Senior full stack developer - clinical platforms spec-driven ai first

Job Description

Location: Norwich area

Salary: £65-£85k depending on experience

Contract: Permanent, full time

Reports to: Head of Product

About us

We build digital products for NHS primary care. Our platforms are used by GP practices to manage clinical workflows, patient monitoring and recall, and data-driven service improvement. We are a small, fast-moving team that has invested heavily in modern tooling and automation, allowing us to deliver at a pace that would normally require a much larger engineering function - and we are now hiring the senior engineer who will own that codebase and that delivery pipeline.

This is a genuine ownership role. You will be the technical anchor for our products, with the autonomy to set engineering standards and the responsibility that comes with software used in live clinical settings.

The role

You will take end-to-end ownership of our product codebases, with three priorities:

1. Own and harden Nexus (core priority). Nexus is our clinical platform for GP practices, built on Node, React, TypeScript and Postgres. The codebase has been produced at pace through a highly automated, spec-driven development pipeline. Your first job is to bring senior engineering judgement to it: review, refactor where needed, establish test coverage, CI/CD, release discipline and documentation, and take it confidently into production operation and ongoing feature delivery.

2. Deliver the Nexus Chrome extension. A browser extension that brings Nexus functionality into the clinician's existing workflow. You will take this from its current state to a released, maintained product.

3. Build our mobile capability. Mobile apps are on our roadmap rather than in production today. You will shape the technical approach (we expect a cross-platform framework such as React Native or similar, leveraging the existing TypeScript stack) and lead delivery when we commit.

How we work - and why this role is different

We run a spec-driven, automation-first development pipeline: structured specifications, modern code generation tooling, and rigorous review gates. The pipeline produces volume; senior engineering judgement produces quality. This role is the judgement.

In practice that means:

• You set the architecture, standards and review gates that all generated and accelerated output must pass before it ships
• You write the specifications and guardrails that make the pipeline produce production-grade code
• You handle the work that genuinely needs a senior human: system design, security, data governance, performance, integration with NHS systems, and the judgement calls
• You ship at a multiple of the pace a traditional solo developer could, because the tooling does the volume and you do the thinking

If you instinctively distrust generated code, good - that scepticism is the job. We want someone who treats pipeline output the way a strong tech lead treats a junior team's output: useful, fast, and never merged unreviewed.

Speed never comes at the cost of rigour. The pipeline operates inside a layered, automated assurance framework: continuous dependency and package maintenance, automated security scanning and vulnerability detection across both the application and database layers, posture and configuration checks, and enforced review gates before anything reaches production. Nothing ships on trust - and you will own, tune and extend that framework as the accountable engineer on top of it.

What you'll be responsible for

• Full ownership of the Nexus codebase and our clinical data benchmarking platform: architecture, code quality, testing, releases and incident response
• Operationalising rapidly developed components: auditing, refactoring, documenting and bringing them to production standard
• Designing and maintaining CI/CD, environments, monitoring and backup/recovery
• Owning and extending our automated assurance tooling: dependency and package maintenance, security and vulnerability scanning across application and database layers, and configuration posture checks
• Embedding security throughout the stack: secure coding practices, threat awareness, dependency and supply-chain hygiene, secrets management, and working with our information governance leads to meet NHS security obligations (DSPT, UK GDPR)
• Owning system performance: profiling, query and database optimisation, load and scalability planning, and keeping the platforms responsive as usage grows
• Data architecture and governance on Supabase/Postgres, including separation of patient-identifiable data from reporting layers
• Delivering the Nexus Chrome extension to release
• Defining and later delivering our mobile app approach
• Continuously improving the development pipeline itself: better specifications, better guardrails, better throughput
• Working with our clinical safety, information governance and product leads to meet NHS obligations (DSPT, UK GDPR, clinical safety standards)

What we're looking for

Essential:

• Strong commercial experience as a full stack developer with TypeScript, Node.js and React
• Solid relational database skills (PostgreSQL)
• A track record of taking ownership of a production system: you have been the person responsible when it broke
• Demonstrable experience using next-generation developer tooling and code generation workflows as a force multiplier in real delivery - with clear, critical views on where they help and where they fail
• Strong testing and code review discipline; you can take an unfamiliar codebase and make it trustworthy
• A security-conscious mindset: you write code with threats, data protection and supply-chain risk in mind by default, not as an afterthought
• Sound grasp of performance fundamentals: you can find and fix slow queries, profile a bottleneck, and reason about how a system behaves under load
• Comfortable working with high autonomy in a small team

Highly desirable:

• Experience building Chrome/browser extensions
• Mobile development experience (React Native, Flutter or native)
• Experience in healthcare, NHS or another regulated/safety-relevant domain (DSPT, UK GDPR, IG, clinical safety standards such as DCB0129/0160)
• Experience with NHS data standards and integrations (SNOMED CT, GP system APIs, ODS)
• DevOps/infrastructure experience (CI/CD pipelines, monitoring, cloud hosting)
• Deeper specialism in application/cloud security (secure architecture, penetration testing awareness, OWASP) or in performance engineering at scale

You do not need every desirable item. If you are a strong TypeScript engineer with production ownership experience and real fluency with modern code generation tooling, we want to hear from you - the domain knowledge can be learned.

What we offer

• £65 - £85k per anum
• The rare combination of small-company autonomy with NHS-scale impact: your code runs in real GP practices
• A leading-edge development environment with the budget and mandate to use the best tooling available
• A defined path to technical leadership as the engineering function grows

How to apply

Send your CV and a short note to dustyn@primarycareit.co.uk. Instead of a generic cover letter, we'd rather you answered one question in a few paragraphs: "Describe a time you inherited a codebase you didn't write. What did you do in the first month?"

We are an equal opportunities employer and welcome applications from all backgrounds.

Note for applicants: this role involves systems that process NHS patient data. The successful candidate will be subject to DBS check and will be expected to complete information governance training.