Senior Java Engineer (ABAC Enforcement)

We are looking for a Senior Java Engineer to join the Access & Authorization platform full-time. This is protocol-level, performance-critical systems work — you will be building the mandatory enforcement sidecar for the ABAC platform: a per-pod, request-path component that performs authorization checks at the level of tenant, endpoint, row, and field. This is not CRUD or framework work — we are looking for a systems engineer, not a typical enterprise Java developer.

Your responsibilities will include:

• Build and own the ABAC enforcement sidecar — a performance-critical component sitting in the request path of all services
• Implement four-layer authorization checks: tenant isolation, endpoint access, row-level filtering, and field-masking
• Stream and rewrite JSON response bodies at the token level with near-zero allocation overhead
• Maintain a local decision cache and integrate with a central Decision API
• Own the HTTP layer end-to-end — including conformance, edge cases, and adversarial scenarios
• Ensure fail-closed semantics — the component must deny by default when the policy engine is unavailable
• Write adversarial tests: malformed requests, mid-stream drops, slow clients, header edge cases

What we expect from you:

• Java 21+ without a framework — vanilla Java only; Spring or DI dependency is a disqualifier for this role
• GraalVM native image shipped to production — not experimented with; understands closed-world constraints, reflection config, build-time vs run-time init
• HTTP protocol internals — can implement and reason at spec level: chunked transfer, keep-alive, streaming without buffering full bodies, backpressure, connection handling
• Jackson streaming API (JsonParser/JsonGenerator) — token-level processing, not databind; able to apply field-masks with flat allocation
• Performance engineering with real numbers — has owned a latency SLA (p99, percentiles, RPS); measures before tuning using JMH, async-profiler, allocation profiling
• Caching and invalidation reasoning — understands the decision-cache triangle: hit latency vs revocation latency vs TTL, negative caching, stampede protection
• AuthZ fundamentals and fail-closed semantics — understands PDP/PEP separation, deny-overrides, tenant isolation; knows the sidecar applies decisions, not computes policy
• Minimal-dependency mindset — solves with the JDK first; can articulate the real cost of adding a library in a native-image context

Will be a plus:

• Netty — used at the channel/pipeline level
• Service mesh / sidecar patterns — Envoy, ext_authz, Istio, Dapr
• Authorization engines — OPA/Rego, Cedar, Zanzibar-style systems, Oso
• GCP stack — Pub/Sub, Memorystore/Redis, BigQuery
• Kubernetes — sidecar injection, resource limits, probes, startup ordering
• gRPC / protobuf over HTTP
• Experience in regulated-data domains — FERPA, COPPA, HIPAA, or similar
• jlink / AppCDS / CRaC — JVM-fallback literacy if native image is constrained

Soft skills / Mindset:

• Systems thinker — reads RFCs, owns the protocol layer, does not treat HTTP as “what the framework handles”
• Measurement discipline — quotes numbers, not vibes; profiles before tuning
• Dependency-conscious — resists the reflex to add a library; accounts for native-image surface and supply-chain cost
• Fail-closed by instinct — treats fail-open as a security consequence, not an availability trade-off
• Upper-Intermediate+ English level

What We Offer:

• Work at a Top-employer company (according to DOU 2025)
• A strong culture built on empathy, trust, openness, and real care for employees
• Competitive compensation with regular reviews
• Medical insurance
• Team events and regular team-building activities
• Flexible hybrid work model with an office in central Kyiv or fully remote