Security · Reliability · Growth
Company: Kew Reach
Product: Palette; an urban planning tool for biodiversity and resilience gain
Location: UK-based · remote-first or hybrid options available (where remote first, occasional London / team days are required)
Type: Full-time · permanent
Reports to: CEO
Salary: Competitive, dependent on experience
A better future for people and planet, made possible through the power of a thriving and resilient natural world.
Launched in 2024, Kew Reach is a joint venture with the Royal Botanic Gardens Kew, set up to deliver nature-based solutions to restore ecosystems in any setting. We accelerate nature-positive action at scale, grounded in scientific expertise, shaped by creative thinking, and sustained through collaboration. We put the knowledge of more than 500 scientists and a global network of specialists directly into the hands of the professionals shaping the built and natural environment, so they can make defensible, climate-resilient decisions about nature restoration projects of every size, from ecosystem regeneration to urban development.
What We Do
We offer an end-to-end service guided by the Kew Method, spanning baseline assessment, climate-informed design and delivery, species sourcing, long-term monitoring and capacity building, ensuring every project is credible, resilient and delivers measurable nature gain.
This spans three Labs: the City Lab, bringing climate-resilient planting and green infrastructure into city and development environments; the Restoration Lab, turning degraded land into resilient, biodiverse ecosystems; and the Infrastructure Lab, delivering nature-based solutions for major capital projects. Capacity building runs through all three, equipping local teams and institutions to sustain nature-positive action after handover.
Behind all of it: 500+ Kew scientists, 400 collaborating institutes across 100 countries, and 260 years of botanical research.
Introducing Palette Our platform, Palette, brings that same scientific confidence to decisions about planting, biodiversity and habitat. Built around our core climate-resilient tree species-selection tools, we're expanding its capabilities to cover pollinator and habitat analysis, combined biodiversity planning, and tools designed for local-authority use. We build Palette for the people who make and influence these decisions: engineering and environmental consultancies, architecture firms, landscape architecture practices, and the public-sector.
You will be the engineer who owns the health of the platform and its growth: its security posture, its reliability and deployment pipeline, the day-to-day usability of the application, and the new client-facing capabilities we build in the future. As those capabilities grow, you'll mature the platform from a single application into a suite of tools that you manage centrally. You'll work alongside our Senior Data Scientist (who owns the scientific data pipeline and modelling) and the CEO.
This is a founding platform-engineer role: broad, high-ownership, and, for now, the sole engineer on the platform side. You'll turn client needs and our domain expertise into features, not just keep the lights on. It suits someone who wants the autonomy and scope of an early hire and is comfortable being the person the platform depends on.
The immediate priority is honest: the migration to our current AWS architecture was largely AI-assisted. The architecture is sound and well-documented, but there is a known, already-scoped list of hardening, reliability and polish work to reach a confident commercial launch (we maintain a living security checklist and Architecture Decision Records). We need someone who can pick it up, prioritise it, and execute it to a professional standard — and then lead the platform's evolution, shipping the features that deepen what clients can learn about their sites.
- Grow the platform beyond its first study - turning client needs and our scientific domain expertise into features that help users understand their sites (climate, soils, canopy, biodiversity context) and act on that understanding (planting design, species palettes, greening and resilience interventions, outcomes over time).
- Work directly with users and the CEO to shape the roadmap: run lightweight discovery, prototype, ship, measure, iterate.
- Design features that generalise. The platform is built with reserves for multiple Labs and studies (Urban, Infrastructure, Restoration); build so a new capability serves more than one use case where it sensibly can.
- Extend the data and API surface thoughtfully alongside the data engineer — they own the science; you own how it becomes a usable, reliable product experience (geospatial site tools, maps, exports, reporting, integrations).
- Balance new-feature delivery against the hardening and reliability work below; neither should starve the other.
- Take our launch security checklist from "mostly coded" to "verified and deployed” WAF rollout (the construct exists; deploy count-mode first), security response headers including a real CSP, and CloudFront in front of the ALB.
- Harden the authentication and session model (WorkOS / AuthKit): replace our currently long-lived stateless JWT sessions with shorter-lived tokens plus server-side session revocation, tighten cookie flags and redirect URIs, and enable MFA/SSO.
- Drive secret hygiene: complete the git-history secret scan and purge, rotate anything historically exposed, keep everything in AWS Secrets Manager.
- Keep the CI dependency-audit gate green (now blocking) and stay ahead of new advisories.
- Stand up account-level detection (CloudTrail, GuardDuty, AWS Config) as code.
- Support UK data-residency requirements (everything in eu-west-2) and help assemble the evidence pack enterprise/public-sector procurement will ask for (SSL Labs grade, security-headers grade, pentest report, incident-response outline, named security contact).
