API Gateway Architect (Apache APISIX)

Purpose: Own the API gateway tier, which is the single ingress point for external traffic across the platform. The gateway terminates device trust, enforces authorisation, applies rate limiting and quota policy, and carries traffic between external consumers and the platform subsystems. Apache APISIX is the selected platform, with Kong retained as a documented fallback. Key Responsibilities: - Define the API gateway architecture including deployment topology, control plane and data plane separation, configuration store, and high availability posture across primary and disaster recovery sites - Design route, upstream and plugin configuration as versioned code deployed through GitOps rather than console or admin API state - Terminate mutual TLS for field device trust at the gateway, validating device certificates against the device registry with defined behaviour for unknown, expired or revoked certificates - Integrate authorisation enforcement with Keycloak for token validation, introspection strategy, and claim-based routing and access decisions - Define rate limiting, quota and traffic shaping policy per consumer class including partner organisations, internal subsystems, field devices and public channels - Develop custom plugins where platform requirements are not met by standard plugin sets and establish standards for plugin development, testing and packaging - Define API lifecycle and versioning policy across the platform including deprecation strategy and external consumer contracts - Integrate gateway telemetry with the platform observability stack for metrics, structured access logging and correlation identifier propagation - Package the gateway and configuration as parameterised Helm charts with externalised configuration for deployment - Produce operational runbooks covering routine configuration changes, certificate rotation, incident response and rollback - Develop nominated platform engineer to independent capability Essential Experience: - Apache APISIX in production at scale, or Kong at equivalent depth with demonstrable ability to transfer reasoning to APISIX - Gateway configuration managed declaratively as versioned code deployed through a pipeline - Mutual TLS termination at the gateway with client or device identity validated against an external registry - Integration of a gateway with an OpenID Connect provider for authorisation enforcement including token validation, introspection and access decisions at the edge - Rate limiting and quota design under real load with a considered position on behaviour during sustained overload - High availability gateway deployment on premise including failover posture and dependency on underlying data tier Desirable Experience: - Custom plugin development for APISIX or Kong using Lua or WebAssembly-based extensions - Nginx and OpenResty at a level sufficient to reason about gateway behaviour beneath the abstraction - Public sector or regulated API programmes with external partner consumers and formal API contracts - Field device fleets where device identity was enforced at the edge Term: 26 weeks. Location: Abuja with weeks 1-8 continuous on site; minimum one week on site per delivery thereafter. Reports to Technical Delivery Lead. Works closely with Identity & Security Architect and develops a nominated platform engineer.