Senior Backend Engineer - Identity & Security

MANISH KHUNT

Senior Software Engineer

Simi Valley, CA 93063 · 805-***-**** · *****.******@*****.*** · linkedin.com/in/manishkhunt PROFESSIONAL SUMMARY

Senior backend engineer with 20+ years of software development experience, including 11 years at Nextiva building secure, multi-tenant SaaS for business communications. Specializes in Java/Spring Boot microservices, identity and access management (SSO, SCIM, OAuth2/SAML/OIDC), authorization design and application security. Earlier background in payments (EMV, PCI, card processor integrations) and embedded/systems programming gives depth from hardware and protocols up to cloud-native services. Uses AI agents (Claude Code) and the BMAD Method across the whole lifecycle: requirements analysis, design, development, test architecture, code review, and root-cause analysis of bugs and product issues.

TECHNICAL SKILLS

Languages & frameworks: Java 8–21, Spring Boot, Spring Cloud, Spring Security, Spring WebFlux, JPA/Hibernate, J2EE; earlier C, C++, C#/.NET, Assembly

Identity & security: OAuth2, OIDC, SAML, SCIM 2.0, JWT, Okta, Microsoft Entra ID, Google Identity, OpenDJ/LDAP, OpenAM, KMS, RBAC, PCI, PGP

Data & messaging: MongoDB, PostgreSQL, Oracle (SQL, stored procedures), BigQuery, Redis, Weaviate, Apache Kafka, RabbitMQ

Cloud & DevOps: GCP (GKE, BigQuery, Vertex AI), Kubernetes, Helm, Docker, ArgoCD, GitHub Actions, Jenkins, Nginx Quality & observability: JUnit 5, Mockito, AssertJ, Testcontainers, Cucumber, Datadog, ELK, Sonatype/Veracode Integrations: Oracle BRM, The Campaign Registry (10DLC), Bandwidth, Inteliquent, Nylas, Gmail API, Microsoft Graph, ISO 8583, EMV (VeriFone)

AI-assisted engineering: Claude Code (agentic coding), BMAD Method (PRDs, architecture, epics and stories, TEA risk- based test design, traceability and quality gates), adversarial AI code review, GitHub Copilot PR review, AI-assisted root-cause analysis, defect triage, incident reports and runbooks PROFESSIONAL EXPERIENCE

Senior Software Engineer Nextiva Aug 2021 – Present Contact-Center Platform 2024 – Present

Java 21, Spring Boot, Spring Security, MongoDB, BigQuery, Kafka, Redis, GCP/GKE, ArgoCD

• Owned identity and access for a multi-tenant contact-center platform. Built SCIM 2.0 provisioning with Microsoft Entra ID sync (scaled to tenants with 10,000+ users), SAML/OIDC SSO for web and mobile, and Google Sign-In with account linking and One Tap.

• Led a platform-wide security hardening effort: enforced record ownership and campaign entitlements, added an allowlist-based SSRF guard, re-enabled method-level security and masked credentials in API responses, all shipped behind runtime flags.

• Re-architected system-admin authorization and support access: granular authorities, role templates and JWT enrichment in place of a single all-access flag, plus a customer-consent model for support impersonation with time-boxed access, automatic relock and audit logging.

• Unblocked new-tenant provisioning on GCP after a retired Google API caused every tenant setup to fail. Moved to per-service enablement with retries and timeouts, and recorded partial failures on the job record for operators.

• Delivered 10DLC SMS compliance end to end by integrating with The Campaign Registry and the Bandwidth and Inteliquent carriers.

• Adopted AI-agent-driven development with Claude Code and the BMAD Method: wrote PRDs, architecture documents and story breakdowns for the admin RBAC redesign and Google Sign-In, then implemented them story by story with AI agents.

• Used BMAD test architecture and AI review as quality gates: risk-based test designs, requirements-to-test traceability and pass/fail gate decisions for pentest fixes, plus adversarial AI code reviews and GitHub Copilot findings resolved before merge.

• Led AI-assisted root-cause analysis of production issues: traced a sysadmin provisioning-gap 403 and a multi- login lockout end to end, then wrote the incident report, an authorization deep dive and a troubleshooting runbook.

