Principal Java/Kotlin Engineer (Spring Security & Auth)

About the RoleWe're building the Authentication & Authorization platform for a new FSA-regulated digital bank in Japan. The platform powers OAuth 2.0/OIDC-based login, token lifecycle, and identity management across four banking channels — officer dashboards, customer-facing apps, BaaS APIs, and third-party service provider integrations.The team is located in Vietnam HCM city with high ownership. You'll own entire auth flows end-to-end — not just write tickets.What You'll BuildToken lifecycle — DPoP-bound access tokens, token exchange (RFC 8693), silent refresh, session managementPasskey/FIDO2 — WebAuthn registration & login flows, step-up authentication for sensitive operationsmTLS integrations — certificate-based service-to-service auth with external financial platformsShared security library — Spring Boot starter providing standardized auth filters across all backend servicesIntegration testing — Karate-based test suites covering all auth flows at scaleMonitoring — Auth event observability, anomaly detection, audit trail completenessMust-HaveBackendOver 10 years in server-side engineering, including 5 to 7 years specializing in Kotlin or Java with Spring Boot development.Redis — session management, distributed locking, cachingPostgreSQL — schema design, migrationsREST API design and HTTP security headersEnglish proficiency (reading, writing, and verbal) — the primary working language across the team and organization for daily communication, code reviews, and technical documentation.Security & AuthStrong Spring Security expertise — filter chains, OAuth2 Resource ServerWorking knowledge of OAuth 2.0 / OIDC — authorization code, client credentials, token exchange, introspectionUnderstanding at least one: DPoP (RFC 9449), mTLS (RFC 8705), PKCE, FIDO2/WebAuthnFamiliarity with JWT structure — claims, JWKS, key rotationStrong knowledge of authentication, authorization, session management, and secure web application development.Strong understanding of the OWASP Top 10 — common web vulnerabilities, mitigation, and secure coding practicesInfrastructureAWS — ECS/Fargate, Secrets Manager, VPC basicsTerraform or similar IaCAPI integration testing (Karate preferred)Nice-to-HaveExperience with AuthleteFAPI 2.0 Security Profile or financial-grade API standardsMicrosoft Entra ID — SAML/OIDC federation, FIDO2 key enforcementCloudflare/ Akamia — mTLS termination, WAF, client certificate forwardingWebAuthn/FIDO2 ceremonies — attestation, assertion, discoverable credentialsFintech/banking background — FSA regulations, maker-checker patterns, audit loggingJapanese language ability (reading/basic communication) — a plus for requirement docsWhy This Role🏦 Real regulated bank — not a fintech startup, not a toy project. FSA-supervised, launching in Japan.🔐 Cutting-edge security standards — FAPI 2.0, DPoP, WebAuthn/FIDO2. Few teams globally work at this intersection.🚀 High ownership — small team, big scope. You'll own entire authentication channels, not just implement tickets.🌏 Global collaboration — work with engineers across Japan, Vietnam, and India on a greenfield digital banking platform.