{"id":2612237,"url":"https://alion.io/job/empat-senior-java-engineer-abac-enforcement","title":"Senior Java Engineer (ABAC Enforcement)","company":{"id":182658,"name":"Empat","domain":"empat.tech","url":"https://alion.io/company/empat","size_band":"51-200","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"PeopleForce","truth_index":null},"role":"Backend","role_family":"Backend","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"unspecified","remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":89000,"max_usd":225000,"period":"year","method":"global_role_seniority_cell","sample_n":6933},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"BigQuery","optional":false},{"name":"Dapr","optional":false},{"name":"Envoy","optional":false},{"name":"GCP","optional":false},{"name":"Google BigQuery","optional":false},{"name":"GraalVM","optional":false},{"name":"gRPC","optional":false},{"name":"HIPAA","optional":false},{"name":"Istio","optional":false},{"name":"Jackson","optional":false},{"name":"Java","optional":false},{"name":"Kubernetes","optional":false},{"name":"Netty","optional":false},{"name":"Redis","optional":false},{"name":"Service Mesh","optional":false},{"name":"SLI/SLO/SLA","optional":false},{"name":"Go","optional":true}],"status":"live","first_seen_at":"2026-10-15T11:20:14Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-15T18:42:08Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"We are looking for a Senior Java Engineer to join the Access & Authorization platform full-time. This is protocol-level, performance-critical systems work - you will be building the mandatory enforcement sidecar for the ABAC platform: a per-pod, request-path component that performs authorization checks at the level of tenant, endpoint, row, and field. This is not CRUD or framework work - we are looking for a systems engineer, not a typical enterprise Java developer.\nYour responsibilities will include:\nBuild and own the ABAC enforcement sidecar - a performance-critical component sitting in the request path of all services\nImplement four-layer authorization checks: tenant isolation, endpoint access, row-level filtering, and field-masking\nStream and rewrite JSON response bodies at the token level with near-zero allocation overhead\nMaintain a local decision cache and integrate with a central Decision API\nOwn the HTTP layer end-to-end - including conformance, edge cases, and adversarial scenarios\nEnsure fail-closed semantics - the component must deny by default when the policy engine is unavailable\nWrite adversarial tests: malformed requests, mid-stream drops, slow clients, header edge cases\nWhat we expect from you:\nJava 21+ without a framework - vanilla Java only; Spring or DI dependency is a disqualifier for this role\nGraalVM native image shipped to production - not experimented with; understands closed-world constraints, reflection config, build-time vs run-time init\n HTTP protocol internals - can implement and reason at spec level: chunked transfer, keep-alive, streaming without buffering full bodies, backpressure, connection handling\nJackson streaming API (JsonParser/JsonGenerator) - token-level processing, not databind; able to apply field-masks with flat allocation\n Performance engineering with real numbers - has owned a latency SLA (p99, percentiles, RPS); measures before tuning using JMH, async-profiler, allocation profiling\nCaching and invalidation reasoning - understands the decision-cache triangle: hit latency vs revocation latency vs TTL, negative caching, stampede protection\nAuthZ fundamentals and fail-closed semantics - understands PDP/PEP separation, deny-overrides, tenant isolation; knows the sidecar applies decisions, not computes policy\nMinimal-dependency mindset - solves with the JDK first; can articulate the real cost of adding a library in a native-image context\nWill be a plus:\nNetty - used at the channel/pipeline level\nService mesh / sidecar patterns - Envoy, ext_authz, Istio, Dapr\nAuthorization engines - OPA/Rego, Cedar, Zanzibar-style systems, Oso\nGCP stack - Pub/Sub, Memorystore/Redis, BigQuery\nKubernetes - sidecar injection, resource limits, probes, startup ordering\ngRPC / protobuf over HTTP\nExperience in regulated-data domains - FERPA, COPPA, HIPAA, or similar\njlink / AppCDS / CRaC - JVM-fallback literacy if native image is constrained\nSoft skills / Mindset:\nSystems thinker - reads RFCs, owns the protocol layer, does not treat HTTP as “what the framework handles”\nMeasurement discipline - quotes numbers, not vibes; profiles before tuning\nDependency-conscious - resists the reflex to add a library; accounts for native-image surface and supply-chain cost\nFail-closed by instinct - treats fail-open as a security consequence, not an availability trade-off\nUpper-Intermediate+ English level\nWhat We Offer:\nWork at a Top-employer company (according to DOU 2025)\nA strong culture built on empathy, trust, openness, and real care for employees\nCompetitive compensation with regular reviews\nMedical insurance\nTeam events and regular team-building activities\nFlexible hybrid work model with an office in central Kyiv or fully remote","description_format":"text","description_chars":3702,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Health insurance","Hybrid work"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Mobile App Development Services","Web Development Services","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-10-15T11:20:14Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":16,"reasons":["conf:1","win:early"],"computed_at":"2026-10-15T20:16:32Z"},"pay":null,"html_url":"https://alion.io/job/empat-senior-java-engineer-abac-enforcement","json_url":"https://alion.io/job/empat-senior-java-engineer-abac-enforcement.json","meta":{"generated_at":"2026-10-15T20:16:32Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30783,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":182658},"rest":"https://alion.io/mcp/rest/get_company?id=182658"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fempat-senior-java-engineer-abac-enforcement"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fempat-senior-java-engineer-abac-enforcement"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fempat-senior-java-engineer-abac-enforcement"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/empat-senior-java-engineer-abac-enforcement\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fempat-senior-java-engineer-abac-enforcement"}]}