Principal Engineer - Oneinventory (Itam)

• Flexible working hours and hybrid work (3 days in the office and 2 days remote).
• A flexible compensation package that includes: meal vouchers, childcare vouchers, medical insurance, life insurance, employee discounts, and more. And if you live in Madrid, a company shuttle bus is available to get you to the office.
• Access to an attractive pension plan.
• Summer intensive schedule.
• You'll be in charge of your own learning journey, with access to thousands of resources to keep advancing your technical expertise. Plus, you'll receive an additional €1,100 per year to further develop your skills.
• 25 vacation days per year (you would receive the proportional days starting from your start date).
• Additionally, at Mapfre we do not work on December 24, December 31, or January 5.
• 28 hours per year for personal matters + 3 recoverable days during Easter week.
• The opportunity to participate in volunteer projects.
• Free paddle tennis courts and gym.
• A great place to work! We're ranked among the 50 best companies to work for in Spain according to Forbes magazine.

We are diverse, and that makes us unique!

Give your career a fresh start and keep growing professionally at Mapfre Tech! You'll join an international environment where you can innovate by working on global projects focused on the latest technology trends. All of this in a flexible, agile setting surrounded by excellent professionals from around the world... Are you ready?

At Mapfre, we want to bring in a Principal Engineer profile to technically lead the evolution and operation of OneInventory, our corporate technology inventory and the ecosystem's Single Source of Truth (SSOT). You will be the reference person in data architecture, domain model, data governance, integration with CMDBs, and automation, helping the entire organization have a reliable, traceable, and real-time view of its technological assets.

Technically lead the architecture and evolution of OneInventory (InventoryDB / Core SSOT), defining design criteria, cross-cutting technical decisions, and platform standards.

Be the reference for the technological inventory: make decisions, prioritize evolutions, and ensure a coherent vision of the data model, domain, governance, and platform.

In your day-to-day, you will be the technical lead for the OneInventory platform (Core SSOT): you will define the relational data model (Domains, Applications, and Services) across the company's technological assets, event-driven architecture patterns, decision criteria, and a clear operating model so that different sources, tools, and teams interact with the inventory in a consistent and governed manner. You will work side by side with Infrastructure and Operations, Portfolio, Architecture, Security, Engineering Platform, and product teams. Additionally, you will design and govern the exposure layer through APIs and MCP (Model Context Protocol) servers, ensuring that applications, platforms, and AI agents access data and actions under an RBAC/ABAC model, with traceability, least privilege, and a Security First approach.

Make OneInventory the data backbone of Mapfre's technology platform: a consistent, integral, and traceable Single Source of Truth that consolidates "what is actually there," integrates with CMDBs ("what should be there"), and propagates status changes to the rest of the ecosystem in an asynchronous, secure, and governed way, enabling asset observability, action automation, and compliance with corporate standards. OneInventory must expose its data and capabilities through APIs and MCP in a secure and governed manner, enabling traditional integrations and use cases with AI agents without bypassing the platform's authorization policies.

Define and evolve the business relational data model based on Domains, Applications, Services, and Assets, including relationship graphs, dependencies, and lifecycle and state control.

Govern the integration with CMDBs and the OneInventory initiative, aligning the technical inventory (what is actually there) with the business source of truth (what should be there).

Lead the event-driven architecture and the separation of reads and writes (CQRS), guaranteeing eventual consistency, idempotency, and traceability across the platform.

Define, build, and evolve the OneInventory exposure layer through APIs (REST/GraphQL) and MCP (Model Context Protocol) servers, ensuring stable contracts, versioning, observability, and standardized consumption by applications, platforms, and AI agents.

Design a common authentication and authorization architecture for APIs and MCP, integrated with Entra ID and based on fine-grained RBAC/ABAC according to domain, asset type, product, environment, and requested operation.

Apply a Security First and Security by Design approach throughout the entire lifecycle: least privilege, segregation of duties, input validation, secure secrets management, encryption, auditing, traceability, and protection against unauthorized access or actions.

Ensure that no consumption channel, including MCP and AI agents, can bypass the business rules, authorization controls, data classification, or governance policies defined in OneInventory.

Define guardrails, controls, and audit evidence for the exposure of operational tools and actions through MCP, including authorization by action and context, scope limits, and end-to-end traceability.

Evolve ingestion and synchronization mechanisms from multiple sources and clouds (AWS, Azure, GCP, GitHub, OnPrem, DataCenters) and satellite tools.

Design and govern the hybrid (RBAC/ABAC) context-based authorization model: domain, asset type, product, and environment, under the principle of least privilege and in agreement with the Security area.

Evolve the Actions Catalog (metadata-driven dynamic orchestration) and the decoupled executor services that react to bus events to trigger operational flows on assets.

Lead the persistence strategy and its evolution, from MongoDB Atlas (current) towards OneInventory objectives (Oracle Autonomous / GoldenGate), with high availability, consistency, and multi-region resilience criteria.

Ensure compliance with regulations, security, and data governance, integrating OneInventory with corporate identity, audit, lineage, and compliance controls and services (Entra ID, Purview, Microsoft Graph).

Define the platform operating model: observability, alerting, logging, support, change management, recurring operation, and scaling.

Maintain technical documentation, runbooks, operating procedures, and artifacts necessary for the operation, continuity, and evolution of the platform.

Define functional requirements, DoD, and acceptance criteria for OneInventory evolutions.

Define and monitor KPIs and metrics for data quality, stability, adoption, compliance, automation, and platform efficiency.

Act as a technical reference point for platform, security, architecture, portfolio, and development teams, accompanying and mentoring more junior technical profiles.

Participate in the resolution of complex incidents and in strategic platform technical decision-making.

The position will be based at our offices in Las Tablas, Madrid.