Principal Engineer

About this role

SPRINGBROOK SOFTWARE Initiative Cirrus · Role Description Principal Engineer Cirrus · Principal · .NET 10 / Angular / Azure Level Principal — top of the individual-contributor engineering ladder Reports to Head of Engineering Direct reports None. Influence is through standards, reference implementations, review and reasoning. Scope Cross-cutting technical ownership across the Cirrus platform rather than a single product area. Hands-on balance Roughly 40-50% writing production code; the remainder on design review, standards, arbitration and technical mentoring. Role overview Cirrus is the platform that unifies Springbrook's 15+ acquired government-software products into one experience — a personalized Home Portal, a .NET backend-for-frontend aggregating two dozen module APIs, centralized identity and user management, a unified API management edge, and automated customer provisioning. Local governments run their utility billing, receivables, cashiering, permitting and general ledger on it. The architecture we set now holds for years. The Principal Engineer is the deepest technical seat on the individual-contributor ladder and is deliberately not embedded in one product area. The value is in seeing across all of them and stopping several teams from inventing several different answers to the same question. You own the .NET standards, the shared contracts and the service boundaries that everyone else builds within. This is not an advisory seat. Authority here is earned by shipping: the principal who cannot write the reference implementation, or who reviews by verdict rather than by reasoning, will be routed around within a quarter. You take the hardest cross-cutting workstreams personally — the migrations, the performance problems, the defects nobody else resolved. Engineers at every level of experience build within the standards you set. That is both the leverage and the constraint of the role: a standard has to be usable without you in the room, and the reasoning behind it has to be written down rather than held in your head. Scope of ownership .NET standards — FastEndpoints, FluentResults, Clean Architecture, error handling, logging, configuration and observability conventions used by every team. Shared contracts — API and event contracts between teams and between the platform and the acquired module teams, including versioning and backward compatibility as products modernize at different rates. Service boundaries — where a capability lives, what it owns, and what it must never reach into. Cross-team design review, early enough to be useful and late enough not to design by committee. Build-versus-reuse arbitration — when a team builds its own and when it consumes a shared primitive. Identity, authorization and tenancy correctness at the architectural level across Auth0, Azure API Management and the service layer, where mistakes are security incidents rather than defects. Legacy modernization sequencing — the technical plan for bringing .NET Framework and PHP components onto current supported runtimes without interrupting customer operations. The technical bar, and the reference material and written reasoning that let any engineer reach it. Responsibilities Architecture and standards Define and document the target architecture, including migration sequencing, risk and rollback plans. Make and defend build-versus-refactor-versus-replace decisions with written trade-off analysis; produce architecture decision records for material choices. Set the standard for API design, service boundaries, authentication, authorization and inter-service contracts. Determine when a workload belongs on App Service, on Azure Functions, or on a VM, accounting for cost, cold-start behaviour, compliance and operational burden — and say honestly where serverless is the wrong choice. Guide EF Core and Dapper data design against Azure SQL for correctness and performance at scale: no N+1s, no accidental cross-tenant reads, no surprise table scans. Shape the messaging and integration backbone — Azure Service Bus events between the platform and the acquired module teams — and keep those contracts versioned and backward-compatible. Own multi-schema and multi-tenant data design patterns, and the approach to migrating live production data safely. Hands-on engineering Write the reference implementations teams copy rather than reinvent, and keep them current — a stale reference is actively harmful. Personally lead the hardest workstreams: the migrations, the performance problems, and the defects nobody else has resolved. Author and tune SQL against Azure SQL, SQL Server and MySQL; diagnose execution plans, deadlocks and slow-query regressions. Work across the stack when a cross-cutting pattern needs to exist in the Angular 19 or Blazor front end too. Instrument and diagnose across service boundaries where no single team owns the failure, and lead escalated incident response and root-cause analysis. Technical influence and mentoring Run design review as teaching, not gatekeeping — explain the reasoning so the next decision does not need you. Raise the capability of the engineers around you at every level, and make the route to greater technical scope concrete and written rather than implied. Arbitrate build-versus-reuse with a written rationale each time, so the precedent is reusable. Distribute deep knowledge deliberately — pairing, design notes, internal documentation — so no critical area depends on one person. Communicate technical risk and trade-offs clearly to engineers and to non-engineering stakeholders. AI-augmented engineering process Own the architectural context assets that make AI tooling effective across teams: repository instruction files, domain and architecture context documents, reusable prompts, custom agents encoding Springbrook conventions. Apply AI systematically to legacy code comprehension across the acquired estate — documentation, call graphs and behavioural summaries for undocumented .NET and PHP code, so the team can modernize what nobody currently understands. Drive AI-assisted bulk migration: framework upgrade transformations, dependency remediation, syntax modernization and SQL dialect translation between MySQL and Microsoft SQL Server, with human verification gates at each step. Define and enforce the review policy for AI-generated code — what must be human-reviewed, what may be auto-merged, how provenance is tracked, and how hallucinated APIs, insecure patterns and silent behaviour changes get caught. Set boundaries consistent with Springbrook's obligations: no customer or personally identifiable data in prompts to non-approved services, license and provenance awareness, documented tool approval. Measure and report the impact — throughput, defect and escaped-defect