Principal System Engineer

Backbase; Toronto; On-site; CAD 140,000 - 210,000; Full time

Job summary

Backbase in Canada is seeking a seasoned Principal System Engineer to drive engineering excellence in a regulated banking environment. You will shape technical direction, ensure platform reliability, and guide cross‑functional teams through complex cross‑layer challenges.

You will mentor engineers, champion DevSecOps practices, implement IaC, and enforce security controls such as RBAC, mTLS, and audit trails while maintaining high performance and compliance standards.

Qualifications

• Senior-level experience designing scalable, compliant banking infrastructure.
• Proven ability to lead cross‑functional engineering teams.
• Hands‑on expertise with cloud-native platforms and CI/CD security gates.
• Strong knowledge of PCI‑DSS, GDPR, SOC 2 controls.
• Experience with incident management and RCA processes.

Responsibilities

• Architect and operate scalable, highly available infrastructure on Azure Kubernetes.
• Drive reliability by implementing SRE practices, error budgets, and incident response.
• Build secure CI/CD pipelines with GitHub Actions, ArgoCD, and IaC tooling.
• Enforce least privilege, mTLS, key vaults, and audit trails across services.
• Mentor engineers and govern architecture reviews and security reviews.

Skills

Kubernetes (self-managed)

Azure

Linux administration

Java & Spring Boot

Observability tooling

Distributed systems design

Security best practices

Communication

Tools

Istio service mesh

GitHub Actions

ArgoCD

Helm

Terraform

SonarQube

Dependency-Track

Job description

About the Role We are seeking a seasoned, hands-on Principal System Engineer to act as a technical vanguard and drive engineering excellence across our organization. Operating in a highly regulated banking environment, you will be the driving force behind our strategic technical direction, platform reliability, and system resilience. This is an influential role where you will balance the hands‑on resolution of complex, cross‑layer challenges with proactive architectural innovation. You will mentor engineering teams, foster cross‑departmental collaboration, and ensure our distributed systems meet the absolute highest standards of compliance, security, and performance.

What You Will Do

Architect & Operate at Scale: Design, build, and maintain highly available infrastructure using self‑managed Kubernetes on Azure. You will manage distributed architectures, stateful sets, database configurations, and advanced resilience patterns (circuit breakers, Istio traffic shifting).

Drive Reliability & SRE Practices: Anticipate operational bottlenecks, define error budgets, conduct chaos engineering, and implement proactive scaling policies. You will own P0/P1 incident management from rapid cross‑layer triage through to blameless Root Cause Analysis (RCA) and permanent mitigation.

Champion DevSecOps & Automation: Build and manage automated, compliance‑aligned CI/CD pipelines utilizing GitHub Actions, ArgoCD (GitOps), and Helm. You will enforce strict quality and security gates (SonarQube, Dependency‑Track) and champion Infrastructure as Code (Terraform).

Ensure Enterprise Security & Compliance: Navigate stringent financial regulations (PCI‑DSS, GDPR, SOC 2, ISO 27001) by embedding secure SDLC processes. You will implement least privilege access (RBAC), mTLS, secret management (Azure Key Vault), network segmentation, and robust audit trails.

Lead & Mentor: Advocate for technical standards, conduct architecture and secure code reviews, and actively mentor other system engineers. You will act as a calm, authoritative technical voice during outages and serve as a strategic consultant to both technical and business stakeholders.

What You Bring to the Team

Cloud Native Mastery: Expert‑level production experience with self‑managed Kubernetes, Azure services, advanced Linux systems administration, and deep network routing/troubleshooting.

Service Mesh & Networking: Expert configuration and operation of Istio Service Mesh (traffic management, mTLS, fault injection) and deep proficiency in DNS management (A, CNAME, SRV, SPF, DKIM).

Java & Performance Tuning: Strong ability to read, modify, and optimise Java/Spring Boot microservices. You bring hands‑on expertise in JVM memory tuning, heap sizing, and Garbage Collection (GC) analysis within containerised limits.

PKI & Security: Deep practical knowledge of Public Key Infrastructure (PKI), certificate lifecycles, revocation, and security enforcement across distributed environments.

Comprehensive Observability: Expertise utilizing Prometheus, Grafana, OpenTelemetry, and logging stacks (Loki/ELK) to drive data‑informed platform stability.

Systematic Debugging: Proven ability to dive deep into complex outages using distributed tracing, JVM debugging (heap/thread dumps), and infrastructure tools (kubectl, Envoy logs).

Communication: Professional fluency in written and spoken English, with the presence and clarity to explain complex technical remediation to developers, security auditors, and executive management.