Lead Software Engineer - Java/SpringBoot, Optum Tech Chief Digital Office - Remote

Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The Lead Software Engineer will design and build secure backend services for identity and access management, collaborating with cross-functional teams to deliver cloud-native services on AWS.

Responsibilities:

• Design, develop, and maintain Java 25 / Spring Boot 4.x microservices that implement OAuth 2.0, OIDC, and SAML 2.0 protocols for the Aikyam identity platform on AWS
• Build and evolve our OIDC implementation including authorization code, client credentials, and token exchange flows
• Implement and maintain shared libraries consumed across all platform services
• Design multi-tenant data models and tenant-scoped configuration patterns; manage tenant lifecycle via the tenants table and Redis cache layer
• Develop and maintain REST APIs following clean-code and domain-driven design principles; enforce consistent exception handling
• Write clean, testable code with comprehensive unit and integration test coverage using JUnit 5, Mockito, and Spring Boot Test
• Work with Quality Engineers to update or create new automated test
• Participate in and lead code reviews, engineering best practices
• Implement and harden JOSE (JWT, JWE, JWS) token issuance and validation pipelines using aikyam-jose-security
• Apply OAuth 2.0 / OIDC security best practices including PKCE, token binding, scope enforcement, and session management
• Collaborate with the security team to implement and maintain Optum's cryptographic and key-management standards via aikyam-miser
• Manage database schema migrations using Liquibase (aikyam-idp-liquibase) and maintain backward-compatible SQL changes
• Drive test strategy including unit, integration, and contract tests to support confident, rapid releases
• Lead architectural design sessions and produce clear ADRs and technical designs for new platform capabilities
• Actively participate in Agile/Scrum ceremonies: sprint planning, backlog refinement, reviews, and retrospectives
• Collaborate cross-functionally with product managers, security architects, QE, SRE, and business stakeholders to align on requirements and priorities
• Communicate technical decisions, risks, and trade-offs clearly to both technical and non-technical audiences
• Stay current with industry trends in identity standards (OAuth 2.1, FAPI, SCIM), cloud-native patterns, and Java/Spring ecosystem updates

Requirements:

• 5+ years of experience in backend software engineering with Java and Spring Boot (Spring MVC, Spring Security, Spring Data)
• 3+ years of experience with OAuth 2.0 / OIDC / SAML 2.0 protocols and identity platform development
• 3+ years of experience designing and operating microservices on AWS (EKS, ALB, SES/SNS, Secrets Manager, ECR)
• 3+ years of experience with Redis (caching, session management, key-pattern design)
• 3+ years of experience with CI/CD pipelines -- Jenkins and/or GitHub Actions -- including Docker image builds and Kubernetes/Helm deployments
• 3+ years of experience with relational databases (PostgreSQL / MySQL) and schema migration tooling (Liquibase or Flyway)
• 3+ years of experience working in an Agile/Scrum environment
• 2+ years of experience with JWT / JOSE standards (JWS, JWE, JWK)
• Proven experience leading technical design and mentoring engineers on a team
• Bachelor's or Master's degree in Computer Science, Engineering, or a related field
• Experience with Spring Authorization Server or Keycloak as an OIDC provider
• Hands-on experience with Spring Cloud Config Server and multi-environment configuration management
• Experience in the healthcare or financial services industry with exposure to regulatory compliance (HIPAA, SOC 2)
• Experience with Harness or similar GitOps-based deployment orchestration platforms
• Knowledge or exposure to AI, GenAI, or LLMs applied to identity and access management use cases
• Familiarity with FAPI (Financial-grade API) or SCIM 2.0 standards
• Proven contributions to open-source identity or security projects
• All employees working remotely will be required to adhere to UnitedHealth Group's Telecommuter Policy