czay.dev
0/32
Roadmaps

Junior Backend Developer 2026

Junior backend job posts keep piling Kubernetes, Kafka, AWS Architecture, Redis Cluster, and Microservices on top of basic Go or C#. Companies try to dump the entire infrastructure team's workload onto a single junior.

Memorizing 20 buzzwords on the surface won't get you hired; what actually gets you hired is a SINGLE live API project where you can defend your architectural, database, and security choices. Go in order, inspect each topic, and check off what you learn.

  • CoreKnow this well before you apply
  • Nice to haveShows up a lot in job posts, gives you an edge
  • LaterOnce you're on the job, when you need it

Click a topic to see what you need to know and where to learn it.

  1. 01

    Foundations & Web Protocols

    The universal rules and protocols APIs speak. Language-agnostic — the common alphabet of every backend engineer.

  2. 02

    Databases & SQL

    The true beating heart of the backend. UIs and frameworks come and go, but data integrity and relational schemas endure.

  3. 03

    Authentication & Security

    What separates an engineer from a hobby coder. An API that neglects security should never see production.

  4. 04

    Getting Job-Ready & Real Project

    What puts you ahead of thousands of applicants. Not just writing code — packaging, documenting, and deploying it live.

  5. 05

    Things You Can Learn Later

    Topics copy-pasted into junior job posts that are NOT prerequisites for getting hired. You'll learn them on the job as production scale demands.

Topic by topic

Every topic on the map with its description, what to know and resources — in one list.

  1. 01Foundations & Web Protocols

    • HTTP Protocol & REST· Core

      The backend's gateway to the world. A backend engineer who misuses HTTP methods and status codes will constantly clash with frontend teams.

      What you should know

      • HTTP Methods: Semantics of GET, POST, PUT, PATCH, DELETE and idempotency
      • Status Codes: Differences between 200, 201, 204, 400, 401, 403, 404, 409, 422, 500
      • Headers: Content-Type, Authorization, Accept, Cache-Control
      • REST Principles: Statelessness, resource-oriented URL naming, and JSON formatting

      Resources

      • Request Lifecycle· Core

        From the moment a request leaves the browser to the Controller, Service layer, and DB, what hops does it take before returning?

        What you should know

        • Middleware concept: Request validation, logging, global error handling
        • Differences between Query params, Route params, and Request Body
      • Postman / Bruno / cURL· Core

        The daily tool for testing and debugging your endpoints independently without waiting for the frontend.

        Resources

    • One Backend Language· Core

      Stop jumping between languages. Pick one among Go, Node.js (TypeScript), or C# (.NET) for your market and go deep.

      What you should know

      • Grasping the language beyond syntax: memory management, type safety, and the standard library
      • Asynchronous programming: Event loop / Goroutines / Async-Await & Threading
      • File I/O, Streams, and safely loading environment variables (.env)

      Resources

      • Error Handling & Logging· Core

        Building centralized error handling that prevents crashes on unhandled exceptions without polluting code with blind try-catch blocks.

        What you should know

        • Never leaking internal stack traces to end users on 500 errors
        • Structured logging (JSON logs, log levels: INFO, WARN, ERROR)
      • Config & Secrets· Core

        Database credentials and secret keys must never be hardcoded. Reading from .env and guarding via .gitignore.

  2. 02Databases & SQL

    • PostgreSQL & İlişkisel SQL· Core

      Don't fall into the NoSQL/MongoDB trap prematurely; 90% of the industry relies on relational databases. Knowing PostgreSQL will carry you through any backend interview.

      What you should know

      • Core CRUD and filtering: SELECT, INSERT, UPDATE, DELETE, WHERE, GROUP BY, HAVING
      • Table Relationships: One-to-Many, Many-to-Many, Primary Key and Foreign Key constraints
      • JOIN Types: Differences between INNER, LEFT, and FULL JOIN and when to use each
      • ACID Principles: Atomicity, Consistency, Isolation, Durability and Transactions (COMMIT / ROLLBACK)

      Resources

      • Database Indexes (B-Tree)· Core

        Why searching 1M rows takes 3 seconds and how CREATE INDEX drops it to 2ms. Index trade-offs and EXPLAIN queries.

        What you should know

        • Full Table Scan vs Index Scan differences
        • The write performance penalty (INSERT/UPDATE) of indexing every column
      • Transactions & Consistency· Core

        What happens during a money transfer if money leaves Account A but fails to credit Account B? Bundling operations into an atomic unit.

    • ORM & Migrations· Core

      Mapping DB schemas to code. ORMs save time, but engineers who don't inspect generated SQL fall straight into the N+1 trap.

