Full Stack Node.js Engineer-SDLC Setup, Security Hardening & AI-Accelerated Delivery (SaaS Platform)

Full-Stack Node.js Engineer — SDLC Setup, Security Hardening & AI-Accelerated Delivery (SaaS Platform) Type: Fixed-price initial engagement (~2 weeks), with ongoing hourly/retainer work for the right person Timezone: Sydney business hours overlap required (min. 3–4 hrs/day) Start: Immediate About the project We run a multi-tenant B2B SaaS platform (Node.js, currently hosted on GoDaddy Node.js Hosting, moving toward Azure DevOps as the system of record). The product is live with operational customers, so uptime and rollback readiness matter on every release. We need a hands-on engineer who works fast with AI tooling (Claude Code, Cursor, Copilot or similar) and can own the full loop: build → test → release. Phase 1 — SDLC foundation (~1 week) • Recover and baseline the production source into a private Azure Repos Git repository (clean, sanitised, tagged) • Reproducible builds: pinned Node.js version, lockfile-driven install, documented build commands • Branch protection, PR review, build validation and a lightweight work-item workflow in Azure DevOps • Environment separation (dev / preview / production) with secrets kept out of source control • CI/CD pipeline: automated install, lint, test, build, artifact packaging; deploy to GoDaddy preview with smoke checks and approval-gated production promotion • Release runbook: health checks, rollback, deployment evidence Phase 2 — Security & multi-tenant hardening (~1 week) • Audit and remediate server-side tenant scoping across API route families (organisation-level data isolation) • Enforce role, permission and plan restrictions server-side (not in the browser) • Lock down privileged setup/migration/seed operations in production behind proper admin controls • Versioned, source-controlled database migrations with a production-safe migration procedure • Fail-closed error handling, durable rate limiting, persistent file uploads across deployments • Automated security regression tests wired into the pipeline (cross-tenant denial, unauthorised access, migrations) Ongoing (for the right fit) • Rapidly ship new functionality using AI-assisted development — we expect you to use AI tooling to move at 2–3x traditional pace without sacrificing quality • Own release management end-to-end: preview deployments, smoke tests, production approvals, rollback • Build and maintain AI-assisted test coverage (AI-generated unit/integration/regression tests, kept in CI) You must have • Strong Node.js full-stack experience with production multi-tenant SaaS • Azure DevOps: Repos, Pipelines, branch policies, release gates • Demonstrated daily use of AI coding tools (tell us your workflow — which tools, how you verify AI output) • Practical application security experience: tenant isolation, server-side authorisation, secrets management • CI/CD and database migration experience (versioned migrations, rollback-safe releases) • Clear written English; concise daily progress updates Nice to have • GoDaddy Node.js Hosting or similar constrained-host deployment experience • Experience preparing a platform for a later Azure migration • AI-driven test generation frameworks or NLP-based test automation experience How we work • Fixed acceptance criteria per phase — payment on demonstrated, evidenced acceptance • Production releases only with explicit approval and documented rollback • No production credentials or customer data in repos, pipelines or logs — non-negotiable • Daily short written updates; immediate escalation of security or production risks To apply, answer these 1. Describe a multi-tenant isolation issue you’ve fixed — how did you find it and verify the fix? 2. What’s your AI-assisted development workflow, and how do you keep AI-generated code safe and correct? 3. Walk us through a CI/CD pipeline you built in Azure DevOps (or equivalent) with approval-gated production releases. 4. Your Sydney-hours availability and earliest start date. Applications without the four answers won’t be considered.