Senior Software Engineer

the Project•Orlando, FL

3d•Hybrid

About The Position

We are hiring a Senior Software Engineer on a 12-month contract to help build and ship the next-generation Children Discovery App (CDA) for Disney Cruise Line. CDA is a location-aware operational platform used by cast and youth programs across multiple ships and resort/island locations. It supports guest registration, check-in, guests-in-care workflows, messaging, reporting, real-time room/occupant visibility, and integrations with enterprise reservation and charging systems. You will work across a multi-repo system—Angular SPA, Node.js Web API, and Java core services—following Disney Reference Architecture (RA) patterns, CI/CD promotion through latest → stage → per-location production, and enterprise security (MyID/Keycloak OIDC, authz, Vault/Consul-style config). The CDA replacement program modernizes a legacy application into a modular stack: UI: Angular SPA, Express static server, Capacitor (iOS/Android), lazy-loaded feature modules (check-in, dashboard, guests-in-care, notifications, settings), i18n, Jest (80% coverage threshold); Web API: Node.js + Restify, TypeScript, OpenAPI/Swagger, authz token endpoints; Core API: Java 21, Spring Boot, embedded Jetty, CXF REST, Flyway/JPA, MariaDB, Redis, STOMP WebSocket relay with room-state aggregation. Domain highlights include per-location behavior with configurable flows, real-time operations with alerting, enterprise integrations, and observability.

Requirements

8+ years professional software development, with 5+ years in senior or lead IC roles on production web applications.
Strong TypeScript and Angular (modern standalone/module patterns, routing, HTTP interceptors, reactive forms, testing with Jest or similar).
Production experience building Node.js REST APIs (TypeScript preferred); comfort with auth middleware, cookies/tokens, and API security basics.
Solid SQL and relational modeling; experience with MariaDB/MySQL or equivalent.
Experience with OAuth2/OIDC enterprise SSO, JWT validation, and role-based access control.
Docker and cloud-style deployment (ECS/Kubernetes or similar); understanding of health checks, env-based config, and twelve-factor practices.
Strong git workflow, code review culture, and ability to work in multi-repo codebases.
Excellent communication: technical design notes, stakeholder updates, and clear written PR/Jira documentation.

Nice To Haves

Java 21 and Spring Boot (JPA, Flyway, embedded servlet containers, Micrometer metrics).
WebSocket/STOMP or similar real-time messaging; Redis pub/sub for multi-instance fan-out.
Capacitor or hybrid mobile delivery for operational tablet apps.
Experience with enterprise integration (reservation, POS/charging, eligibility services).
Familiarity with WDPR Reference Architecture blocks (MyID login, mpropz, logasaurus, authz filters)—or comparable large-org platform libraries.
NGINX reverse proxy and local multi-service dev setups.
Load/performance testing and operational runbooks for ship/resort deployments.
Productive use of AI-assisted development tools (e.g. IDE agents, code review aids) with strong judgment—validating output, preserving security and quality standards, and following company policy on guest/PII and credentials.

Responsibilities

End-to-end feature delivery — design, implement, test, and deploy user-facing and API capabilities aligned with acceptance criteria and location-config requirements.
Full-stack contribution — primary strength in Angular + TypeScript and/or Node.js Web APIs, with willingness to touch Java/Spring services (relay, children API, persistence) when the work spans layers.
Location-aware design — implement and extend configuration-driven behavior so one codebase serves many deployment targets without hard-coded location logic.
Real-time UX — integrate STOMP/WebSocket room state in the SPA; handle reconnect, replay on subscribe, and consistent UI state under multi-pod deployments.
Security & compliance — OIDC/MyID login flows, role/claims enforcement (CDA_USER, CDA_ADMIN, cast/guest authz patterns), parameterized data access, no secrets in code, safe error handling.
API quality — REST contract design, OpenAPI documentation, backward-compatible versioning, integration with existing RA auth interceptors and validators.
Data & persistence — MariaDB schema/migrations (Flyway), JPA entities, and coordination with documented MongoDB/per-location persistence strategy where applicable.
DevOps collaboration — Docker images, health checks, environment-specific config (Vault, mpropz), and CI pipeline fixes; promote artifacts through latest → stage → production locations.
Code quality — unit/integration tests, lint gates, code review, and clear PR descriptions (including Jira mapping and test plans).
Mentorship — unblock mid-level engineers, uphold RA and team conventions, and document non-obvious domain or integration behavior.
Modern engineering practices — use approved tools (including AI-assisted development where permitted) to accelerate delivery while maintaining test coverage, code review standards, and compliance requirements; validate all generated or suggested code and never expose guest/PII, credentials, or secrets to unapproved external tools.