Principal Software Engineer

Job

Principal Software Engineer

Description

POSITION TITLE: Principal Software Engineer

LOCATION: Burbank, CA (Hybrid)

REPORTS TO: Senior Director of Architecture

ABOUT THE ROLE:

Position Overview

Deluxe is modernizing the software behind global content localization and fulfillment. Our infrastructure is already cloud-native; the work ahead is evolving a substantial body of legacy applications into well-factored, event-driven services that support automation, AI/ML, and global scale.

We are looking for a Principal Software Engineer to be the senior technical owner of that platform’s foundations. You will define the patterns other teams build on, and then build them. This is a hands-on individual contributor role: you will spend a meaningful portion of your week in code and design documents, not exclusively in meetings.

Working directly with the Senior Director of Architecture, you will own the deep technical execution of our architecture strategy — service design, the internal developer platform, shared libraries and SDKs, and the identity system. Where the Senior Director sets direction with Product, Engineering leadership, and Operations, you translate that direction into working systems and make the hard technical calls along the way.

RESPONSIBILITIES:

Software Architecture & Design

• Own the design of new services and the decomposition of existing ones: service boundaries, domain models, API contracts, and data ownership. These are the decisions that are expensive to reverse, and they will be yours to make.
• Set the patterns for how our software is built — API design and versioning, error handling, idempotency and retries, concurrency, resilience, and testing strategy — and demonstrate them in working code, not only in documents.
• Lead the modernization of legacy applications into well-factored services: incremental extraction, strangler patterns, and data migration strategies that let teams keep shipping while the system underneath them changes.

Platform & Shared Services

• Own the technical design and hands-on implementation of shared capabilities on our Kubernetes/EKS-based microservices platform: service templates, golden paths, and paved-road tooling that teams adopt because it is the easiest option available, not because it was mandated.
• Design, build, and maintain shared libraries and SDKs — configuration, authentication, telemetry, messaging, data access — consumed across service teams. You own their versioning, release process, deprecation policy, and the migration of downstream consumers.
• Establish standards for service-to-service communication, event-driven messaging (SNS/SQS/EventBridge and message brokers), API contracts, and data access patterns — then ship reference implementations that demonstrate them in production.

Identity & Access

• Own the architecture and ongoing evolution of our identity platform across multiple user populations: employees, external contractors and partners, and machine-to-machine workloads.
• Go deep on OIDC/OAuth2 flows, SPA and native application authentication, token lifecycle and refresh, session and cookie strategy, and cross-tenant federation.
• Partner with IT and Security on identity provider integration (Microsoft Entra ID and equivalents), and implement the application-side patterns — cookie scoping, CORS, CSRF defense, token handling — as reusable libraries so that each team is not reinventing them, usually incorrectly.

Infrastructure & Delivery

• Contribute to and review the infrastructure code that runs our services — Terraform, CDK (CloudFormation), Helm charts, Kubernetes manifests, and CI/CD pipelines. You should be fluent enough to make and review changes; you will not be its sole owner.
• Partner with our Systems and Platform Architects on EKS and AWS architecture, bringing the application perspective to scaling, secrets management, and workload identity decisions.
• Treat cost efficiency, reliability, and observability as first-class design constraints rather than post-launch cleanup.

Architecture & Governance

• Act as the senior technical reviewer in our architecture review process: RFCs, ADRs, and pre-implementation design reviews across distributed teams. Make tradeoffs explicit and write them down.
• Maintain reference architectures and architectural decision records that engineers actually use.
• Personally lead the hardest slices of modernization work — the migration everyone has been avoiding, the legacy integration nobody wants to touch.
• De-risk major decisions with spikes and prototypes before teams commit roadmap capacity to them.

Technical Leadership Without Direct Reports

• Mentor senior engineers and architects through design review, code review, and pairing — raising the technical ceiling of teams you do not manage.
• Represent the architecture position in working sessions on behalf of the Senior Director of Architecture: make the call in the room where you can, and escalate only what genuinely requires it.
• Translate strategy into sequenced, executable technical plans, with honest assessments of cost, risk, and sequencing.
   

