Senior Backend Engineer (TypeScript / Nest.js / AWS)

Vecten; Warszawa; Hybrid; PLN 180,000 - 300,000; Full time

Job summary

Vecten is seeking an experienced backend engineer to design and build a Nest.js-based gateway in AWS, connecting a multi-tenant claims platform to external policy systems. You will work in a small pod with client engineers to map policies, implement secure webhooks, and ensure data isolation.

You will drive canonical data modeling, observability, and onboarding for rapid partner integration while navigating a fast-moving, production-focused environment.

Qualifications

• 5+ years backend engineering with TypeScript in production.
• Experience with Nest.js or a DI-based Node framework.
• Experience building integration services or API gateways.
• PostgreSQL and relational data modelling.
• Experience with multi-tenant systems and data isolation.
• Hands-on AWS (ECS/EKS or Lambda, SQS, S3, IAM, Secrets Manager or Vault).
• AI-native tools as part of delivering (e.g., Claude Code, Codex).
• Self-directed with ability to scope ambiguous requests and deliver independently.
• Fluent English and proactive communication across time zones.

Responsibilities

• Design and build the gateway service on the client's Nest.js-based internal framework and AWS.
• Implement the webhook contract: HMAC authentication, Vault secrets, IP allowlisting, ISO-8601 dates.
• Build the tenant router and registry with composite resolution and failure handling.
• Create the source adapter framework with per-source auth, timeouts, retries, and circuit breaking.
• Establish batch paths: SFTP landing zones, file validation, and data loads to PostgreSQL.
• Define the canonical policy model and mapping tables; review with client experts.
• Deliver per-tenant observability (logs, metrics, Grafana dashboards) and onboarding runbooks.
• Write isolation tests and run drills; support security review.
• Collaborate with client engineers across time zones; some PT availability may be required.

Skills

TypeScript

Nest.js

Backend engineering

AWS

PostgreSQL

Multi-tenant systems

API gateways / integration services

Terraform

OpenTelemetry

Grafana

Vault

Tools

Terraform

Grafana

OpenTelemetry

Vault

Job description

Full-time B2B | Remote EU / Poland | US Insurance Context | Start October 2026

We are an AI-native data and technology partner for private capital and healthcare. Founded in 2010 and headquartered in Warsaw, we work with leading PE firms, VC funds, and healthcare organizations to build proprietary data infrastructure, deploy AI solutions, and drive AI-native transformation.

Our clients manage a cumulative $1.2T+ in assets. Our average engagement runs five years. Our NPS sits above 80. We don't need to claim credibility - we can show it.

We've also done to ourselves what we now do for clients. We've restructured our own company around AI - tools, policies, roles, delivery models. This isn't a pitch. It's a playbook we've already run, and we're hiring the engineers who will run it for others.

The Opportunity

Our client is a US insurance carrier building a platform business on top of its own paper: a set of operational services it offers to the specialist insurers (MGAs) it underwrites for. The first service is claims - the carrier is becoming the claims administrator for its partners, running their claims in a shared instance of a modern claims platform. That platform only knows how to talk to one policy system, and every partner has their own. The missing piece is a multi-tenant policy gateway, and it is the blocking dependency for the first partner's go-live at the start of 2027.

You'll be the engineer who builds it. You’ll work in a small pod with our tech lead and directly with the client's staff engineer, engineering manager and claims domain expert, in their codebase and on their AWS. We already run the data platform for the client's first partner, so you join a team that knows both ends of the integration. The environment is fast-moving and the spec is a PRD, not a design - we're expected to propose, decide and deliver, not wait for tickets.

What you'll be doing

The core of the work is a greenfield Nest.js / TypeScript service that sits between the claims platform and N external policy systems: it authenticates the incoming webhook, resolves which tenant a request belongs to, fetches the policy (live API call or from a policy store fed by daily file extracts), maps it through a canonical policy model and returns it in the claims platform's schema - with hard data isolation between tenants, because a misrouted policy is a cross-tenant data leak. Around that core you'll define the canonical model, drive the first partner's field-mapping through business review, build the observability and the onboarding runbook that turns tenant #2 into a configuration exercise, and take the whole thing through security review and launch readiness. Expect to spend real time reading the client's existing single-tenant precedent and their internal framework conventions before you write your own.

Your Responsibilities

• Design and build the gateway service on the client's Nest.js-based internal framework and AWS, proposing infrastructure changes as Terraform PRs for their DevOps team to apply
• Implement the webhook contract: HMAC authentication in application code with secrets in Vault, IP allowlisting, ISO-8601 date handling, policy-version-at-date-of-loss selection
• Build the tenant router and registry with composite resolution and well-defined failure behaviour
• Build the source adapter framework - a common interface with per-source auth, timeouts, retries with backoff and circuit breaking so one slow tenant source cannot degrade the webhook for others
• Build the batch path: SFTP landing zones per tenant, file validation and quarantine, idempotent loads into a PostgreSQL policy store with snapshot retention and freshness monitoring
• Define the canonical policy model and the shared canonical-to-target mapper; take the first partner's mapping tables (coverage codes, deductible types, roles) through review with the client's claims expert
• Ship per-tenant observability (structured logs, metrics, Grafana dashboard, freshness and error-rate alerts) and an onboarding runbook
• Write isolation negative tests as a release gate, run failure-mode drills and end-to-end walkthroughs in the client's sandbox, and support their security review
• Collaborate directly with client engineers and domain experts across time zones, largely async. Some availability in PT timezone would be required - not more than once a week.

• 5+ years backend engineering with strong, recent TypeScript in production; Nest.js or a comparable DI-based Node framework
• Experience building integration services or API gateways: webhooks, signature-based auth, retries, idempotency, circuit breakers, third-party API adapters
• PostgreSQL and relational data modelling; comfortable designing schemas and writing migrations
• Experience with multi-tenant systems or another domain where data isolation is a hard requirement, and the instinct to test it explicitly
• Hands-on AWS (ECS/EKS or Lambda, SQS, S3, IAM, Secrets Manager or Vault); able to read and propose Terraform even if someone else applies it
• AI-native way of working: you use tools like Claude Code and Codex as a core part of how you deliver, and you still read every line that ships
• Self-directed: able to scope ambiguous requests, write a short design note, ask the client the right question early, and deliver without heavy oversight
• Fluent English and clear, proactive communication with technical and non-technical stakeholders
  

Nice to Have

• Insurance domain exposure - policy administration systems, claims, FNOL, coverages and deductibles, MGA/carrier structures
• Batch or file-based integrations (SFTP ingestion, schema validation, quarantine patterns) or data-mapping heavy work
• Regulated-data experience: PII/PHI handling, HIPAA or SOC 2 controls, audit logging
• Grafana / OpenTelemetry-style observability
• Prior consulting or client-facing delivery

• Unrestricted AI Stack & Premium Gear: Fully paid licenses for Cursor, Claude Pro, etc.

• Total Autonomy (Remote-First): No filler meetings, no Jira bloat, no micromanagement. You own the workflow. We care about shipped systems in production, not logged hours.
• Direct Impact: You'll work face-to-face with our CEO, CTO & VPs and directly with client leadership.
• Frontier Engineering Culture: Build alongside elite engineers who are shipping systems that drive real business decisions. Backed by continuous growth and a strong knowledge-sharing culture (check our YouTube).