- Own the AWS infrastructure (defined as CDK - ECS Fargate, RDS PostgreSQL + PostGIS, ALB, Route 53, S3) and keep prod, staging and dev clean and reproducible.
- Improve observability: extend our CloudWatch dashboards and Sentry setup into real alerting on error rate, latency and saturation; define and track SLOs.
- Own the deploy pipeline (GitHub Actions, OIDC-based, migrations-as-a-task) and make releases boring - safe rollouts, tested rollbacks, verified DB migrations.
- Run an RDS restore drill; enable credential rotation safely (fronting the DB with RDS Proxy or equivalent - the app currently reads DB credentials only at container start, so rotation needs care).
- Keep spend right-sized (billing alarms already exist; extend the discipline).
- Improve the end-user experience: performance, accessibility, responsiveness, error states, and the general polish that makes a paid product feel trustworthy.
- Build out the multi-tenant / org-first surface (organisations, roles, seats, tiers) that's currently part-scaffolded.
- Strengthen input validation, error handling and rate limiting across the tRPC API.
- Keep the frontend (React 19 / Tailwind / shadcn) maintainable and consistent.
- Uphold our test discipline - every new backend procedure ships with happy-path and error-path tests; the suite stays green on every commit.
- Keep the architecture documented via ADRs; keep the runbooks current.
- Small, reviewable, conventional-commit PRs; deploy to staging, validate, then prod.
You'd be walking into a platform that is already well past prototype:
- Live product with ~320 species scored across 12 UK regions.
· Stack: React 19 · Tailwind 4 · Wouter · shadcn/ui · Vite (frontend); Express 4 · tRPC 11 · TypeScript · Drizzle ORM (backend); PostgreSQL 16 + PostGIS (RDS in prod, Docker locally).
· Services: WorkOS AuthKit (auth) · Postmark (email) · HubSpot (CRM) · S3 / MinIO (object storage) · Google Maps Platform (mapping/geocoding) · SQS (job queue — provisioned, not yet wired).
- Hosting: AWS ECS Fargate in eu-west-2, behind an ALB; CloudFront still to be added.
- Infrastructure as Code: AWS CDK in TypeScript, with reusable constructs for network, database, application, storage, WAF and observability, plus separate dev/staging/prod stacks.
- CI/CD: GitHub Actions with keyless OIDC deploys; staging on merge to main, prod on tag with manual approval; DB migrations run as a one-off Fargate task; a blocking dependency-audit gate.
- Observability: Sentry for errors; CloudWatch dashboards for request/error rate, p95 latency and utilisation.
- Quality: ~380 tests across ~39 suites and a genuine "untested code doesn't merge" culture.
- Documentation: working-conventions doc, phased build plan, seven ADRs, a living launch security checklist, and deployment/bootstrap runbooks.
Known open work (a realistic first-quarter backlog, already scoped): deploy the WAF; add CloudFront; finish security headers / CSP; harden sessions; purge and rotate historical secrets; enable CloudTrail/GuardDuty/Config; verify RDS encryption-at-rest and enable rotation safely; run a restore drill; and commission a pre-launch penetration test.
- Strong TypeScript across the stack (Node.js backends and a modern React frontend).
- Solid AWS experience and comfort with infrastructure as code (CDK ideally; Terraform/Pulumi transfers).
- Demonstrable application and cloud security know-how: OWASP fundamentals, auth/session design, secret management, TLS/headers/CSP, WAF, least-privilege IAM.
- Experience running production web services: CI/CD, containers (ECS/Docker), observability, incident handling, safe database migrations.
- Relational databases (PostgreSQL) and an ORM (Drizzle/Prisma/TypeORM).
- A test-first instinct and a bias toward small, reviewable changes.
- Product sense — a track record of building and shipping user-facing features, not just infrastructure: understanding a need, designing a solution, iterating with real users.
- tRPC, Drizzle, WorkOS (or similar identity platforms — Auth0/Clerk/Cognito).
- PostGIS / geospatial data.
- Multi-tenant SaaS (orgs, roles, seats, tiers, billing).
- Selling into UK public sector / enterprise — data residency, security questionnaires, pentest evidence packs.
- Frontend accessibility and performance (Core Web Vitals, WCAG).
- Interactive maps / geospatial UX (Google Maps Platform; also Leaflet, Mapbox, deck.gl or similar).
- A genuine interest in the domain — trees, urban greening, biodiversity, climate resilience.
This is not a data-science or modelling role - the scientific data pipeline, species envelopes and suitability methodology are owned by our data engineer. You'll integrate with that work and turn it into product, but you won't be building the models yourself. Your focus is the platform and its product: security, stability, usability, and the new capabilities we grow on top.
