LLM Platform Engineer/Lead (m/f/d)

HELP US CHANGE THE WAY THE WORLD WORKS BUILD SOMETHING THAT MATTERS. Langdock exists to change the way the world works, bridging the gap between what technology can do and what people actually do with it. We bring all leading AI models into one secure, model-agnostic platform and make them usable across entire organizations. Over 10,000 companies use our platform every day, from fast-growing startups to some of Europe's largest enterprises. Their employees open Langdock to draft strategies, analyze documents, or automate workflows - helping them to work smarter, think more creatively, and reach their full potential. ABOUT THE ROLE Platform Engineers at Langdock work on shared backend systems that many product features depend on. This includes the AI engine, queues, document processing, integrations, code execution, authentication, and billing. The job is to make these systems reliable and understandable enough that other engineers can build on them. That means designing clear APIs, choosing the right data models, handling failure cases, writing tests for important invariants, adding useful observability, and keeping abstractions simple enough to maintain. Typical problems include deciding which parts of a long conversation to keep in context, retrying background jobs without running the same side effect twice, handling model-provider failures during streaming responses, refreshing integration tokens before they expire, and enforcing tenant boundaries in shared services. WHAT YOU WILL DO Examples of the kind of systems Platform Engineers own: * The AI engine at the core of the platform. It handles the prompts users send through Langdock and abstracts over providers such as OpenAI, Anthropic, Google, Azure, Bedrock, Mistral, and open-source models. The work includes prompt caching, routing, failover across model deployments, and normalizing provider-specific behavior behind a stable internal interface. * The workflow runtime. Workflows need to execute reliably across agent steps, conditions, loops, structured-output extraction, human-in-the-loop pauses, and actions across hundreds of integrations. The platform work is about making that execution model predictable, observable, and safe to extend. * Context-window optimization. Long conversations, uploaded files, and tool calls need to stay correct while model costs stay under control. This is one of the most cost-sensitive parts of the platform. * A code execution service for running untrusted customer code. Today this means JavaScript in some places, but the direction includes broader execution environments such as Bash. The hard part is clear isolation: secrets, filesystem access, outbound network access, and tenant boundaries need to be controlled explicitly. * A flexible integration layer for connecting Langdock to external services. Most integrations are standard REST APIs, but the platform also needs to support industry standards for tools and agents, including Model Context Protocol (MCP) and agent-to-agent (A2A) communication. You will pick up a platform area over time and can shape where it goes next. TECH STACK * TypeScript across a Turborepo monorepo * Next.js, React, and Tailwind on the front end * Node.js services and workers on the back end * PostgreSQL with Prisma; Redis with BullMQ * A multi-provider model abstraction across OpenAI, Anthropic, Google, Azure, Bedrock, Mistral, and open-source models * Sandboxed Node.js for code execution * Multi-cloud storage abstraction over AWS S3, Azure File Share, and GCS * Terraform for infrastructure orchestration * Kubernetes for workloads that need portable deployment across cloud providers * Linear for ticket management * Datadog and Sentry for observability You should be familiar with most of this. We trust you to pick up the rest quickly. HOW WE SHIP * Small temporary squads of 2 to 3 engineers around a topic. Squads form, ship, and dissolve. * Every change is linked to a Linear ticket and ships via PR. CI runs lint, tests, and AI review. * We deploy continuously to production. * We use AI tools heavily in engineering. You have freedom in the tools to use (eg. Cursor, Claude, Codex). We are building a strong harness that allows engineers to move fast while shipping high quality software. * We are building a strong operating system around AI-assisted shipping: clear ticket context, focused branches, AI review before human review, explicit rollout notes for risky changes, and production verification after release. * The engineer who ships a change owns it in production. If something breaks, you lead the fix. YOU MIGHT BE A FIT IF… * 3 to 6 years of experience building back-end systems that handle real load: queues, caches, databases, streaming pipelines, distributed schedulers. You can talk through failure modes and tradeoffs from systems you have actually run. * Strong in TypeScript and Node. Opinionated about API design, abstractions, and where boundaries should sit. * Some infrastructure experience: Terraform, Kubernetes, cloud deployments, networking, or operating services across AWS, Azure, or GCP. * Very driven. You have high standards for yourself, move fast without needing to be pushed, and want to do the best work of your career. * Working knowledge of the LLM ecosystem at a technical level: context windows, tool calling, streaming protocols, provider quirks, prompt caching. * Habit of adding metrics, traces, and structured logs because you have been on call before and know you will need them. * Security-first mindset. Multi-tenant data isolation is a design constraint, not a postscript. * Heavy user of AI tooling in your own development workflow, with opinions on what works and what does not. We are looking for people who are already compounding their output with AI. * You are a kind person who cares about the people around you. THE ENVIRONMENT We work from our office in Berlin, Greifswalder Strasse 212. Everyone works together in person because the hardest problems get solved faster at a whiteboard than in a Slack thread. Conversations happen faster, problems get solved quicker, and we actually know each other. Days start at 8:30. Lunch & dinner are together. We run, go to the gym, and take care of ourselves. Health is not separate from work here, it is part of how we work well. The vibe is calm but intense. No one is yelling or panicking. But everyone is working hard on things that matter. COMPENSATION Salaries are transparent and tied to levels, not negotiation. All roles include equity. We will figure out the right level together based on your experience and scope. Levels are about the work you own, not your title or years of experience. We narrow down the expected salary range early in the process. NEXT STEPS We move fast. Most processes complete within two weeks. If this sounds like your kind of work, we would like to meet you.

