Senior Java Developer (HSM Cyptograpgy)

Senior Java Developer

Experience - 6+ years

Job Description -

• Java (modern LTS, 21+) as the primary language deep, current, hands-on expertise is essential.
• Spring Boot 3.x and the wider Spring ecosystem (Spring Web / WebFlux, Spring Security, Spring Data, Spring Cloud); reactive programming with Project Reactor is a strong plus.
• Gradle (Kotlin DSL), version catalogs, multi-repo / composite builds, and CI/CD pipelines (Jenkins, Git-based workflows).
• OpenAPI-first API design with code generation, API linting/governance, and disciplined versioning.
• Relational databases and schema evolution: PostgreSQL, JPA/Hibernate, Flyway migrations, query performance and data modelling.
• Event-driven and asynchronous messaging: Apache Kafka, event/command-driven or CQRS-style architectures (e.g. Axon), and reliable delivery patterns such as the transactional outbox.
• Containerised delivery and cloud-native operations: Docker, orchestration platforms, configuration and secret management (e.g. HashiCorp Vault), 12-factor configuration.
• Observability in production: structured logging, metrics, tracing, dashboards and alerting including how to instrument systems that must never log sensitive data.
• Git and modern collaborative development practices (PR-based workflows, code review culture, semantic versioning).

Security and cryptography

• Good working knowledge of industry-standard cryptographic algorithms and primitives — symmetric (AES, 3DES), asymmetric (RSA, ECC), hashing, MAC/CMAC, key derivation and key wrapping — and sound judgement on how, where and when to apply them.
• Practical experience with key management concepts: key hierarchies, LMKs, transport/zone keys, key blocks (e.g. TR-31), key ceremonies, rotation, custody, key states and lifecycle.
• Hands-on experience integrating with Hardware Security Modules (e.g. Thales payShield, Entrust nShield) and cryptographic interfaces such as PKCS#11 and JCE/JCA.
• PKI and certificate management: X.509, CA hierarchies, CSR/issuance flows, certificate lifecycle and validation; EMV issuer certificate concepts are a strong plus.
• Secure service-to-service communication: TLS/mTLS, keystores and truststores, authentication/authorisation and policy enforcement at the gateway.
• Secure development mindset: threat modelling, least privilege, secure defaults, secrets handling, and an instinct for never exposing key material, PANs, cryptograms or tokens in logs, traces or errors.
• Familiarity with payments domain standards and regulatory/compliance drivers (PCI DSS / PCI PIN / PCI P2PE, EMV, ISO 8583) is highly desirable.

Ways of working

• Expert critical-thinking and problem-solving skills; able to reason from first principles about unfamiliar, high-stakes systems.
• Highly motivated and proactive about the success of the team and the product, not just individual deliverables.
• High-energy, detail-oriented and able to handle multiple high-priority demands while driving consistent, predictable results.
• Excellent written and verbal communication; can explain complex cryptographic and architectural concepts to both specialist and non-specialist audiences.
• Comfortable working in a globally distributed team, and a demonstrated willingness to mentor, document and share knowledge.