Intern

ABOUT VALURA.AI

Valura.Ai is a regulated global-investing platform. We let Indian and UAE investors put money to

work outside their home market: US equities and ETFs under LRS through our IFSCA-regulated GIFT

City entity (Valura India IFSC Private Limited), global funds through our marketplace, and curated

thematic baskets built in-house.

Behind that sits a real system: a PNPM/Turborepo monorepo with roughly twenty applications, a

double-entry ledger in Python that books every rupee and dollar across two regulated entities,

broker and payment integrations, a KYC stack, a multi-agent AI microservice, partner-facing portals

and cobranded web apps, and infrastructure spread across AWS ECS and Coolify.

Nine of those applications are Next.js: the customer web app, the admin consoles, the partner

portal, the explore and marketing surfaces. They span App Router on Next 16 and older builds still

on 14, with React Query, Redux Toolkit, Prisma, Tailwind and Radix in the mix, and route handlers

that talk to our own APIs. If you cannot work confidently on both sides of a Next.js app, most of this

codebase is closed to you.

It is a fast-moving fintech codebase. That means it is also, in places, an under-documented and

under-tested one. That is the job.

THE ROLE

The CTO's Office is not a product feature team. You are not here to take a designer's screen off a

backlog and build it. You are here to make the platform legible, tested, clean and safe, and to leave

behind artifacts that outlast you.

You will still write a lot of full-stack Next.js. Auditing a web app means reading its server

components, its route handlers, its data fetching and its auth, not skimming the JSX. Cleaning one up

means moving code across that boundary and proving nothing broke. And the internal tools this seat

produces are Next.js applications you own end to end. Treat "not a feature team" as a statement

about whose backlog you work from, not about how much code you write.

This is one of the highest-leverage seats we offer an early-career engineer, because you will read

everything. Most engineers know one service. In six months you will know how money enters at a

payment gateway, becomes an order at a broker, gets booked in the ledger, and shows up in a

customer's portfolio. Very few people at any fintech can trace that end to end.

1. AUDIT THE CODEBASE

- Run a structured audit across every app and shared package: architecture, security, correctness,

testing, error handling, observability, dependency health and documentation.

- Produce a weighted scorecard per service and an evidence-backed findings register. Every finding

cites a file and a line, states the actual failure it enables, and carries a severity. No vague "code

smells".

- Hunt for the things that actually hurt a regulated business: unauthenticated endpoints, secrets

committed to git, unvalidated webhooks, missing idempotency on money paths, silent exception

swallowing, unsafe defaults in environment config.

- Turn the register into a tiered remediation plan, get it into our tracker, and then chase it. An audit

nobody acts on is a document, not work.

- Re-score each service after remediation so we can see the delta. The scorecard is a tracked metric,

not a one-off.

2. OWN KNOWLEDGE TRANSFER

- Sit with each service owner, understand the service properly, and write it down: what it does, who

calls it, what it calls, the data it owns, the failure modes, and the things you only learn by breaking it.

- Build and maintain the context spine: a per-repo router document plus a file-level documentation

index, so a new joiner (or an AI agent) can orient in an hour instead of a fortnight.

- Write runbooks for the operations we actually perform: deploys, migrations, broker syncs,

reconciliation runs, incident recovery.

- Capture the decisions, not just the code. Short architecture decision records for why we chose a

broker flow, a queue, a schema.

- Run internal walkthrough sessions and record them. Measure yourself on one number: how long it

takes a brand new engineer to make their first safe production change.

3. TESTING AND QUALITY

- Establish what "tested" means here, then get us there: unit tests on business logic, integration tests

on service boundaries, contract tests on broker and payment integrations, and end-to-end tests on

the flows that move money.

- Prioritise by blast radius. The ledger's posting rules, FIFO cost relief, fee handling, FX conversion,

reconciliation checks and order state machines come before a form validator.

- Build the fixtures and harnesses that make tests possible: seeded databases, recorded broker

responses, deterministic clocks. Half our testing gap is not laziness, it is missing scaffolding.