QUALIFICATIONS:

• 12+ years designing, building, and operating distributed production systems, including 4+ years at staff, principal, or architect-level scope.
• Currently hands-on. You have shipped production code within the past year and intend to keep doing so.
• Demonstrated depth in software architecture: service decomposition, API design and versioning, domain and data modeling, and the failure and resilience patterns that distributed systems require.
• Experience incrementally decomposing or replacing legacy applications without halting delivery in the process.
• Solid working knowledge of AWS and Kubernetes/EKS as an application platform — you understand how your services run, scale, and fail in production.
• Demonstrated experience building shared libraries, SDKs, or internal platforms consumed by multiple engineering teams, including the unglamorous work of versioning and migrating consumers.
• Substantive depth in identity and access: OIDC/OAuth2, SAML, token and session security, and the browser security model.
• Strong proficiency in at least one modern backend language, with the ability to read and review code in others. New development here is primarily Go and Python, so depth in either is a distinct advantage. Experience with PHP, .NET, or Java is valuable for working across the existing services we are modernizing.
• Comfortable reading, extending, and reviewing infrastructure-as-code (Terraform, CDK). You will work in it regularly; you will not be expected to be our deepest infrastructure specialist.
• Excellent written communication. Design documents and decision records are a primary deliverable in this role.
• A track record of influencing engineering direction across teams without formal authority over them.

PREFERRED EXPERIENCE:

• Media, entertainment, or digital supply chain domain experience.
• PostgreSQL depth — schema and index design, partitioning, logical replication and CDC.
• Deeper infrastructure-as-code ownership — Terraform module design, state management, multi-account patterns.
• Observability and FinOps practice in multi-account AWS environments.
• Experience collaborating with engineering teams across multiple global time zones.

ALSO A PLUS:

• Familiarity with media supply chain standards (IMF, HDR, Dolby Vision, adaptive streaming, localization metadata).
• Content security, DRM, or media content security frameworks (MPA Content Security Best Practices, TPN assessments).
• Integration of AI/ML pipelines or workflow orchestration systems into production platforms.

About the Company:

Deluxe, a subsidiary of Platinum Equity, is a global leader in media and entertainment services for film, video, and online content.  Since 1915, Deluxe has been the trusted partner for the world’s most successful Hollywood studios, independent film companies, TV networks, exhibitors, advertisers and others, offering best-in-class solutions in post-production, distribution, asset and workflow management, and cloud-based technologies.

With headquarters in Los Angeles and offices around the globe, the company employs over 3,500 of the most talented individuals, developers, and industry veterans worldwide. For more information, please visit www.bydeluxe.com.

We offer competitive pay and benefits program including medical, dental & vision coverage, vacation & sick leave, 401(k), and more. 

Diversity Statement:

Deluxe is committed to inclusivity, fostering an environment where every employee feels comfortable bringing their full selves to work. It is our policy to provide equal employment opportunities to all applicants and employees.  Applicants will receive consideration for employment without regard to, and will not be discriminated against, on the basis of race, color, religion, creed, national origin or ancestry, sex, age, physical or mental disability, veteran status, sexual orientation, gender identity or expression, genetic information or any other legally recognized protected basis under federal, state or local laws, regulations or ordinances. Deluxe will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable local, state, and federal law.

Applicants with disabilities may be entitled to reasonable accommodation under the terms of the Americans with Disabilities Act and certain state or local laws. A reasonable accommodation is a change in the way things are normally done which will ensure an equal employment opportunity without imposing undue hardship on Deluxe. Please inform the company's HR representative if you need assistance completing any forms or to otherwise participate in the application process.

This role is based in Burbank, CA and the base pay range for this role is $170,000.00 - $200,000.00 annually. Actual amounts will vary depending on education, skills, experience, and geographic location.