Senior Backend Engineer — Authentication & Security Platform (Digital Bank)

Location requirement

You must already be living in Japan with valid work authorization. We are not sponsoring relocation or visa transfers from overseas for this role. Applications from outside Japan will not be considered.

About Abbeal

Abbeal is an international IT consulting firm (France, Japan, Canada) placing senior engineers on high-impact product teams. Through Abbeal, join the Authentication & Authorization platform of an FSA-regulated digital bank launching in Japan.

The Context

We support an FSA-regulated digital bank launching its platform in Japan. You will join the team building the Authentication & Authorization foundation: OAuth 2.0/OIDC login, token lifecycle and identity management across four banking channels (officer dashboards, customer apps, BaaS APIs, third-party integrations). The team is distributed across Japan, Vietnam and India; the role is anchored on Tokyo with a remote-friendly setup. English is the working language — Japanese is not required.

What You Will Build

• Token lifecycle — DPoP-bound access tokens, silent refresh, session management
• Passkey / FIDO2 — WebAuthn registration and login flows, step-up authentication
• mTLS integrations — certificate-based service-to-service auth with external financial platforms
• Shared security library — Spring Boot starter providing standardized auth filters
• Integration testing — Karate-based suites covering all auth flows at scale
• Monitoring — auth event observability, anomaly detection, audit trail completeness

What We Are Looking For

• 10+ years in server-side backend engineering, including 5-7 years in Kotlin or Java + Spring Boot
• Spring Security (filter chains, OAuth2 Resource Server) and strong OAuth 2.0 / OIDC knowledge
• At least one of DPoP, mTLS, PKCE, FIDO2 / WebAuthn — plus JWT (claims, JWKS, key rotation)
• Redis (sessions, distributed locking, caching) and PostgreSQL (schema design, migrations)
• AWS (ECS/Fargate, Secrets Manager) and Terraform or equivalent IaC
• Strong understanding of the OWASP Top 10 and secure web application development
• Professional English (working language); Japanese not required

Nice to Have

• Currently based in Japan with valid work authorization — no relocation or visa sponsorship from overseas for this role
• Authlete; FAPI 2.0 Security Profile; Microsoft Entra ID; Cloudflare / Akamai (mTLS termination, WAF)
• Fintech / regulated banking background (FSA, maker-checker, audit logging); Japanese ability

Why This Role

A real FSA-supervised bank — cutting-edge security standards (FAPI 2.0, DPoP, WebAuthn/FIDO2), high ownership of entire authentication channels, global collaboration on a greenfield platform.

Compensation and Setup

Permanent role, anchored on Tokyo, distributed team, remote-friendly. Indicative range ¥8M–¥17M/year depending on experience. Hired and supported by Abbeal (visa sponsorship + Mobbeal expat support); relocation support possible depending on profile.