- Write a regression test for every production bug we have already fixed, so it cannot come back.

- Get coverage reporting into CI, make the pipeline honest (green means green), and kill flaky tests

rather than retrying them.

4. CLEAN UP THE CODEBASE

- Delete dead code, unused packages, stale branches, orphaned environment variables and

commented-out experiments. Deletion is a feature.

- Consolidate duplication into shared packages, especially the same logic reimplemented in three

apps.

- Standardise the boring things: linting, formatting, TypeScript strictness, error shapes, logging

structure, folder conventions, naming.

- Upgrade and prune dependencies, and remove the ones nobody imports.

- Do it in small, reviewable, behaviour-preserving pull requests, with tests written before the

refactor. A cleanup PR that changes behaviour is a bug shipped quietly.

5. BUILD THE INTERNAL TOOLS, END TO END

- The findings of an audit are worth more as a tool than as a document. You will build the small

internal Next.js applications that make our own state visible: a service scorecard that re-renders

itself from the register, an operations console for reconciliation breaks, dashboards for job runs and

broker syncs, and the admin surfaces nobody has got round to.

- End to end means end to end. Schema and query, route handler and server action, auth and access

control, the client state, the table that has to stay fast at fifty thousand rows, the deployment. There

is no separate backend engineer waiting to pick up your half.

- Get the boring parts right, because these tools touch real money data: input validation with Zod,

authorisation checked on the server and not in the component, no secrets leaking into client

bundles, no unbounded query behind a page that a browser will happily call in a loop.

- Work inside the monorepo the way it is built. Shared packages over a fourth copy of the same

hook, the existing design system over a private one, and Server Components where they belong

rather than "use client" at the top of every file.

- Ship these the same way as everything else: small pull requests, tests, and a README that lets the

next person run it.

6. BEYOND THE FIVE

- Security and secrets hygiene. Sweep the history for committed credentials, drive rotation, get

secret scanning into CI, review who has access to what, and check that production databases are not

reachable from the open internet.

- CI/CD and developer experience. Fix the chronically red pipelines, tighten branch protection and

required checks, cut build times, and make local setup a single documented command. Time-to-first-

commit for a new engineer is your metric.

- Observability. Make sure every service emits useful logs, that alerts reach a human, that uptime

monitoring covers what it claims to cover, and that we notice failures before a customer does.

- API contracts. Get accurate OpenAPI specs for our internal and partner-facing APIs, generate typed

clients from them, and stop the drift between what the docs promise and what the server returns.

- Data integrity. Work alongside the ledger team on reconciliation: understand why a check fires,

distinguish a real money break from an artifact of how the check is written, and write tests that pin

the difference.

- Cost and performance. Review what we run and what it costs, profile the slow paths, and find the

queries that will fall over at ten times the volume.

- AI-native engineering. We use coding agents seriously. You will use them to audit and refactor at a

scale a single intern could not otherwise reach, build the internal prompts, skills and evaluation

harnesses that make them reliable, and stay clear-eyed about where they confidently get things

wrong.

- Incident support. Shadow production incidents, help build the timeline, and write the postmortem.

Then turn each postmortem into a test or an alert.

- Compliance-facing engineering. A regulated platform has to be able to prove things: audit trails,

access reviews, data retention, change control. Help us keep the evidence in a state where an

auditor's question takes an hour, not a week.

WHAT THE SIX MONTHS LOOK LIKE

- Weeks 1 to 4. Get every service running locally. Map the monorepo. Ship your first documentation

pass and your first ten cleanup pull requests. Deliver the audit of one service end to end, and

present it.

- Weeks 5 to 12. Audit the remaining services in priority order. Stand up the testing scaffolding. Get

coverage reporting and a green pipeline. Publish the tech-debt register with owners and severities,

and ship the first internal Next.js tool that renders it.

- Weeks 13 to 20. Drive remediation of the critical and high findings. Land the runbooks and

architecture decision records. Onboard a new joiner using only your documentation, and fix

everything they stumble on.

