Senior Software Engineer, Java/Scala Platform

Bring the cape. The people we help need us every day.

Some heroes stop the train. Others rebuild the bridge while the train is still running across it. This job is the second kind, and it takes a steadier hand.

Our Java and Scala platform has been doing serious work for a long time. Behind it are real people: a missing child someone is still looking for, a family waiting on a call, an agency counting on the record being right. The platform can't go down while we modernize it, and it can't get a single access rule wrong. We need someone who can make it better without ever making it worse.

WHO WE ARE

Safience builds identity intelligence for public safety. We help identify two kinds of people: those who pose a real threat, and those who need to be found. Every record we work from is sourced from law enforcement. We don't scrape the internet. We don't follow people. There is no video. Not recorded, not streamed, not ever. If law enforcement isn't already looking for you, you pass through and leave no trace.

No alert goes out because a machine said so. Trained analysts review every identification before anyone gets a call. Every good hero has a code. That's ours.

WHY THIS ROLE MATTERS

Some of the most important code you'll touch decides who is allowed to see which record. That's where civil liberties live in software. A slow page is a bug. A missing access filter is a breach of trust. You'll treat both accordingly.

You'll report to our Director of Product Architecture and own long-lived, business-critical Play Framework applications in Java and Scala, backed by MongoDB-compatible document stores (Amazon DocumentDB) and running in containers on AWS ECS/Fargate across multiple accounts.

WHAT YOU'LL DO

• Maintain and extend Play Framework 2.x applications in Java and Scala: controllers, actions, filters, and Twirl templates.
• Work cleanly within Guice dependency injection: correct scoping, eager bindings, and none of the lifecycle traps that come from injecting into objects built outside the container.
• Refactor legacy code in small, safe steps. Pin down behavior with tests first, then change it.
• Lead our framework and library modernization. Inventory every dependency, direct and transitive, with its support status, known vulnerabilities, and upgrade blockers. Turn that into a sequenced, risk-ranked plan, then execute it one major version at a time, using feature flags or strangler-style replacement where a big-bang swap isn't safe.
• Make build-versus-replace calls out loud and record them as architecture decision records.
• Put guardrails in place so the stack never drifts again: automated dependency updates, vulnerability scanning in CI, and a supported-versions policy.
• Own the data access layer: entity mappings, references, query construction, and compatibility with DocumentDB's differences from MongoDB.
• Hunt down slow pages end to end. Read profiler output and explain() plans, find the collection scans, N+1 fetches, and in-memory aggregation, and replace them with indexed queries and server-side aggregation. Faster than a speeding bullet is the goal. Proving it with before-and-after numbers is the job.
• Design indexes and denormalization strategies, and keep downstream search sync pipelines healthy.
• Package JVM apps as hardened container images on ECS/Fargate and tune heap, GC, and resource limits.
• Troubleshoot JVM networking in containers, including dual-stack address selection, DNS caching, and TLS trust stores.
• Write and review Terraform for application infrastructure across multiple AWS accounts.
• Own observability: structured logs, JVM and query metrics, and alarms that catch regressions before users do.
• Maintain the authentication and authorization logic that controls who sees what. Treat secrets, personal data, and access filters as correctness-critical. Never remove a filter until you've proven it's redundant.
• Lead design reviews, write clear design docs and incident reports, and set team standards for base images, query patterns, testing, and runbooks.

WHO YOU ARE

• You own a cape. You've leapt a ten-year-old codebase in a single bound and left it better than you found it. You also know the real superpower with legacy systems isn't speed. It's patience, evidence, and a good test harness.
• Ownership is your default. Production health, data correctness, and security are your job, not someone else's ticket.
• You debug with evidence. You form a hypothesis, measure, and rule causes out with data instead of guessing.
• You modernize in safe, reversible steps, and you can explain the trade-offs to anyone.
• Your code reviews have x-ray vision. You spot the N+1 query and the missing index before they reach production.
• You write clear design docs, PR descriptions, and incident reports. Every good origin story has a paper trail.
• You make the people around you better through review, pairing, and documentation.
• You take privacy as seriously as uptime. An access rule is a promise to a real person, and you keep it.

