Data Acquisition and Control Platform Architect (m/f/d) ID26814 -0

Data Acquisition and Control Platform Architect (m/f/d) ID26814 -0

Project Description

• Architecture engagement to define and validate a modern frontend/backend architecture for an on‑premise data acquisition and control platform.
  
• Scope: on‑premise, isolated network deployment using services such as Docker, Nomad, Consul and Ansible (without Kubernetes), compatible with future multi‑node clusters.
  
• Design of an end‑to‑end architecture for Modbus and non‑Modbus data ingestion, transformation, storage (e.g. InfluxDB v3 and Postgres or comparable time‑series and relational databases) and exposure via APIs and web frontend.
  
• Definition of the target backend application architecture and its logical building blocks (e.g. device IO, transformation, configuration, gateway/API), with clear responsibilities and boundaries.
  
• Design of the API layer (REST), including resource model, versioning strategy, error model and contract governance.
  
• Design of the authentication and authorization model, integrating LDAP/OpenLDAP and a dedicated identity provider (e.g. Keycloak) using OpenID Connect for user authentication and OAuth2 access tokens for API and service -to -service authorization.
  
• Definition of RBAC and authorization concepts for operators, admins, partners and technical services, including role/permission matrix and token/claims usage.
  
• Specification of secure credential and secrets management: tools such as Ansible Vault, certificates/PKI, Modbus credentials, database credentials and API tokens.
  
• Definition of the data model and persistence strategy across time‑series and relational data stores.
  
• Development of a target deployment and infrastructure architecture that starts with a single -node dev/lab PoC and can grow to a small on -prem cluster.
  
• Evaluation and introduction of container orchestration tooling (e.g. Nomad) as well as service discovery and service -mesh tooling (e.g. Consul/Consul Connect).
  
• Design of an observability concept: metrics, logging, tracing, dashboards and alerts using tools such as Prometheus, Grafana, and Alertmanager.
  
• Delivery of a refined, consistent set of architecture documents, decision records and an implementation roadmap.
  

Tasks

The external consultant takes on the following tasks within the project, which are carried out independently:

• Facilitate workshops with stakeholders (engineering, operations, security) to clarify requirements and constraints for the new architecture.
  
• Derive and document the target logical decomposition of the backend (device IO, transformation, configuration, gateway/API) and key workflows (read/write cycles, scheduling, backpressure, retries).
  
• Design API contracts and the resource model for operators, external systems and internal callers; capture these in OpenAPI and architecture diagrams.
  
• Define end‑to‑end authentication and authorization flows, including integration with LDAP/OpenLDAP and Keycloak, OpenID Connect login flows, and OAuth2 -based access tokens.
  
• Design secrets and certificate management based on tools such as Ansible Vault and existing PKI processes.
  
• Specify the data model for devices, registers, measurements, configuration, alarms and historical events, mapping it to appropriate time‑series and relational databases.
  
• Define deployment topology and evolution path: from a single‑node dev/lab PoC to a small on‑prem cluster using container orchestration (e.g. Nomad) and service‑mesh capabilities (e.g. Consul).
  
• Define non‑functional requirements and architecture tactics for resilience, failover, backup/restore and scaling strategies.
  
• Design an observability baseline including metrics, logging, tracing and standard dashboards.
  
• Propose a test and quality strategy at architecture level (test pyramid, integration and E2E scenarios, migration validation).
  
• Produce and maintain key architecture artefacts: architecture overview, cluster diagrams, architecture decision records (ADRs) and an implementation roadmap.
  
• Provide guidance and guardrails for developers: coding and architecture patterns, module/service boundaries, error handling and API standards.
  
• Identify technical and delivery risks (e.g. auth complexity, module boundaries, observability gaps) and document mitigations.
  

Skills & Qualifications

• Strong experience as Solution or Software Architect for on‑prem, backend‑heavy systems (data platforms or industrial/OT integrations).
  
• Deep understanding of modular backend architectures and API design, including versioning, error models and contract management.
  
• Experience designing architectures around containerised workloads using Nomad and Consul (or similar orchestrators/service discovery tools).
  
• Solid knowledge of authentication and authorization: LDAP/OpenLDAP integration, Keycloak (or similar IdPs) with OpenID Connect and OAuth2, RBAC design and token/claims‑based access control.
  
• Experience designing security and secrets management in on‑prem environments, including TLS/mTLS, PKI concepts and tools such as Ansible Vault.
  
• Familiarity with time‑series and relational databases (e.g. InfluxDB v3 and Postgres), including backup/restore and data modelling.
  
• Understanding of observability practices and tooling (e.g. Prometheus, Grafana, Alertmanager, logging stacks, distributed tracing).
  
• Ability to write clear architecture documentation, decision records and diagrams.
  
• Excellent communication and facilitation skills for workshops and stakeholder alignment.
  
• Experience with industrial protocols (Modbus) and edge/OT data scenarios is a strong plus.
  
• Experience with on‑premise deployments in isolated networks.
  
• Language: English (fluent), German is a plus.