Senior Backend Engineer — Authentication & Security Platform (Digital Bank)

About Abbeal Abbeal is an international IT consulting firm (France, Japan, Canada) placing senior engineers on high-impact product teams. Through Abbeal, join the Authentication & Authorization platform of an FSA-regulated digital bank launching in Japan. The Context We support an FSA-regulated digital bank launching its platform in Japan. You will join the team building the Authentication & Authorization foundation: OAuth 2.0/OIDC login, token lifecycle and identity management across four banking channels (officer dashboards, customer apps, BaaS APIs, third-party integrations). The team is distributed across Japan, Vietnam and India; the role is anchored on Tokyo with a remote-friendly setup. English is the working language — Japanese is not required. What You Will Build Token lifecycle — DPoP-bound access tokens, silent refresh, session management Passkey / FIDO2 — WebAuthn registration and login flows, step-up authentication mTLS integrations — certificate-based service-to-service auth with external financial platforms Shared security library — Spring Boot starter providing standardized auth filters Integration testing — Karate-based suites covering all auth flows at scale Monitoring — auth event observability, anomaly detection, audit trail completeness What We Are Looking For 10+ years in server-side backend engineering, including 5-7 years in Kotlin or Java + Spring Boot Spring Security (filter chains, OAuth2 Resource Server) and strong OAuth 2.0 / OIDC knowledge At least one of DPoP, mTLS, PKCE, FIDO2 / WebAuthn — plus JWT (claims, JWKS, key rotation) Redis (sessions, distributed locking, caching) and PostgreSQL (schema design, migrations) AWS (ECS/Fargate, Secrets Manager) and Terraform or equivalent IaC Strong understanding of the OWASP Top 10 and secure web application development Professional English (working language); Japanese not required Nice to Have Authlete; FAPI 2.0 Security Profile; Microsoft Entra ID; Cloudflare / Akamai (mTLS termination, WAF) Fintech / regulated banking background (FSA, maker-checker, audit logging); Japanese ability Why This Role A real FSA-supervised bank — cutting-edge security standards (FAPI 2.0, DPoP, WebAuthn/FIDO2), high ownership of entire authentication channels, global collaboration on a greenfield platform. Compensation and Setup Permanent role, anchored on Tokyo, distributed team, remote-friendly. Indicative range ¥8M–¥17M/year depending on experience. Hired and supported by Abbeal (visa sponsorship + Mobbeal expat support); relocation support possible depending on profile.