Identity & Access Management Platform 2021 – 2024

Java 11, Spring Boot, OAuth2/OIDC, OpenDJ/LDAP, Okta, Oracle, PostgreSQL, Kafka, RabbitMQ, Redis, Kubernetes/Helm

• Hardened the Token Management Service: moved stored OAuth tokens to KMS-backed encryption with a live migration of existing tokens, and put the service behind policy-based (PDP) authorization.

• Evolved authorization and authentication controls: Kafka-driven team events and location-admin roles in AuthZ v3 with data backfills, password history, login rate limiting and PII masking in logs.

• Drove platform migrations across the IAM services: API gateway move from Tyk to Nginx, move to Kubernetes/Helm across two sites with Redis, RabbitMQ and Kafka cutover and autoscaling, structured JSON logging, and Sonatype/Veracode vulnerability remediation. Software Engineer Nextiva Aug 2015 – Aug 2021

Identity & Access Management Platform 2019 – 2021

Java 8/11, Spring Boot, OAuth2, OpenDJ/LDAP, OpenAM, Oracle, Kafka, RabbitMQ

• Built a Token Management Service from scratch for third-party OAuth connections (Office 365, Google) and Nylas email, calendar and IMAP integration, with encryption of stored tokens.

• Modernized authentication and authorization services: moved AuthN user management onto OpenDJ/LDAP, built the Team Service, laid the foundation for event-driven AuthZ v3 (RabbitMQ), and published profile events from AuthN over Kafka.

Billing, Licensing & Account Platforms 2015 – 2019 Java 8/11, Spring Boot, Oracle BRM, Oracle, PostgreSQL, RabbitMQ, Docker

• Built the billing service on Oracle BRM: account and child-account hierarchies, contracts, orders with licenses and promo bundles, payments, balances, credit limits and past-due tracking, plus the product catalog service for bundles and rate plans.

• Built the License Service and payment foundations: product and feature entitlements with auto-assignment, credit-card and eCheck payments, channel-partner commissions, and subscription renewal fees with tax calculation.

Software Engineer Maas Global Solutions May 2013 – Jul 2015 Simi Valley, CA · Java, J2EE, Oracle, SOAP, XML/XSL, JAXB, PGP, C#/.NET, Android, ISO 8583

• Integrated payment processors and gateways across the USA, Canada and South America for a financial-services platform, following PCI requirements.

• Led EMV chip-and-PIN development on the VeriFone MX915 terminal using XPI, along with an account updater, a patient drug-eligibility portal and merchant-services customer support tools.

• Built batch and multi-threaded payment and record processing with scheduling, and wrote Oracle SQL and stored procedures for client databases.

Software Engineer Circuit Express Inc. Dec 2003 – Apr 2013 Simi Valley, CA · Java, Java Swing, JNI, C, C++, Assembly, CNC, CAD/CAM

• Built control software for PCB manufacturing machines (Excellon drills, Kenard routers and PCB test machines): X/Y/Z axis motion control in CNC, and Java Swing interfaces talking to the machines over the PC parallel port through JNI, C and Assembly.

• Converted legacy machine programs to modern languages, working with hardware engineers on hardware/software interfaces and performance.

• Developed CAD/CAM utilities that panelize PCB designs, generate CNC drill and route programs, and check design rules before manufacturing.

• Built production-management software tracking manufacturing activity, with reports on stock, output, cost, quotes, on-time delivery and scrap.

Early Career India Jul 2000 – Sep 2003

• Programmer, AcTax InfoTech (Jun 2002 – Sep 2003): built casino gaming software (Java Swing, J2EE, EJB) with demo and real-money modes and credit-card payment integration, and a modem file-transfer system

(Xmodem/Ymodem/Zmodem) for sending US tax returns to the IRS.

• Jr. Software Engineer, System Level Solution (Jul 2001 – May 2002): ported uClinux and Red Hat eCos to a 32-bit SPARC processor (boot code, register setup, kernel fixes), and built serial and parallel port APIs for smart-card testing and loading OS images into flash.

• Trainee Software Engineer, Right Solution (Jul 2000 – Jun 2001): built a multi-client chat server and web mail system with Java Servlets, JSP, JavaMail and sockets. EDUCATION

Bachelor of Engineering, Computer Engineering 2001 L.D. College of Engineering, Gujarat University, Ahmedabad, India

Contact this candidate