- Weeks 21 to 26. Re-audit and re-score. Hand over a maintained system: living docs, a CI that means

something, a test suite people trust, and a debt register the team actually uses.

WHAT YOU WILL WALK AWAY WITH

- A rare, complete mental model of how a cross-border regulated investing platform works, from

payment rail to broker to ledger to screen.

- A public-quality body of evidence: audits, tests, documentation and pull requests with your name

on them.

- Direct exposure to the CTO and the founders, and to how engineering decisions get made in a

regulated business.

- A strong shot at a full-time offer. This seat exists partly as a long-form interview.

WHAT WE ARE LOOKING FOR

Required

- Final-year student or recent graduate in computer science or engineering, or self-taught with

equivalent evidence.

- You can read code you did not write. This is the single most important trait for this role, and it is

rarer than it sounds.

- Full-stack Next.js and React, for real. You have built and shipped something where you owned both

sides: routing, data fetching, server and client components, API or route handlers, a database behind

it, and authentication. Not a tutorial to-do app, and not a frontend where somebody else wrote the

API. This is a hard requirement, not a preference. Expect to be asked, in the technical round, why a

given piece of your code runs on the server rather than the client, and to have an answer.

- Solid TypeScript. You use the type system to prevent bugs rather than to satisfy the compiler, and

"any" is a decision you can justify.

- Working knowledge of Python as well. You do not need to be expert in both languages, but the

ledger is Python and you cannot be a stranger to it.

- Comfortable with git, the command line, SQL and Docker.

- You have written tests before, by choice, not because a professor asked.

- Clear written English. Most of your output this internship is prose, not code.

- Intellectual honesty, and the nerve to say "this is broken" about work done by people more senior

than you, with evidence attached.

Nice to have

- Depth in the stack we actually run: App Router, React Server Components, React Query, Redux

Toolkit, Prisma, Tailwind, Radix or shadcn, NextAuth or a comparable session model.

- Having worked on a Next.js app you did not start, especially a migration between Pages and App

Router or a major-version upgrade. We have both, at both versions.

- Exposure to a monorepo, to CI/CD pipelines, or to cloud infrastructure (AWS, Docker, Terraform).

- Prior work with testing frameworks (Jest, Vitest, pytest, Playwright).

- Some understanding of double-entry accounting, market microstructure, or payments. You will

learn it here either way, but a head start shows.

- Open-source contributions, particularly documentation, tests or refactors rather than only

features.

- Real fluency with AI coding tools, including a sense of their failure modes.

Who this is not for

- Someone who only wants to build new features and finds cleanup beneath them.

- Someone who needs a fully specified ticket before they can start.

- Someone who will hand us a large refactor with no tests and call it done.

- Someone who is a frontend developer only. If your answer to "where does this data come from" is

"the API team", this seat will be uncomfortable for both of us.

- Someone who wants a certificate at the end. We want the artifacts.

HOW WE HIRE

1. Application review, including the screening questions on this posting.

2. Screening call, 30 minutes on your background and what you personally built.

3. Take-home. A real exercise: we hand you an unfamiliar codebase, you find what is wrong with it,

write tests that prove it, and propose the fix. Part of it is a full-stack slice you have to actually build.

Fixed deadline, told up front. We care that it is right and reasoned, not that it is pretty.

4. Technical round. We take your take-home apart with you, then look at code together and ask

what you would change and why. Expect the server/client boundary, data fetching and authorisation

to come up.

5. Final round with the CTO and founders, on judgement, ownership and fit.

We aim to close the process in two to three weeks.

DETAILS

Type: Internship, 6 months, full time. Convertible to a full-time engineering or platform role.

Location: Gandhinagar (GIFT City) / Mumbai, India. Hybrid, with some overlap with our UAE desk.

Reports to: Chief Technology Officer.

Stipend: Paid, calibrated to what you bring.

Valura is an equal opportunity employer. We hire on evidence of ability, and we welcome applicants

from any background.