Help us shape the next-generation identity provider for Germany’s healthcare telematics infrastructure (TI). You will enable millions of people covered by statutory health insurance to access digital healthcare services securely. This is a security-critical, regulated platform built on Java 25 and Spring Boot 4.1. It provides production-ready OAuth 2.0/OIDC identity services and hardware-backed cryptography, and runs cloud natively on Kubernetes in sovereign German cloud environments.
As a Solution Architect, you will be responsible for the target architecture of the entire platform: from its domain-driven modular architecture (modulith) and its evolution towards a hexagonal architecture, to the multi-tenant platform topology for Germany’s largest statutory health insurers, and the translation of gematik specifications into an auditable, audit-ready system design.
Your responsibilities will also include:
Owning the end-to-end solution architecture: the backend modulith, event-driven integration, data architecture and multi-tenant Kubernetes topology (active/active across multiple data centers), including tenant onboarding and capacity planning and scaling for new customers
Evolving the architecture from a modulith towards a hexagonal architecture, including defining domain boundaries, migration steps and architecture fitness functions (ArchUnit)
Designing the identity and security architecture: OAuth 2.0/OIDC flows, token security, HSM-backed key management and Trusted Execution Environments (VAU) to protect personally identifiable information (PII)
Translating gematik specifications into a compliant, testable architecture and representing it to regulators, auditors and customer architects
Owning the Architecture Decision Records (ADR) process and ensuring that documentation based on arc42 and the C4 model remains up to date and authoritative
Mentoring senior engineers across backend, DevSecOps, mobile and testing, working closely with the Principal Architect, program management, SRE and security engineering. Architecture is seen as a supportive, enabling function—not an isolated “ivory tower.”
Your profile
Java and Spring Boot ecosystem (currently Java 25 / Spring Boot 4.1)
OAuth 2.0/OIDC and IAM architectures
Domain-Driven Design (DDD), hexagonal architecture and modulith patterns
Kubernetes and cloud-native architectures
PostgreSQL and Apache Kafka
Architecture documentation (ADRs, arc42, C4)
CI/CD and Git
Experience with digital healthcare identities (gematik, eGK, eID)
eIDAS and OpenID Federation 1.0
HSMs and applied cryptography
Confidential computing (e.g. SGX, VAU)
Sovereign cloud environments (OTC, T-Cloud Sovereign)
Threat modeling
At least eight years of software development experience, including several years with explicit architectural responsibility for production backend platforms
Hands-on experience designing IAM systems. You should have a command of OAuth 2.0/OIDC at the architecture and design level, not just from an integration perspective
A proven track record in evolutionary software architecture, particularly decomposing or modularizing established production systems without interrupting ongoing operations
Experience in regulated or security-critical environments, including translating complex specifications into precise, auditable solution designs
Strong communication skills: documenting architectural decisions clearly and building a shared understanding with developers, auditors and customers
Fluent written and spoken English. German is a strong advantage, as some gematik specifications and compliance documents are available only in German
About T-Systems International GmbH
At T-Systems, we provide our business customers with the right system solutions for their digital business. Our portfolio helps ensure that digital transformation reduces complexity, saves costs and makes everyday work easier. Our focus areas are connectivity, digital, cloud and infrastructure, and security. Let’s power higher performance!
Is this the right role for you? Take the next step and apply online. We look forward to hearing from you!
This position is also available part-time.
People with severe disabilities will be given preference where candidates are equally qualified.
Alle Stellenanzeigen unterliegen den Allgemeinen Geschäftsbedingungen von GrabJobs. Wir erlauben Benutzern, Beiträge zu kennzeichnen, die möglicherweise gegen diese Bedingungen verstoßen. Stellenanzeigen können auch vom GrabJobs-Moderationsteam gekennzeichnet werden. Allerdings ist kein Moderationssystem perfekt und das Markieren eines Beitrags stellt nicht sicher, dass er entfernt wird.
Seien Sie der Erste, der die neuesten Others Full-Time-Jobs in Germany erhält.
Richten Sie Ihre Jobbenachrichtigung ein:
Durch die Aktivierung von Jobbenachrichtigungen stimme ich den Nutzungsbedingungen und der Datenschutzerklärung von GrabJobs zu. Ich kann die Jobbenachrichtigungen jederzeit abbestellen.
Überspringen
Sie haben die maximale Anzahl an Jobbenachrichtigungen erreicht.
GrabJobs ist das führende Jobportal in Germany und verbindet Sie schnell mit Tausenden von -Jobs!
Finden Sie die besten -Jobs in Germany, bewerben Sie sich mit einem Klick und sichern Sie sich noch heute einen Job!
Ihre E-Mail-Jobbenachrichtigung ist jetzt aktiv!