At Upvest, we are on a mission to make investing as easy as spending money. Upvest empowers businesses to offer a wide range of investment products and the best experience in the field of capital market investment and retirement planning. Upvest’s Investment API is easy to integrate so that fintechs and financial institutions can save resources and fully focus on their core business. We are proud to partner with Europe’s leading Fintechs and financial institutions such as DKB, Revolut, N26 and Raisin. Founded in 2017 by Martin Kassing, Upvest now brings together over 270 talented professionals from more than 70 nationalities. Upvest is backed by €280M in total funding from world-class investors, including BlackRock, Tencent, Sapphire Ventures, and Bessemer Venture Partners, Earlybird, Notion Capital, and Motive. Our latest €105M funding round in March 2026 - led by Sapphire and Tencent - serves as a massive catalyst for our growth, allowing us to offer premier investment experience. ABOUT THE ROLE: Upvest is at the inflection point where security needs to scale and remain a foundational discipline of the company. We're hiring a Security Engineering Lead to step into our lean and efficient Security team, set its multi-quarter direction, work cross-functionally and scale Security Engineering into a team that continues to own Upvest's entire application security and cloud security posture in a highly regulated environment as it scales. This role sits alongside our Security Operations and GRC teams, which owns detection, response, and compliance operations. Where SecOps keeps watch over what's happening now, Security Engineering shapes what we build and how we build it, embedding security into the SDLC, hardening our cloud environment, and building the platforms that make security teams more effective. You will own the secure paved roads every Upvest engineer relies on: automated SAST/DAST/SCA in our GitHub Actions pipelines, SSDLC adherence, IAM and network controls, and the technical implementation of DORA's (and other regulations') ICT risk framework for our platform. Our mission for the team is simple: make the secure way the easy way for everyone at Upvest. WHAT YOU’LL DO: * Set the multi-quarter strategy for application and cloud security across Upvest's Investment API platform — aligned with our product roadmap, our tenant commitments, and our regulatory obligations under DORA, MiFID II, and BaFin's MaRisk / BAIT requirements. * Lead, mentor, and grow our Security Engineering and Upvest's security culture. You'll inherit a small, talented team and own hiring, onboarding, growth, and retention as we scale. And you'll create initiatives to build security into the development and product life cycle. * Build paved roads. Own how Upvest performs encryption, authN/authZ, CI/CD, data, and network surfaces. We want fewer security review queues and more security baked into the templates. * Own application security end-to-end. Threat modeling, secure code review, SAST/DAST/SCA tooling integration in our GitHub Actions CI/CD, and vulnerability management. * Drive better cloud security posture across our GCP environment — IAM, VPC Service Controls, Cloud KMS, CSPM (Wiz), Binary Authorization for GKE, Terraform-driven infrastructure security baselines, and our Linkerd service mesh posture. * Mature Upvest's DORA technical implementation. Partner with our risk and compliance functions to translate DORA's ICT risk framework (Art. 5–9), secure development testing requirements (Art. 16), and threat-led penetration testing (Art. 24–27) into engineering work programmes — and into evidence we can show auditors and regulators. * Embed security in every product design. Partner deeply with product and engineering teams. Architecture reviews, design partnerships, security champions across product squads, collaboration beats gatekeeping. * Stay current on emerging threats. AI / LLM security, agentic identities, and the secure use of AI tooling in our own engineering workflow are an active concern * Represent Upvest's security posture clearly to everyone WHAT YOU BRING: * 6–10 years in security engineering, with 4+ years focused on product security or cloud security, and you work well in a regulated environment. You don't need to check every box, but we're asking for evidence that you've taken security from "owned by one team in a queue" to "embedded in how an engineering org ships." * Hands-on, technically credible. You earn the trust of engineers by going deep, so you're comfortable reading code, threat modeling designs, debating architectures, and writing tooling when it's valuable. * Cloud-native security depth. GCP preferred; AWS or Azure