Principal Software Engineer
Avely
Role:Avely is a multi-tenant recruiting platform that handles candidate records, CVs, hiring workflows, email, AI-assisted screening and sourcing, and subscription billing. We’re looking for a hands-on principal engineer to assess the codebase and take ongoing ownership of engineering quality across the frontend, backend and production infrastructure.
The platform was built with extensive AI assistance. You’ll bring independent engineering judgment to the code and its tests, then work with us to fix what you find. You should be comfortable reading a React component, tracing an API request into a Postgres policy, and following the same workflow into a background job or external provider.
What you’ll do
Lead an architecture and code assessment. Trace critical workflows across the UI, API, database and workers. Find duplicated business rules, unclear boundaries and code that is difficult to change safely. Recommend focused improvements and implement the highest-priority fixes.
Verify tenant isolation and access control. Review authentication, roles, Supabase row-level security, privileged database functions and file access together. Use separate test companies and roles to verify that users can access only the records, files and actions they’re entitled to.
Improve backend correctness. Test what happens when requests are retried, jobs stop halfway, or two people act at the same time. Focus on billing webhooks, AI Credits, candidate emails, imports and company deletion, where a failure can create duplicate actions or leave customer data in an inconsistent state.
Raise the frontend engineering bar. Review React component boundaries, state management, request handling and rendering performance. Improve large-list responsiveness, accessibility and behavior when a save fails or a session expires. Validate improvements on representative workflows and devices.
Own release quality and reliability. Improve the checks that protect production releases, including migration compatibility, targeted regression tests and rollback rehearsals. Set measurable targets for latency, errors and background-job delays. Verify that another operator can diagnose an incident and follow the recovery runbook.
Coordinate independent security testing. Prepare a representative staging environment with synthetic data, help scope the assessment, remediate confirmed findings and obtain independent retest evidence for serious issues.
Set standards for AI-assisted development. Establish which changes require human review, what evidence belongs in a pull request, and how critical business rules should be documented and tested.
What we’re looking for
Experience designing, shipping and operating a production multi-tenant SaaS application.
Strong hands-on TypeScript, React and Next.js skills, including the ability to diagnose browser and server behavior.
Deep PostgreSQL experience with schema design, migrations, transactions, indexing, query plans and access policies. Direct experience with Supabase and row-level security is strongly preferred.
A track record of finding authorization and data-integrity defects through code review and hands-on testing.
Experience with background jobs, webhooks and third-party integrations. You can explain how to handle duplicate delivery, partial failure and safe retries.
Practical experience with CI/CD, monitoring, production incident response and recovery.
Clear written judgment. You can describe a defect, its impact and the evidence required to close it in terms engineers and business owners can both use.
Experience with Stripe Billing, Vercel, hiring or HR software, browser extensions, or applications that process sensitive documents is a plus.
What success looks likeYour first milestone is an evidence-backed assessment of a specific release. It should include an architecture map, a prioritized backlog, and reproducible findings with code references and customer impact. For each material finding, identify how it will be fixed and retested. You’ll then lead remediation and put lasting checks in place so the same defects are caught before future releases.
You’ll work directly with the founder and have the authority to challenge design decisions, require stronger evidence, and recommend holding a release when a material risk remains open.