Senior Java Engineer (ABAC Enforcement)

We are looking for a Senior Java Engineer to join the Access & Authorization platform full-time. This is protocol-level, performance-critical systems work — you will be building the mandatory enforcement sidecar for the ABAC platform: a per-pod, request-path component that performs authorization checks at the level of tenant, endpoint, row, and field. This is not CRUD or framework work — we are looking for a systems engineer, not a typical enterprise Java developer.

Your responsibilities will include:
Build and own the ABAC enforcement sidecar — a performance-critical component sitting in the request path of all services
Implement four-layer authorization checks: tenant isolation, endpoint access, row-level filtering, and field-masking
Stream and rewrite JSON response bodies at the token level with near-zero allocation overhead
Maintain a local decision cache and integrate with a central Decision API
Own the HTTP layer end-to-end — including conformance, edge cases, and adversarial scenarios
Ensure fail-closed semantics — the component must deny by default when the policy engine is unavailable
Write adversarial tests: malformed requests, mid-stream drops, slow clients, header edge cases
What we expect from you:
Java 21+ without a framework — vanilla Java only; Spring or DI dependency is a disqualifier for this role
GraalVM native image shipped to production — not experimented with; understands closed-world constraints, reflection config, build-time vs run-time init
HTTP protocol internals — can implement and reason at spec level: chunked transfer, keep-alive, streaming without buffering full bodies, backpressure, connection handling
Jackson streaming API (JsonParser/JsonGenerator) — token-level processing, not databind; able to apply field-masks with flat allocation
Performance engineering with real numbers — has owned a latency SLA (p99, percentiles, RPS); measures before tuning using JMH, async-profiler, allocation profiling
Caching and invalidation reasoning — understands the decision-cache triangle: hit latency vs revocation latency vs TTL, negative caching, stampede protection
AuthZ fundamentals and fail-closed semantics — understands PDP/PEP separation, deny-overrides, tenant isolation; knows the sidecar applies decisions, not computes policy
Minimal-dependency mindset — solves with the JDK first; can articulate the real cost of adding a library in a native-image context
Will be a plus:
Netty — used at the channel/pipeline level
Service mesh / sidecar patterns — Envoy, ext_authz, Istio, Dapr
Authorization engines — OPA/Rego, Cedar, Zanzibar-style systems, Oso
GCP stack — Pub/Sub, Memorystore/Redis, BigQuery
Kubernetes — sidecar injection, resource limits, probes, startup ordering
gRPC / protobuf over HTTP
Experience in regulated-data domains — FERPA, COPPA, HIPAA, or similar
jlink / AppCDS / CRaC — JVM-fallback literacy if native image is constrained
Soft skills / Mindset:
Systems thinker — reads RFCs, owns the protocol layer, does not treat HTTP as “what the framework handles”
Measurement discipline — quotes numbers, not vibes; profiles before tuning
Dependency-conscious — resists the reflex to add a library; accounts for native-image surface and supply-chain cost
Fail-closed by instinct — treats fail-open as a security consequence, not an availability trade-off
Upper-Intermediate+ English level
What We Offer:
Work at a Top-employer company (according to DOU 2025)
A strong culture built on empathy, trust, openness, and real care for employees
Competitive compensation with regular reviews
Medical insurance
Team events and regular team-building activities
Flexible hybrid work model with an office in central Kyiv or fully remote