transferable. You know IAM, network segmentation, KMS, IaC security (Terraform), and Kubernetes hardening (RBAC, network policies, Pod Security Standards) as a craft. * Product/Application security foundations. OWASP Top 10 / ASVS, secure code review, SAST/DAST/SCA tooling integration, supply-chain security (SLSA, signing). * Lead through influence, not gatekeeping. You drive security outcomes through partnership with engineering teams. You can navigate ambiguity, set direction, and make sound risk-based decisions that scale with the organisation. People want to work with you, because you don't just say "no", you say "yeah, and this is how". * Hire and grow people. You've built or grown a small team. You set a high bar in interviews, invest in onboarding, give real-time feedback, and address performance issues quickly and fairly. Communicate cleanly across audiences e.g. a security incident write-up to engineering, a control narrative to an auditor, and a risk briefing to executives are three different documents, and you can write all three. NICE TO HAVE: * Experience securing multi-tenant B2B platforms or financial-API products: tenant isolation, API-as-product safety boundaries, and the specific operational shape of selling to regulated customers. * Experience with trading, custody, or securities settlement platforms, or curiosity about that domain. * Bug bounty / VDP programme management. * In a past life, you have shipped backend code in production, and you're comfortable in Go (preferred), Python, or another modern backend language. * Regulatory fluency. Working knowledge of DORA, MaRisk, BAIT, ISO 27001. You can change audit-speak or regulation into actionable technical requirements other people understand. You can hold your own with auditors and regulators without losing engineering pragmatism. * Background in engineering and offensive security * German skills are useful for some potential client interactions, but not required. Our working language is English. * Hands-on experience with AI/LLM security, agentic identity, or securing AI tooling in an engineering workflow. * Familiarity with the operational side of security is a bonus, hands-on experience with EDR and SIEM platforms, or a background in incident response. This matters in practice, you'll be part of the security on-call rotation, so being comfortable picking up an active incident is real, not theoretical. HOW WE UPVEST IN YOU: * Best-in-class AI tools: Every Upvenger has €20,000 per year to spend on the best AI tools available — so you're always working with the most powerful models and tooling on the market. * Impact-driven work: We’re building the infrastructure that will power the future of investing in Europe. It’s complex, ambitious, and meaningful. You’ll work with modern technologies and create something entirely new. No legacy systems, no limits. * Wellbeing: Recharge with 30 days of annual leave and maintain a healthy lifestyle with sports benefits. Access confidential professional coaching and enjoy the flexibility to work remotely abroad for up to 183 days a year. Recharge with UpRest, a one-month fully paid sabbatical after every 4 years of working at Upvest. * Development: Growth is in our DNA. Each Upvenger has access to a personal development budget and the freedom to decide how to use it. * Flexible work environment: Work from any of our hubs in Berlin, London or Tallinn hybrid or remotely across Europe, depending on the role. We give you the choice and budget to work where you’re most comfortable and productive, either at home or in the office. You choose. * Compensation and equity: We believe that all Upvengers contribute to our success and deserve a competitive, above-market salary and a participation in our employee equity program. * Team celebrations: Participate in company-wide events, such as UpFest, dinners, offsites and our Holiday party, to connect with colleagues and celebrate our achievements. * Inclusion: We’re committed to a culture where everyone belongs and thrives. Our Employee Resources Groups foster inclusion and connection, like Upfem for our female Upvengers, or UpVergent supporting neurodivergent Upvengers and allies. OUR VALUES: * Make it easy for others. We simplify the complex and act with the best intentions. * Own the outcome. We are proactive, fast and confident to get the job done, valuing progress over perfection. * Rise to the challenge. We aim high and push the boundaries. We stay curious, learn and celebrate our wins together. * Tell the story. We start with the Why to align on purpose. We are transparent and share knowledge to empower and inspire others. Upvest is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.