Senior Principal Engineer / Architect

Job title: Senior Principal Engineer / Architect

Location : New Jersey

Duration: Long term Contract

Apigee Edge, Amazon API Gateway, AWS, Terraform/CDK, Python, CI/CD

Domain: API platform modernization, cloud migration, AWS

Engagement scale: ~400 Apigee Edge proxies, ~5,000 APIs/operations, production workloads

Role Summary

We are looking for a hands-on API Gateway Architect Engineer to lead the design and delivery of a migration from Apigee Edge to Amazon API Gateway at enterprise scale. You will define the target-state architecture, build the migration factory and automation, and take the platform to production with zero or minimal consumer disruption. You must have done this before: real Apigee Edge to AWS migrations, not just greenfield API Gateway work.

Key Responsibilities

Architecture and design

- Define the target-state API platform on AWS: REST vs HTTP API selection per use case, regional vs edge-optimized vs private endpoints, custom domains, and base-path mapping strategy.

- Design a multi-account, multi-region topology (AWS Organizations, landing zone aligned) that respects API Gateway service quotas (APIs per region, resources/routes per API, stages, throttle limits) at 400 proxies / 5,000 APIs.

- Decide proxy-to-API grouping (one-to-one, consolidated by domain, or by business capability) and document the rationale, trade-offs and blast-radius implications.

- Design resilient, highly available patterns: active-active or active-passive multi-region, Route 53 health checks and failover, and DR with defined RTO/RPO.

- Integrate back ends via Lambda, ALB/NLB through VPC Link, PrivateLink, and on-prem connectivity (Direct Connect / Transit Gateway).

Apigee Edge assessment and migration

- Inventory and classify all proxies, shared flows, products, developer apps, KVMs, target servers, and environment configuration; identify dead, duplicate and low-traffic APIs for retirement.

- Map Apigee policies and constructs to AWS equivalents, for example: VerifyAPIKey / OAuth to usage plans, Cognito, JWT or Lambda authorizers; Quota / SpreadArrest to usage plans and stage/method throttling; AssignMessage / ExtractVariables / JavaScript to mapping templates, request/response parameter mapping, or Lambda; ServiceCallout to integrations or Step Functions; FaultRules to gateway responses; KVM to Parameter Store / Secrets Manager; flow hooks and shared flows to reusable authorizers, Lambda layers, and CI/CD templates.

- Build a repeatable migration factory: automated extraction of Apigee bundles, OpenAPI generation/normalization, templated IaC output, and automated validation.

- Plan and execute wave-based cutovers with traffic shifting (DNS weighted routing, canary stages, or CloudFront), rollback plans, and consumer communication.

Handle consumer-facing impact: API key and credential migration, OAuth client migration, hostnames, and backward compatibility.

Security

- Implement authentication and authorization patterns: OAuth 2.0 / OIDC, JWT validation, mTLS, IAM auth, and Lambda authorizers with caching.

- Apply AWS WAF (managed and custom rules), Shield, resource policies, TLS policy enforcement, and request validation against schema.

- Integrate with enterprise IdP, Secrets Manager, KMS, and Security Hub / GuardDuty. Support compliance needs (SOC 2, PCI, HIPAA, or equivalent).

Platform engineering and operations

- Deliver everything as code (CDK, Terraform, or CloudFormation/SAM) with API-first, OpenAPI-driven pipelines (CodePipeline, GitHub Actions, GitLab CI or Jenkins).

- Define governance: linting (e.g., Spectral), naming and versioning standards, contract testing, and automated security and policy checks in CI.

- Build observability: structured access logs, CloudWatch metrics and alarms, X-Ray / OpenTelemetry tracing, dashboards, SLOs, and log forwarding to the enterprise SIEM or Splunk/Datadog.

- Performance and cost optimization: caching, payload compression, throttling tiers, throughput load testing, and cost modelling (Apigee licensing vs AWS consumption).

- Replace Apigee Analytics and developer portal capabilities (usage reporting, API catalog, onboarding, key management) using AWS-native or portal tooling.

- Produce runbooks, support model, and knowledge transfer; mentor engineers and lead design reviews.