Senior Software Developer

Xylem is a Fortune 500 global water solutions company dedicated to advancing sustainable impact and empowering the people who make water work every day. As a leading water technology company with 23,000 employees operating in over 150 countries, Xylem is at the forefront of addressing the world's most critical water challenges. We invite passionate individuals to join our team, dedicated to exceeding customer expectations through innovative and sustainable solutions.Xylem is seeking a Senior Software Developer to help drive the architecture and evolution of its enterprise Customer Identity and Access Management platform. In this role you will contribute to a transition toward a modern Policy-as-Code authorization model, participate in an active dual-domain identity migration, and work within and evolve a hybrid RBAC/ABAC authorization model serving a global portfolio of customer-facing digital products.About the RoleAs Senior Software Developer, you will be a key technical contributor on a production IAM platform serving multiple internal engineering teams and end-customer organizations worldwide.This role is about contributing to a transition, not inheriting a steady state. The platform is actively evolving toward a modern Policy-as-Code architecture, decoupling authorization logic from application code, thinning JWT payloads, and enforcing Zero Trust principles at the gateway layer. You will help shape the roadmap and build the technical foundation the team executes against. That said, you will be operating within a production enterprise identity platform at scale.What You'll DriveArchitectural Evolution and Policy-as-Code DirectionContribute to the platform's evolution toward a thin-token, policy-as-code authorization model where JWTs carry identity context rather than encoded permissions and a dedicated policy engine becomes the authoritative evaluation layer. This is an active direction, not a completed migration. You will help scope the roadmap, sequence the work, and support consuming teams through the transition.Participate in an active dual-domain migration for the identity platform, including reverse proxy configuration, dynamic issuer handling, and ensuring downstream resource servers can validate tokens across both issuer values without regression.Authorization Model DevelopmentWork within and evolve a hybrid RBAC/ABAC authorization model built around a user, role, customer, and application authorization tuple, including platform-defined baseline roles, customer-scoped composite roles, and application-defined custom role patterns.Help identify and address security misconfigurations in how consuming teams integrate with the platform, ensuring authorization is evaluated against customer context, not flat role presence in a token.Developer Experience and Integration EnablementContribute to Golden Path integration patterns for the engineering teams building on top of the platform, covering OAuth2/OIDC client registration, PKCE, identity provider hints, step-up authentication, redirect URI strategy, and token validation for Angular and React applications.Platform Operations ConsoleHelp drive an internal operations and governance UI from its current prototype state to production. The tool serves platform operators, security engineers, and compliance teams across modules including application management, role management, user management, customer hierarchy, MFA configuration, enterprise SSO federation, authorization policy authoring, and audit logs. The goal is reducing manual, ticket-based admin work.Security, Compliance and RiskContribute to technical controls mapped to SOC2 CC6 and NIST 800-53 in alignment with Zero Trust principles. Support business-risk framing of architectural decisions and technical debt for leadership audiences, covering compliance exposure, audit risk, and real-time access control gaps.What You BringRequired7+ years in software engineering with demonstrated experience in complex, multi-team platform environmentsStrong hands-on proficiency with Java and Spring Boot in a production microservice contextSolid understanding of software development lifecycle practices including CI/CD, code review, testing strategy, and release managementFoundational understanding of security principles — authentication, authorization, token-based identity, and secure API designExperience working with or integrating against an identity provider (Keycloak, Okta, Auth0, Entra ID, or similar)Familiarity with OAuth 2.0 and OIDC concepts including authorization code flow, PKCE, and JWT structureAbility to communicate technical decisions clearly to both engineering peers and non-technical stakeholdersStrongly PreferredHands-on experience with Keycloak or a comparable open-source identity provider, including realm configuration, client scopes, protocol mappers, IdP federation, and the Admin REST APIExperience with a production authorization policy engine and a point of view on decoupling policy from application codeExperience designing IAM for multi-tenant SaaS, including JWT size constraints, token claim strategy, and downstream performance tradeoffsPractical experience with API gateway security and policy enforcement at the edgeSAML 2.0 federation and enterprise SSO integration with providers such as Microsoft Entra ID or OktaSOC2 Type II audit preparation and NIST 800-53 control mappingFamiliarity with NIST 800-207 Zero Trust Architecture principlesNice to HaveExperience with TOTP enforcement and MFA patterns for privileged accessReverse proxy configuration for multi-domain identity routingFrontend prototyping experience for operator tooling (Angular or React)Experience writing authorization policy expressions against principal and resource attributesIntegration testing experience for auth flowsPrior work on developer-facing platforms, including writing integration guides and reviewing PRs for auth correctnessWhy This RoleThis is not a commodity IAM deployment. It is a purpose-built platform with a nuanced authorization model that has real compliance and security implications across Xylem's entire digital portfolio. The person in this role will be contributing to architectural decisions that affect how dozens of engineering teams authenticate users, enforce fine-grained access, and satisfy audit requirements for a global water technology company.Join the global Xylem team to be a part of innovative technology solutions transforming water usage, conservation, and re-use. Our products impact public utilities, industrial sectors, residential areas, and commercial buildings, with a commitment to providing smart metering, network technologies, and advanced analytics for water, electric, and gas utilities. Partner with us in creating a world where water challenges are met with ingenuity and dedication; where we recognize the power of inclusion and belonging in driving innovation and allowing us to compete more effectively around the world.At Xylem, you'll not only contribute to solving water issues but also have the chance to make a difference through our paid Volunteer Program, Xylem Watermark. We prioritize our employees' well-being through inclusion and belonging as well as our Employee Resource Groups (ERG).Proud to be an Equal Employment Opportunity (including disability and veterans) and Affirmative Action workplace, Xylem fosters an inclusive environment free from discrimination or harassment. Please note that the information in this job description outlines the general nature of the position and is not an exhaustive list of duties. Xylem is dedicated to providing reasonable accommodations to enable all employees to perform their essential job functions. We reserve the right to modify this job description and assign additional duties as needed. Embrace the opportunity to be part of Xylem's transformative journey in shaping the future of water technology! #XylemCareers #GlobalImpact #WaterInnovation SummaryLocation: Charlotte, North Carolina; Morrisville - Perimeter Park; Morrisville, North Carolina (Office); Yellow Springs, Ohio; Morton Grove, Illinois; Yellow Springs 1710; Yellow Springs 1725Type: Full time