Senior Software Engineer - C# - (Hybrid Remote)

• Senior Software Engineer -Product & Platform
  Security
• Reliability
• Growth
  an urban planning tool for biodiversity and resilience gain
• remote-first or hybrid options available (where remote first, occasional London / team days are required)
• Type: Full-time
• permanent
  We accelerate nature-positive action at scale, grounded in scientific expertise, shaped by creative thinking, and sustained through collaboration.

We put the knowledge of more than 500 scientists and a global network of specialists directly into the hands of the professionals shaping the built and natural environment, so they can make defensible, climate-resilient decisions about nature restoration projects of every size, from ecosystem regeneration to urban development.

We offer an end-to-end service guided by the Kew Method, spanning baseline assessment, climate-informed design and delivery, species sourcing, long-term monitoring and capacity building, ensuring every project is credible, resilient and delivers measurable nature gain.
and the Infrastructure Lab, delivering nature-based solutions for major capital projects.

Capacity building runs through all three, equipping local teams and institutions to sustain nature-positive action after handover.

Introducing Palette Our platform, Palette, brings that same scientific confidence to decisions about planting, biodiversity and habitat.

Built around our core climate-resilient tree species-selection tools, we're expanding its capabilities to cover pollinator and habitat analysis, combined biodiversity planning, and tools designed for local-authority use.

You will be the engineer who owns the health of the platform and its growth: its security posture, its reliability and deployment pipeline, the day-to-day usability of the application, and the new client-facing capabilities we build in the future.

You'll work alongside our Senior Data Scientist (who owns the scientific data pipeline and modelling) and the CEO.

This is a founding platform-engineer role: broad, high-ownership, and, for now, the sole engineer on the platform side.

The immediate priority is honest: the migration to our current AWS architecture was largely AI-assisted.

The architecture is sound and well-documented, but there is a known, already-scoped list of hardening, reliability and polish work to reach a confident commercial launch (we maintain a living security checklist and Architecture Decision Records).

We need someone who can pick it up, prioritise it, and execute it to a professional standard — and then lead the platform's evolution, shipping the features that deepen what clients can learn about their sites.

Grow the platform beyond its first study - turning client needs and our scientific domain expertise into features that help users understand their sites (climate, soils, canopy, biodiversity context) and act on that understanding (planting design, species palettes, greening and resilience interventions, outcomes over time).

• Work directly with users and the CEO to shape the roadmap: run lightweight discovery, prototype, ship, measure, iterate.
• Extend the data and API surface thoughtfully alongside the data engineer — they own the science; Harden the authentication and session model (Work OS / Auth Kit): replace our currently long-lived stateless JWT sessions with shorter-lived tokens plus server-side session revocation , tighten cookie flags and redirect URIs, and enable MFA/SSO.
• Drive secret hygiene : complete the git-history secret scan and purge, rotate anything historically exposed, keep everything in AWS Secrets Manager.
• Stand up account-level detection (Cloud Trail, Guard Duty, AWS Config) as code.
• Support UK data-residency requirements (everything in eu-west-2) and help assemble the evidence pack enterprise/public-sector procurement will ask for (SSL Labs grade, security-headers grade, pentest report, incident-response outline, named security contact).

Own the AWS infrastructure (defined as CDK - ECS Fargate, RDS Postgre SQL + Post GIS, ALB, Route 53, S3) and keep prod, staging and dev clean and reproducible.

• Own the deploy pipeline (Git Hub Actions, OIDC-based, migrations-as-a-task) and make releases boring - safe rollouts, tested rollbacks, verified DB migrations.
• enable credential rotation safely (fronting the DB with RDS Proxy or equivalent - the app currently reads DB credentials only at container start, so rotation needs care).
• Keep spend right-sized (billing alarms already exist; Usability & frontend quality
• Improve the end-user experience : performance, accessibility, responsiveness, error states, and the general polish that makes a paid product feel trustworthy.
• Keep the frontend (React 19 / Tailwind / shadcn) maintainable and consistent.

Uphold our test discipline - every new backend procedure ships with happy-path and error-path tests; Keep the architecture documented via ADRs ; React 19

• Tailwind 4
• Wouter
• shadcn/ui
• Vite (frontend); Express 4
• Type Script
• Drizzle ORM (backend); Postgre SQL 16 + Post GIS (RDS in prod, Docker locally).
• Services: Work OS Auth Kit (auth)
• Postmark (email)
• Hub Spot (CRM)
• S3 / Min IO (object storage)
• Google Maps Platform (mapping/geocoding)
• SQS (job queue — provisioned, not yet wired).
• Hosting: AWS ECS Fargate in eu-west-2, behind an ALB; Infrastructure as

Code: AWS CDK in Type Script, with reusable constructs for network, database, application, storage, WAF and observability, plus separate dev/staging/prod stacks.

• staging on merge to main, prod on tag with manual approval; DB migrations run as a one-off Fargate task; Quality: ~380 tests across ~39 suites and a genuine "untested code doesn't merge" culture.
• Documentation: working-conventions doc, phased build plan, seven ADRs, a living launch security checklist, and deployment/bootstrap runbooks.

Strong Type Script across the stack (Node. js backends and a modern React frontend).

• Solid AWS experience and comfort with infrastructure as code (CDK ideally; Experience running production web services : CI/CD, containers (ECS/Docker), observability, incident handling, safe database migrations.
• Relational databases (Postgre SQL) and an ORM (Drizzle/Prisma/Type ORM).
• Product sense — a track record of building and shipping user-facing features, not just infrastructure: understanding a need, designing a solution, iterating with real users.

Post GIS / geospatial data.

• Multi-tenant Saa S (orgs, roles, seats, tiers, billing).
• Selling into UK public sector / enterprise — data residency, security questionnaires, pentest evidence packs.
• Frontend accessibility and performance (Core Web Vitals, WCAG).
• Interactive maps / geospatial UX ( Google Maps Platform ; also Leaflet, Mapbox, deck.

A genuine interest in the domain — trees, urban greening, biodiversity, climate resilience.

This is not a data-science or modelling role - the scientific data pipeline, species envelopes and suitability methodology are owned by our data engineer.

You'll integrate with that work and turn it into product, but you won't be building the models yourself.