Principal Engineer - Software- OAuth, OIDC & CIAM

Skill Required proficiency Java / Spring Boot Principal-level ownership of production Spring Boot services: able to set engineering direction, make and defend key design decisions, diagnose complex production issues, and establish patterns and standards that other engineers can follow.

Kafka Principal-level command of event-driven design and Kafka, including consumer groups, offset and failure management, partitioning and ordering, compaction, dead-letter strategies and delivery semantics. Able to design for scale, resilience and operability, identify trade-offs, and guide teams beyond basic producer/consumer implementation.

Docker / Compose Able to define robust containerisation patterns for development and delivery, including production-quality Dockerfiles, multi-service Compose environments, health/readiness checks and dependency configuration. Can diagnose complex networking and runtime issues and establish repeatable patterns for engineering teams.

GitLab CI/CD Able to own and evolve CI/CD engineering practices across teams: designing, maintaining and troubleshooting GitLab pipelines; defining multi-stage build and test strategies, quality and security gates, artefact promotion and deployment controls; and embedding trunk-based, small-batch delivery as the default engineering model.

TDD Leads by example with test-first engineering as the normal development model: failing test, minimum implementation, then refactor with tests green. Able to define appropriate unit, component, contract and integration boundaries and coach teams to make executable evidence part of the definition of done. This is foundational to safe AI-assisted engineering.

AI-assisted engineering (Claude Code) Demonstrable hands-on use of Claude Code or equivalent approved tooling on real codebases, covering exploration, specification and planning, implementation, test authoring, debugging and review. At Principal level, expected to establish safe and effective working patterns for teams, critically validate generated output, preserve human accountability, and ensure AI-assisted delivery remains within SDLC, security and governance controls.

OPA / Rego / Policy-as-Code

• Rego language: comprehensions, partial evaluation, data references, default rules, test framework
• OPA bundle lifecycle: build, sign, distribute, hot-reload
• OPA plugin architecture: how custom plugins (Kafka, HTTP, Vault) extend the OPA runtime
• Policy modelling: RBAC, ABAC, ReBAC expressed in Rego
• Performance: sub-10ms policy evaluation at volume against large in-memory data sets

Envoy / Service Mesh

• Envoy proxy configuration: `ext_authz` filter (HTTP and gRPC), route matching, header manipulation
• PEP/PDP separation: what the proxy enforces vs what the policy engine decides
• Failure modes: fail-closed configuration, circuit breaking, timeout handling
• Spring Cloud Gateway or equivalent API gateway: routing, filters, header injection

Event Streaming

• Kafka internals: partitioning strategy, log compaction, consumer lag monitoring, replay from offset
• Event sourcing patterns: state reconstruction from event streams, snapshot + delta merge, idempotent consumers
• CloudEvents specification: envelope structure, checksums, correlation
• Multi-topic state merge: combining events from multiple topics into a coherent document per entity

Identity / CIAM / LDAP

• Ping Identity stack (IG, AM, DS) or equivalent enterprise CIAM platform
• OAuth 2.0 / OIDC: authorization code flow, token exchange, JWKS validation, session management
• mTLS, certificate management, TIAA or equivalent token service

AuthN + AuthZ Architecture

• PEP / PDP / PIP model — can explain and implement the separation
• Decision evidence: linking every authorisation decision to the entitlement state and policy version that produced it

Platform / DevOps / Observability

• Terraform and/or Helm for infrastructure-as-code
• Prometheus, Grafana, CloudWatch, or Observe for metrics and dashboards
• Structured logging, distributed tracing (OpenTelemetry / W3C Trace Context)
• CI/CD pipeline design: build, test, scan, promote, deploy across multiple environments
• Container security scanning (Wiz, Prisma, SonarQube)