API Lead - OAuth/API Gateway

Role Overview :

Owns the API ecosystem: the contracts Foundry and other consumers call, the standards they follow, and the security applied to them. Designs them, governs them, and keeps them versioned and consistent as consumers multiply.

Total Experience : 8 - 12 years

Experience and skills :

- 8+ years in integration and API engineering, with 3+ years leading API design for an enterprise programme with multiple consumers.

- Fluent in API specification and governance: OpenAPI, REST maturity, versioning strategies, contract-first design and contract testing.

- Hands-on with API gateways and management platforms: MuleSoft Anypoint, Apigee, Azure API Management, AWS API Gateway, Kong or similar.

- Strong applied API security: OAuth 2.0 and OpenID Connect, mutual TLS, JWT and scope design, secrets handling, and protecting sensitive fields in payloads.

- Practical event-driven experience: schema design, schema registry, compatibility modes, ordering, retries and dead-letter handling on Kafka, Azure Service Bus, Event Hubs or equivalent.

- Experience exposing data from packaged systems - Salesforce in particular - and knowing when to wrap rather than extend a product API.

- Able to write the specification and the standard, then hold others to it across teams that did not write it.

- Desirable: healthcare data experience (claims, eligibility, provider data), FHIR or X12 exposure, and GraphQL where consumer patterns justify it.

Core responsibilities :

1. Design the API contracts :

- Specify operations on Patient, Provider, Payor, Claim, Bill and Eligibility: resources, payload schemas, pagination, filtering, error semantics and status codes, delivered as OpenAPI specifications.

- Define the canonical shape of each business object with the Architect and the application SMEs, and confirm the system of record per object so contracts do not encode the wrong source.

2. Set and govern API standards :

- Naming, layering (system, process and experience), versioning and deprecation policy, backward-compatibility rules, idempotency keys, correlation identifiers, and the definition of done for an API.

3. Own API security design :

- Authentication and authorisation (for example OAuth 2.0 client credentials, mutual TLS), scope and claim design, rate limiting and throttling, field-level PHI protection, masking and audit logging - agreed with MedRisk security.

4. Own the event contracts alongside the APIs :

- Business event definitions, payload schemas, topic or channel naming, schema registry and compatibility rules, ordering and retention requirements, and producer and consumer ownership.

5. Define the API platform operating model :

- Gateway standards, developer portal and catalogue, onboarding of consumers, environment and credential management, API observability, SLOs and error budgets.

6. Run the consumer relationship with Palantir :

- Confirm what Foundry needs, in what shape and at what latency; keep contracts stable and communicate changes before they break anyone.

7. Design for reuse :

- Keep one contract per capability across the eight Foundry workstreams; refuse workstream-specific variants that duplicate an existing contract.

8. Prepare the build :

- Produce the API backlog, mocks and stubs, contract testing approach, and the estimates that let build start without re-analysis.

Skills

Solution Architect, API, RESTful API, OpenAPI, OAuth, MuleSoft, APIGEE, Integration Architecture, API Gateway