WHAT YOU BRING

• 6+ years of professional software engineering, including 5+ years building production services in Java on the JVM
• 2+ years of production Scala, or the ability to read and modify Scala fluently
• 3+ years with Play Framework or a comparable JVM web framework (Spring Boot, Dropwizard, Akka
• 3+ years running applications backed by MongoDB or a MongoDB-compatible database
• A track record of improving a large legacy codebase while it stayed in production, including leading at least one major framework, ODM or driver, or JDK migration
• Java: collections, generics, concurrency (ExecutorService, CompletionStage), immutability, exception handling, and a working knowledge of the Java Memory Model
• Scala: case classes, pattern matching, Option and Future, implicits, and Java interop
• Play Framework: request lifecycle, actions and filters, sessions, configuration, Twirl templates, and async results
• Guice: bindings, scopes, providers, eager singletons, and lifecycle pitfalls
• MongoDB and DocumentDB: query and aggregation pipelines, compound index design, explain() output, and DocumentDB's functional differences
• Morphia and the MongoDB Java driver: entity mapping, references, the Query API, connection pooling, and read preferences
• Performance: JVM profiling (JFR, async-profiler, heap dumps) and database profiling, with a nose for N+1 and over-fetching
• Containers and AWS: Docker multi-stage builds for JVM apps, ECS/Fargate, IAM, VPC networking, and CloudWatch
• Build and CI: sbt (plus familiarity with Maven or Gradle), GitHub Actions, and automated test gates
• Testing: JUnit, ScalaTest or specs2, Mockito, and integration tests against real databases with Testcontainers or equivalent

EXTRA POWERS (NICE TO HAVE)

• Production experience with Amazon DocumentDB
• Upgrading Play across major versions (including the Akka-to-Pekko move in Play 3.x), replacing an older ODM with a maintained one, or moving a Play app to another JVM framework
• IAM-based database authentication with federated identities (IAM Identity Center, Cognito)
• Maintaining custom language lexers and parsers with JFlex and CUP
• Identity-aware proxy or zero-trust access patterns
• Elasticsearch or OpenSearch, including change-stream or oplog-based sync
• IPv6 and dual-stack networking for JVM workloads
• Terraform at production scale: remote state, modules, and multi-account layouts
• Regulated or security-sensitive domains (gaming compliance, identity, personal data handling)
• Other languages in our stack: Node.js/TypeScript, Go, C#/.NET, or T-SQL
• MongoDB Certified Developer, AWS Certified Developer Associate, or AWS Solutions Architect Associate
• Prior experience saving the world is a plus but not required

YOUR FIRST SIX MONTHS

• 30 days: Your local and devcontainer builds work, you've shipped a first production change through the full pipeline, and you've mapped the main request paths, data model, and known hot spots of one Play application.
• 90 days: You own one application end to end, on-call included. You've delivered a dependency inventory with support status and a sequenced migration plan, and you've fixed at least one measured performance problem with before-and-after numbers.
• 6 months: You've shipped the first major framework or library migration to production, along with the test harness that made it safe, and you've set a team standard such as automated dependency updates, a JVM base image, or an integration-test setup.

WHAT WE OFFER

• Fully remote. If you're near Phoenix, Philadelphia, or Northern Virginia, that's a plus, but the best candidate wins, wherever they log in from.
• Work that matters in the most literal sense. When the system holds up, a child goes home.
• A team that treats privacy as an engineering requirement, not a legal afterthought
• Cape: optional. Characterization tests: mandatory.

REQUIREMENTS

• Ability to pass a comprehensive background check, plus continuous vetting for as long as you're on the team. Secret identities are fine. Secret pasts are not.
• Participation in an on-call rotation. Villains don't keep business hours, and neither do outages.
• Authorization to work in the United States. We do not offer visa sponsorship.