Senior Software Architect

Born in the Netherlands in 1992, Maestronic is an independently owned global technology company headquartered in Vancouver, BC. We design, manufacture, and deploy the full ITS stack for buses, trams, rail, and wayside infrastructure — passenger information displays, CCTV and AI analytics, automatic voice announcements, passenger counting, vehicle communication gateways, and a proprietary cloud fleet management platform. Everything is engineered in-house, produced in our own factory, and backed by service agreements up to 12 years. Our systems are active on over 10,000 vehicles worldwide, chosen by some of the world’s top transit agencies. We are proud members of ITxPT, APTA, UITP, and CUTA, with offices across Canada, the USA, the Netherlands, Germany, Indonesia, Hong Kong, and China.

About the Role

As Maestronic scales its software platform to serve a growing portfolio of transit operators across North America and Europe, we are seeking a Senior Software Architect to own the end-to-end design of our software layer — backend services, fleet management systems, security architecture, and cloud infrastructure. This role operates at the software and systems level; our embedded hardware teams own firmware independently. You will define integration contracts, telemetry schemas, OTA pipelines, and security handshakes at the boundary with those teams. A general understanding of embedded and IoT systems is an advantage, not a requirement.

You must be comfortable with flexible hours to maintain regular overlap with our Bali engineering team (WITA, UTC+8) — typically late afternoon or early evening from Vancouver.

Responsibilities

• Own the end-to-end software architecture across backend services, fleet management, security, and cloud infrastructure — setting direction, resolving trade-offs, and maintaining consistency across the platform.
• Define and evolve integration contracts, telemetry schemas, and OTA update pipelines at the boundary between the software platform and embedded hardware teams.
• Lead security architecture across the software stack: access control, network segmentation, cryptographic key lifecycle, and compliance posture for regulated EU and North American markets.
• Architect scalable, high-availability multi-tenant services and data pipelines that meet the operational demands of large, geographically distributed transit fleet deployments.
• Establish and enforce engineering standards across the SDLC: from build pipelines and deployment gates to observability and incident response.
• Design integration patterns for ERP and third-party operational systems, ensuring clean boundaries and minimal coupling.
• Produce Architecture Decision Records and maintain living documentation that keeps distributed teams aligned and informed.
• Chair architecture review boards; evaluate vendors and tooling against platform needs and long-term supportability.
• Mentor engineers across Vancouver and Bali/Bandung, and represent the software architecture in technical discussions with European and North American transit customers.

Requirements

Qualifications & Experience

• Bachelor’s or Master’s degree in Computer Science, Software Engineering, or equivalent.
• 8–12+ years of software/system architecture experience with production deployments at scale.
• TOGAF 9.2 or TOGAF 10 certification; ITIL 4 is an advantage.
• Proven track record in architecting multi-tenant SaaS platforms with high availability and reliability at scale.
• Experience in regulated markets — public transit, smart city, utilities, or critical infrastructure in the EU or North America.

Backend & API

• Strong hands‑on depth across modern backend stacks: Node.js, Java (Spring Boot), .NET/C#, and Laravel/PHP.
• Solid understanding of microservices and distributed system design patterns: service mesh, API gateway, circuit breaker, and event sourcing.
• RESTful and GraphQL API design; gRPC for service-to-service communication; WebSocket and async messaging patterns.
• Familiarity with modern backend tooling: ORM frameworks, background job processing, and API documentation standards (OpenAPI/Swagger).

Frontend

• Solid working knowledge of modern frontend: React and Next.js (App Router), TypeScript, and component‑driven architecture.
• Understanding of state management patterns, SSR vs CSR trade‑offs, and frontend build tooling (Vite, Webpack or equivalent).
• Awareness of frontend performance, accessibility standards, and modern CSS approaches (Tailwind or equivalent).

Databases & Data

• Expert‑level PostgreSQL: schema design, partitioning, indexing, query optimisation, and replication for high‑transaction production systems.
• Experience with time‑series databases (TimescaleDB, InfluxDB) for telemetry and operational data workloads.
• Caching strategies and platforms (Redis or equivalent); familiarity with NoSQL patterns where applicable.
• Understanding of data modelling trade‑offs across relational, document, time‑series, and graph stores.

Cloud, Infrastructure & Observability

• Hands‑on experience across AWS, GCP, and Azure in multi‑cloud, multi‑region production environments.
• Docker, Kubernetes, and Helm; Infrastructure‑as‑Code and GitOps workflows.
• CI/CD pipeline design with automated quality and security gates.
• Observability platform design using Grafana alongside log aggregation and time‑series backends.

Security

• Threat modelling and zero‑trust network architecture across software and cloud layers.
• Cryptographic key management: HSM‑backed generation, rotation, and revocation.
• Identity federation: enterprise IdP platforms (e.g. Entra ID, Keycloak) and perimeter security.
• Compliance architecture for GDPR, NIS2, and public‑sector security standards.

Leadership & Communication

• Demonstrated ability to lead and mentor distributed engineering teams across time zones.
• Comfortable working flexible hours with regular overlap into Bali (WITA, UTC+8).
• Excellent written and spoken English for async documentation, architecture review, and client‑facing engagement.

Preferred

Fleet & Operational Systems

• Experience designing OTA update systems or large‑scale device lifecycle management platforms.
• Familiarity with ERP integration (Odoo or equivalent) for asset management and maintenance workflows.

Security Tooling

• Production experience with host‑based IDS and SIEM platforms (e.g. Wazuh) for monitoring and log aggregation.
• Working knowledge of encrypted mesh networking (e.g. WireGuard) and inbound‑portless remote access patterns.
• Privileged Access Management at enterprise scale (e.g. Teleport, HCP Boundary, or equivalent).

Standards & Compliance

• Familiarity with ITxPT, APTA, or UITP standards environments.
• RED‑DA and EU CRA compliance awareness.
• NIST CSF, SOC 2 Type II, ISO27001 compliance awareness.

Advantageous

• Knowledge of embedded Linux systems and SoC‑based platforms is an advantage.
• Understanding of hardware‑level security: secure boot chains, hardware security modules (HSM), TrustZone or equivalent TEE, and OTP fuse lifecycle management.
• Exposure to rugged or industrial‑grade product development — MIL‑spec, environmental certification, or long‑lifecycle hardware design.
• Practical familiarity with IoT communication protocols (MQTT, CoAP, BLE) — including QoS levels, retain/persistence semantics, and broker architecture.
• Experience with on‑device networking stacks (OpenWrt or equivalent) and understanding of edge networking patterns: local breakout, captive portal, and cellular failover.

#J-18808-Ljbffr