Architus specialises in connecting leading UK and US businesses with top EU engineering talent, helping them build high-performing technology teams and establish a presence overseas. With offices in London, Vilnius and Kaunas, Architus has a strong track record and an impressive list of clients, including Invesco, Tide, Capital Group, Schroders, BNP Paribas, and HSBC.
The Opportunity
Architus is partnering with a leading UK energy company to help build a significant presence in Lithuania. With a reputation for innovation, the company is tackling some of the world’s most pressing challenges by creating better energy systems for the planet and everyone on it.
This is an exciting time to join the company as it continues to expand, offering numerous opportunities for professional development. You will be part of a passionate team dedicated to making a tangible difference in the world through cutting-edge technology, driven by a dynamic and entrepreneurial spirit.
About the Role
As a Staff Software Engineer, you will play a critical role in driving a major Identity and Access Management (IAM) transformation. You will take full technical ownership of migrating their authentication ecosystem from a third-party hosted IdP to a highly scalable, self-hosted Keycloak platform. This high-impact project is pivotal to their long-term platform independence and modern cloud architecture.
What You’ll Be Doing
This is an Individual Contributor role without formal people management responsibilities, but with the opportunity to lead a mission-critical technical initiative, establish migration standards, and mentor team members. You’ll join a small, senior engineering team delivering one of the organisation's most important platform modernisation initiatives. Success in this role comes from combining strong software engineering fundamentals with the ability to contribute across authentication, platform engineering, and cloud-native systems. While no single technology is considered mandatory, we value engineers who can work independently, collaborate closely with experienced teammates, and adapt across different technical challenges.
Designing & Delivering Authentication Platform Changes: Help design and deliver the migration to a self-hosted Keycloak platform on GCP/Kubernetes, contributing to architecture, implementation, and rollout planning alongside experienced engineers.
Executing Complex Migrations: Lead the major-version upgrade of Keycloak, design realm/client/role export-import tooling, and implement user migration strategies (preserving password hashes or designing lazy-migration/credential-reset flows).
Vendor Offboarding & Data Extraction: Negotiate and validate third-party data extractions (DB dumps vs. API exports) to ensure complete and secure data transfer.
Platform & GitOps Engineering: Build and manage stateful workloads on Kubernetes using Helm, setting up robust Argo CD / GitOps workflows, TLS/certificate handling, and GCP Secret Manager integration.
Collaboration & Technical Alignment: Work closely with software, platform, and security engineers to deliver the migration, sharing ideas, agreeing technical direction, and independently driving implementation.
Best Practices & Knowledge Transfer: Help improve engineering standards, documentation, and operational practices while sharing knowledge across the team.
Requirements
Strong software engineering fundamentals combined with experience in at least two of the following areas:
- Authentication & Identity;
- Backend Software Engineering;
- Platform / Cloud Engineering.
Experience with TypeScript is an advantage, as it is the team's primary development language. Experience with Scala or Java is also valuable but not required.
Strong understanding of modern authentication concepts, protocols and identity systems (OIDC, OAuth2, SAML or similar). Direct Keycloak experience is beneficial but not required.
Hands-on experience designing and operating scalable, reliable cloud-native…