rate, review latency, coverage gain — so AI adoption is defended with evidence rather than enthusiasm. Technical environment Backend C# / ASP.NET Core on .NET 10. FastEndpoints, FluentResults, Clean Architecture, service-oriented (non-CQRS) designs. Legacy .NET Framework and PHP components remain across the wider Springbrook estate. Front end Angular 19 and Blazor with TypeScript. React in surfaces inherited from acquired products. Data Azure SQL with EF Core and Dapper. Microsoft SQL Server and MySQL across the legacy estate. Multi-schema, multi-tenant data design. Cloud Microsoft Azure — App Service, Azure Functions, Service Bus, Redis, Blob Storage, Key Vault, VNet, Application Insights and Log Analytics. Identity & edge Auth0 for identity, Azure API Management as the unified API edge, centralized user management across 15+ acquired applications. Testing Playwright for end-to-end, xUnit / Moq / Shouldly / Respawn for .NET, contract testing and BDD / specification-by-example, all enforced in CI. Delivery Azure DevOps CI/CD today, migrating toward GitHub (including GitHub Actions) and Jira. Infrastructure as code via Bicep / ARM or Terraform. AI tooling GitHub Copilot, Claude Code, Cursor or equivalent used daily, with repository instruction files, architectural context documents, reusable prompts and custom agents encoding Springbrook conventions. What we're looking for Depth 10+ years building production software, with several years of technical ownership spanning multiple teams. Deep C# / .NET expertise spanning legacy .NET Framework through current .NET (8/9/10), including ASP.NET MVC to ASP.NET Core migration patterns. Distributed systems judgment — you know how they fail, and how to build ones that do not. Strong SQL Server and Azure SQL fundamentals: relational modelling, indexing, execution plans, deadlocks, low-downtime migrations on live data. MySQL exposure is valuable given the legacy estate. Hands-on Azure across compute, serverless, storage, networking, Service Bus, API Management and Key Vault. Working proficiency in Angular / TypeScript and Blazor, sufficient to review code, set standards and contribute directly. Identity and authorization depth: OAuth 2.0 / OIDC, Auth0, token handling, and multi-tenant authorization design that survives an audit. Security practice: secure coding, threat modelling, OWASP, secrets management and least-privilege design. Track record At least one completed legacy modernization or major version upgrade owned end to end — before state, migration approach, measured outcome. Demonstrated design of multi-tenant SaaS where tenant isolation and authorization boundaries were a first-class concern. Standards you set that were actually adopted, and a clear account of how adoption was achieved rather than mandated. Evidence of having raised other engineers' capability, across more than one level of seniority. AI-assisted engineering — required Demonstrated daily working use of AI coding assistants and agentic development tools on production code, with specific delivered work to point to. Strong prompting and context engineering on large legacy codebases: repository context, instruction files, task decomposition. Sound judgment about AI limits — able to identify hallucinated APIs, plausible-but-wrong logic, insecure generated patterns, and output that should be discarded. Experience introducing AI tooling to a team: standards, review policy, change management — not solely individual use. Comfort integrating AI into automation: CI checks, automated review, test generation, or internal developer tooling built on LLM APIs. Judgment and communication Clear technical writing — design documents, decision records and migration plans that survive review. Ability to defend a decision with reasoning and trade-offs, invite challenge, and be moved by a better argument. Comfort disagreeing with a senior voice when the evidence supports it, and doing so without theatre. Bonus FastEndpoints, .NET Aspire, Clean Architecture and service-oriented (non-CQRS) designs. Payments depth — tokenization, idempotency, exactly-once effects over at-least-once delivery, reversal and compensation, reconciliation to the penny. PCI DSS as an implementer: CDE scoping, segmentation, secure SDLC requirements, evidence a QSA assessment consumes. Government / public-sector, ERP or multi-tenant SaaS experience where correctness is non-negotiable. Building with generative AI — integrating LLMs, RAG or AI agents into product features, beyond using an AI code assistant. How we work, and who thrives here We are not looking for someone who waits to be handed a fully specified problem. We are looking for an engineer who can take an ambiguous one, reason about it critically, choose a defensible path, and own the outcome end to end — and who can then explain the reasoning well enough that someone else could have made the same call. Ownership. You own work from problem statement to production and beyond. When something you built breaks at 2 a.m., you want to know why, and you want to fix the root cause rather than paper over it. Accountability. You hold yourself to the standard before anyone else has to. You say what you will deliver, deliver it, and flag risk early and honestly when reality changes. Self-starter. You find the next most valuable thing to do and start it. Blockers are problems you drive to resolution, not reasons to stop. Independent critical thinking. You question assumptions, including your own and ours. You can defend a technical decision with reasoning and trade-offs, disagree with a senior voice when the evidence supports you, and change your mind when it does not. Creativity. You bring options to the table, not just problems. You find the simple design hiding inside a complicated requirement, and you are willing to challenge how it has always been done. What this role is not A non-coding architect. Reference implementations are part of the deliverable. A people manager. This is an individual-contributor role with no reports. A gatekeeper whose approval is a queue. Standards must be adoptable without you in the room. A team lead. The role is cross-cutting by design rather than owning one product area. Springbrook Software — role description for Initiative Cirrus. Skill sets derived from the Cirrus role descriptions; engineering, modernization and AI-augmented-delivery expectations derived from the Springbrook Technical Role Specifications (25 August 2026).

Key Responsibilities

• Platform technical ownership
• Define engineering standards
• Define service boundaries
• Write production code
• Own legacy modernization sequencing: moving .NET Framework/PHP components to current runtimes without interrupting customer operations.

Requirements

Must have

• 8–11 years of experience