      What you should know

      • Pick one ORM/Query Builder for your stack: Prisma, TypeORM, GORM, EF Core, or Dapper
      • The N+1 Query Problem: Avoiding 101 round-trips when fetching 100 users and their orders
      • Database Migrations: Synchronizing schema modifications across teams and environments

      Resources

      • N+1 Problem & Fixes· Core

        The most frequent performance question in backend interviews. Eager loading, JOINs, and batching mechanisms.

      • When to Write Raw SQL· Nice to have

        Knowing when to drop the ORM and write native SQL for complex aggregations and reports.

  3. 03Authentication & Security

    • Authentication (Auth)· Core

      Who is the user, and do they have permission? The era of plain-text passwords ended twenty years ago.

      What you should know

      • Password Hashing: Salting with bcrypt or Argon2, defending against rainbow table attacks
      • JWT: Header, Payload, Signature structure. Understanding that JWTs are signed, not encrypted
      • Access Token & Refresh Token lifecycle: Secure storage (HttpOnly Cookies vs Headers)
      • Authorization (RBAC): Role-based access control middleware (Admin, User, Editor)

      Resources

      • Session vs JWT· Nice to have

        Trade-offs between stateful sessions (server-side Redis/DB state) and stateless JWTs.

      • OAuth 2.0 Basics· Nice to have

        How 'Sign in with Google or GitHub' works behind the scenes (Authorization Code Flow).

    • Validation & API Defense· Core

      Never trust user input (Zero Trust). You must rigorously validate incoming request payloads against a schema.

      What you should know

      • Request DTOs / Validation: Enforcing strict payload schemas with Zod, Joi, or FluentValidation
      • SQL Injection: Why prepared statements and parameterized queries are mandatory
      • CORS: What actually happens when a frontend calls your API from a different domain?
      • Rate Limiting: Throttling endpoints against brute-force and DDoS bots

      Resources

      • CORS & Preflight Requests· Core

        What is an OPTIONS preflight request, why browsers issue it, and how to configure backend headers correctly.

  4. 04Getting Job-Ready & Real Project

    • Docker Temelleri· Core

      Ending the 'works on my machine' excuse. A junior backend doesn't need Kubernetes, but writing a Dockerfile is non-negotiable.

      What you should know

      • Containers vs Images: What is a Docker image, and how does a container run?
      • Writing a Dockerfile: Producing slim images with multi-stage builds and exposing ports
      • Docker Compose: Spinning up the API service and PostgreSQL DB together with a single `docker compose up`

      Resources

      • Local Dev with Compose· Core

        Spinning up an isolated database container via Docker instead of polluting your host OS.

    • Documentation (Swagger / OpenAPI)· Core

      An undocumented API might as well not exist. Being able to hand a frontend engineer a living Swagger URL or Postman collection.

      Resources

      • API Contracts· Nice to have

        Defining strict request/response contracts upfront to speak the same language with client teams.

    • A Real Live API Project· Core

      Leave todo apps and tutorial clones behind. A SINGLE live API with auth, relational PostgreSQL, Docker packaging, and public deployment gets you hired.

      What you should know

      • Real business logic: Booking, e-commerce checkout flow, ticketing, or billing API
      • At least 4-5 interrelated PostgreSQL tables (User, Product, Order, OrderItem)
      • Live Deployment: A public working endpoint on Render, Railway, Fly.io, or a cloud VPS
      • README: Architecture diagram, environment variable table, local setup instructions, and Swagger link
      • Integration Testing· Nice to have

        Writing automated end-to-end tests against a test database for mission-critical endpoints (Login, Create Order).

      • Defending Your Architecture· Core

        Confidently answering 'Why PostgreSQL?', 'How are passwords stored?', and 'Why did you add an index to this column?'.

  5. 05Things You Can Learn Later

    • Distributed Architecture & Queues· Later

      Splitting an app with 10 users into 10 microservices is a recipe for disaster. Start monolithic; learn microservices when production warrants it.

      • Mikroservisler· Later

        Inter-service communication (gRPC, HTTP), network latency, and distributed consistency. Not a junior's day-one responsibility.

      • Kafka & RabbitMQ· Later

        Event-driven architectures and asynchronous queues. Picked up in a couple of weeks when your company's workload actually demands it.

      • Redis & Caching· Later

        Cache invalidation is notoriously difficult. Don't optimize prematurely; optimize your database queries and indexes first.

    • Advanced DevOps & Cloud· Later

      Cluster and cloud provisioning are the domain of DevOps/Cloud engineers. Docker fluency is more than enough for a junior backend engineer.

      • Kubernetes (K8s)· Later

        Container orchestration, pod management, and cluster operations. Nobody expects a junior to configure production clusters.

      • AWS / GCP / Azure· Later

        VPCs, IAM permissions, Terraform, managed clusters... These are learned using company infrastructure under senior supervision.

      • İleri CI/CD Pipeline· Later

        Automated canary deployments, blue-green deployment pipelines, and advanced GitHub Actions workflows.