Senior Software Engineer

Profile: Full-stack Engineer - Portals & Identity

Role: Technical owner of the RNHB portals, leading the replacement of the current identity provider and driving further development.

First assignment - identity provider replacement:

• Leads the migration of the current IdentityServer-based IdP to a new solution (e.g., Entra External ID / Duende / OpenIddict), and helps substantiate that choice.

• Designs and delivers OIDC/OAuth2 flows (authorization code + PKCE, refresh, logout/sessions), federation for intermediaries, IDIN (or a replacement) login for customers, MFA/passwordless, impersonation and e-mail verification, with no loss of current functionality.

• Security assurance: threat modelling, OWASP, secrets / Key Vault / Managed Identity, GDPR/consent.

Beyond that first assignment:

• Technical owner of the portals: further development, incidents and hotfixes, performance and security.

• A driving role: prioritising with the business, aligning with architecture, guiding (external) developers, reviewing PRs, and safeguarding the reference architecture (DDD/CQRS, BFF, CDM contracts, event-driven).

• Structuring the handover from the current vendor (knowledge, pipelines, runbooks). • Delivering through our DTAP chain (build-once, PR review, branch deploys).

Must-have (5+ years, demonstrably full-stack, in order of importance):

• Frontend: Next.js / React / TypeScript (App Router, SSR/ISR, headless CMS - Contentful), Tailwind, accessibility and performance of public sites.

• Identity: strong OIDC/OAuth2/SAML knowledge, and has led at least one IdP migration (IdentityServer to Entra External ID / Duende / OpenIddict or comparable).

Experience with federation, IDIN/eHerkenning-style external login, session and token management, Entra ID and Microsoft.Identity.Web.

• Backend: .NET/C#, ASP.NET Core, DDD/CQRS, BFF pattern, Azure Service Bus, Cosmos DB, MediatR/FluentValidation.

• Platform: Azure (App Service, APIM, Key Vault), Terraform, GitHub Actions, App Insights.

• Has led or coordinated a small team or a vendor; can explain architectural choices and enforce them in code review.

• Security-minded in a regulated environment (AFM/DNB/GDPR): OWASP, least privilege, secrets hygiene.

Nice-to-have:

• Mortgage or financial domain knowledge, monorepo experience, Contentful, SonarCloud/CodeQL, Playwright/E2E regression, ArchiMate/EA (BlueDolphin). Person:

• Takes initiative and ownership, comfortable being the point of contact for portals and identity.

• Pragmatic (maintainability over cleverness), strict on quality and security. • Strong communicator.

We are looking for hands-on OIDC/OAuth2 experience and ideally someone who has led an IdP migration (IdentityServer to Entra External ID / Duende / OpenIddict or comparable).

Also, the frontend experience should be: Next.js / React / TypeScript.