Senior Software Engineer (AM+ Auth)

Gravitee•Denver, CO

17d•Hybrid

About The Position

Gravitee is seeking a Senior Software Engineer to join their team and focus on building and maintaining the identity and authorization features of Gravitee Access Management (AM). This role will involve working on both the AM runtime and the access-management experience within Gamma, Gravitee's next-generation product. This is a new position that will establish US-hours ownership of critical incident support and contribute to the parity of AM in Gamma, building a sustainable engineering capability in the US. The role involves a split of approximately 80% feature delivery and 20% incident support and bug fixing, working closely with the European-based AM team.

Requirements

5+ years building and running production backend software, on a team that ships and supports its own product; you have personally resolved production incidents.
Strong Java experience (C# accepted if the object-oriented depth is there), with Maven and a reactive stack such as Vert.x/RxJava.
Deep working knowledge of identity standards: OAuth 2.0 and OIDC flows (authorization code + PKCE, client credentials, token exchange), SAML 2.0, SCIM, and FAPI/CIBA/UMA profiles.
Solid grasp of token and session semantics: JWT, JWKS, rotation, revocation, introspection, MFA/step-up, WebAuthn/FIDO2, and IdP federation.
A security-first mindset: secure defaults, certificate and secret handling, audit logging, and awareness of token replay, SSRF, and account-takeover risks.
Experience with safe migrations and backward compatibility across persistent data stores such as MongoDB or JDBC-backed relational databases.
Git-based workflow, code review, and writing your own automated tests.
Hands-on experience using LLMs or AI coding assistants as part of an engineering workflow, combined with the judgment to review and improve their output.
Clear communication, collaborative problem-solving, and the ability to take an ambiguous problem through to production.

Nice To Haves

Experience at an API gateway, proxy, or service-mesh vendor, or on the API platform team of a large company (e.g., Kong, Google Apigee, MuleSoft, Tyk, Solo.io , Traefik, WSO2).
Kubernetes operators and CRDs; OpenAPI tooling; service mesh or Envoy experience.
Docker, Kubernetes, and cloud-native application delivery.
Model Context Protocol (MCP), Agent2Agent (A2A), tool calling, LLM proxies, or other emerging AI protocols and standards.
Building or operating LLM-powered applications, RAG systems, or agentic workflows — especially their security, governance, and observability needs.
Open-source software or enterprise developer platforms.

Responsibilities

Design and deliver features end to end, from discovery and technical design through implementation, testing, release, and iteration.
Build and maintain identity and authorization features of Gravitee Access Management, across the AM runtime and the AM experience in Gamma.
Implement and support OAuth 2.0 and OIDC flows (authorization code + PKCE, client credentials, token exchange), SAML 2.0 as both IdP and SP, SCIM, and FAPI/CIBA/UMA profiles.
Work with token and session semantics — JWT, JWKS, key rotation, revocation, introspection, MFA and step-up, WebAuthn/FIDO2, and IdP federation and social login.
Ensure security behavior and upgrades are safe: standards compliance, secure defaults, certificate and secret handling, consent, audit logs, and defenses against token replay, SSRF, and account takeover.
Own safe migrations and backward compatibility across MongoDB and JDBC, and support multi-domain, multi-region deployments and login/token endpoint performance.
Own US-hours Level 3 and Level 4 escalations for AM customers as part of the L3 pager duty rotation.
Use LLMs and AI-assisted development tools thoughtfully for prototyping, implementation, testing, debugging, and exploration, applying sound engineering judgment to validate AI-generated work.
Write meaningful automated tests and contribute to reliable delivery practices.
Collaborate with product managers, designers, engineers, and technical leaders — including the AM team based in Europe — to discover effective solutions and improve them through code and design reviews.
Share what you learn and help the team make practical choices as identity standards and protocols evolve.