Senior Software Engineer – MCP & AI Platform

Notice Period: Immediate to 10 days

What You Will Do

• Design and implement the Client Pulse MCP server exposing tools for approvals, billing, and workforce events, mapped to our existing REST API (/v1/approvals, /v1/billings, /v1/events).
• Define tool schemas, descriptions, and input/output contracts that are precise enough for LLMs to invoke correctly without hallucination.
• Implement the auth layer: API Key injection, OAuth 2.0 client credentials flow, and per-tenant credential isolation using AWS Secrets Manager.
• Build the confirmation and safety guardrail layer for write tools to prevent unsafe AI-triggered mutations.
• Implement response normalization so complex, paginated API payloads are reshaped into LLM-friendly summaries without exceeding context window limits.
• Design and own the tool versioning strategy so breaking API changes never break deployed agents.
• Integrate MCP server logging with Amazon CloudWatch and ensure every tool invocation produces a durable, queryable audit trail.
• Implement circuit breaker and retry logic for the VMS call path (API Gateway → Lambda → AWS Direct Connect → on-prem VMS).
• Collaborate with InfoSec to ensure the MCP server meets enterprise security requirements including WAF compliance, private VPC deployment, and PEN test remediations.
• Participate in architecture reviews and contribute to the evolution of the Client Pulse API Platform.

What You Bring

Required:

• 4+ years of professional software engineering experience building production backend systems.
• Direct experience designing and implementing MCP servers – you have shipped at least one MCP integration that is in production or active use.
• Strong proficiency in Node.js or TypeScript; familiarity with Python or Java is a plus.
• Experience with AWS Lambda, API Gateway, VPC networking, Secrets Manager, and CloudWatch.
• Solid understanding of REST API design, OpenAPI/Swagger specifications, and API versioning strategies.
• Experience with OAuth 2.0 flows (client credentials, on-behalf-of) and API Key management.
• Clear understanding of how LLMs consume tool definitions and how tool description quality affects agent behavior.
• Strong security instincts: you know the difference between authentication and authorization, and you think about credential exposure before writing the first line.

Preferred:

• Experience building integrations with Microsoft Bot Framework or Slack Bolt SDK.
• Familiarity with enterprise SaaS platforms (Workday, SAP Fieldglass, ServiceNow, or similar VMS/HCM systems).
• Experience with the approval outbox pattern or event-driven architectures using SNS/SQS.
• Exposure to Redis caching and ElasticSearch in a production context.
• Background in workforce management, procurement, or enterprise HR technology.

Tech Stack

• MCP: Model Context Protocol (Anthropic spec)
• Runtime: Node.js / TypeScript (MCP server layer)
• Cloud: AWS (Lambda, API Gateway, VPC, Secrets Manager, CloudWatch, SNS/SQS, Direct Connect)
• Backend: Java / Spring Boot / PostgreSQL (on-prem VMS – you integrate with it, not build it)
• Auth: OAuth 2.0, API Key
• Observability: Amazon CloudWatch
• Channels: Microsoft Teams (Bot Framework), Slack (Bolt SDK)

 WhyThis Role

• You own the layer. MCP architecture is finalized. You are not joining a committee – you are shipping the server.
• Real enterprise scale. Client manages billions in workforce spend. The tools you build will be used by managers at Fortune 500 companies to approve real workforce actions.
• Early in a fast-moving space. MCP is months old as a production standard. You will be defining best practices, not following them.
• Strong technical foundation. The API Platform, auth model, observability stack, and security architecture are already production-grade. You are adding a layer on top of something that works.