 2–3 days a week, working alongside our embedded lead and the client's internal tech owner. This is a senior, hands-on, security-critical contract. You're not just shipping features — you're building a system that holds a brand's commercial data and creative IP, used by their whole team, where who-can-see-what and what-leaves-the-tenant matter as much as what the tools do. What you'll own: Foundation & data • Stand up the data layer — AlloyDB (Postgres + pgvector) as the operational store and embeddings; Firestore for live state. • Build read-only, least-privilege ingestion from the brand's systems (Shopify, Klaviyo, AP21, TRS, Profit Peak, and a PLM platform) — normalised to one canonical schema, idempotent, kept current. • Build the brand-rules engine: brand and commercial rules as versioned config, enforced by a deterministic policy gate before and after every generation. AI & agents • Integrate and harden the agents (sketch, tech pack, trade pack, image generation, email) on the Anthropic API (Claude) — each reading the rules engine and data layer, gated, writing back to memory. • Build the evaluation and observability layer — score outputs against known-good sets, log and trace every run. • Engineer for token cost — prompt caching, batching, model routing. The application • Build the operating view — dashboard, critical path, alerts — and the admin/access layer (below), as a Next.js + Postgres app. • Version-controlled, staged, feature-flagged, demoed before release. Built so the client can own and run it after hand-over. Security & access — central to this role! You own how the system is secured and who can do what: • Identity & access — Google Workspace SSO and Cloud IAM. Build the admin module where an admin sets who can use the system and which modules each person sees, viewer by default. Access gates navigation, routes and APIs — never just the UI. • Least privilege everywhere — tightly scoped service accounts; read-only connectors; the app as the single front door, preventing shadow IT. • Secrets & perimeter — all credentials in Secret Manager, none in code or repos; VPC Service Controls around the client's project; everything inside the client's own tenant. • Data protection — PII classified and masked at ingestion; deliberate control of what data crosses to the model API (minimise and curate what leaves the tenant); brand IP and commercial data handled with care. • Auditability — Cloud Logging and audit on; every run and every access change logged and traceable. No dark rollouts. • The policy gate as a safety control — the deterministic rules gate enforces brand and commercial rules on every output: governance, not just quality. You should be able to explain this access and data-handling model plainly to a non-technical sponsor — because trust in it is part of what we sell. What you'll need • Senior full-stack experience — TypeScript/React/Next.js and Python (or close equivalent), able to work independently with minimal oversight. • Strong Google Cloud — AlloyDB/Postgres, Cloud Run, Firestore, IAM, Secret Manager, VPC Service Controls, Cloud Logging. • Data engineering — Postgres + pgvector, API ingestion/ETL, canonical schema design. • Building on LLM APIs (Anthropic/Claude or equivalent) — RAG, embeddings, tool use, agent orchestration, evaluation/observability. • Demonstrable security engineering — IAM and RBAC, least-privilege design, secrets management, PII/data protection, audit logging. You design secure-by-default and can reason clearly about an inference/data boundary. Nice to have • Retail / ecommerce / fashion domain • Replit, prompt caching / cost optimisation, DLP tooling. • Experience handing systems over to a client team to run themselves. Who you are • Senior judgement; comfortable owning your workstreams and making architecture calls with the lead. • Self-directed — at 2–3 days a week you manage your own time and deliver against the sprint plan without hand-holding. • Embedded and client-facing — work alongside the client's internal owner, demo your work, document as you go. • Protect scope; ship; trustworthy with sensitive commercial and creative data. Practical • Contract, 2–3 days/week for an eight-week sprint, with scope for ongoing work across future client builds. • Embedded in Tribe Gen AI's pod, working with the lead and the client's internal tech owner.