Principal Security Software Engineer Digital Banking

Must-Have
Backend
Over 10 years in server-side engineering, including 5 to 7 years specializing in Kotlin or Java with Spring Boot development.
Redis - session management, distributed locking, caching
PostgreSQL - schema design, migrations
REST API design and HTTP security headers
English proficiency (reading, writing, and verbal) - the primary working language across the team and organization for daily communication, code reviews, and technical documentation.
Security & Auth
Strong Spring Security expertise - filter chains, OAuth2 Resource Server
Working knowledge of OAuth 2.0 / OIDC - authorization code, client credentials, token exchange, introspection
Understanding at least one: DPoP (RFC 9449), mTLS (RFC 8705), PKCE, FIDO2/WebAuthn
Familiarity with JWT structure - claims, JWKS, key rotation
Strong knowledge of authentication, authorization, session management, and secure web application development.
Strong understanding of the OWASP Top 10 - common web vulnerabilities, mitigation, and secure coding practices
Infrastructure
AWS - ECS/Fargate, Secrets Manager, VPC basics
Terraform or similar IaC
API integration testing (Karate preferred)
Nice-to-Have
Experience with Authlete
FAPI 2.0 Security Profile or financial-grade API standards
Microsoft Entra ID - SAML/OIDC federation, FIDO2 key enforcement
Cloudflare/ Akamia - mTLS termination, WAF, client certificate forwarding
WebAuthn/FIDO2 ceremonies - attestation, assertion, discoverable credentials
Fintech/banking background - FSA regulations, maker-checker patterns, audit logging
Japanese language ability (reading/basic communication) - a plus for requirement docs
Why This Role
🏦 Real regulated bank - not a fintech startup, not a toy project. FSA-supervised, launching in Japan.
🔐 Cutting-edge security standards - FAPI 2.0, DPoP, WebAuthn/FIDO2. Few teams globally work at this intersection.
🚀 High ownership - small team, big scope. You'll own entire authentication channels, not just implement tickets.
🌏 Global collaboration - work with engineers across Japan, Vietnam, and India on a greenfield digital banking platform.