Senior Software Developer (Python/Django)

Senior Software Developer (Python/Django)

Position Summary

We are seeking a senior full-stack developer to own and modernize shared Python/Django capabilities and serve as the technical escalation point for complex, cross-application work. The role combines hands-on development with architecture, secure identity and database integration, lifecycle upgrades, production troubleshooting, documentation, and mentoring. The developer will collaborate with application teams, DevTools/DevOps, NIH CIT, Security, and database administrators across on-premises and AWS environments.

Key Responsibilities

• Application engineering. Design, develop, test, and maintain Python/Django applications, reusable libraries, REST APIs, and supporting JavaScript/HTML/CSS components.
• Python and Django lifecycle upgrades. Lead end-of-life upgrades across the application portfolio: inventory dependencies, assess compatibility, update requirements and internal packages, refactor deprecated APIs, test across environments, coordinate consuming teams, and publish migration and rollback guidance.
• Runtime and package engineering. Build, validate, package, and distribute Python runtimes from source when approved installers are unavailable; verify checksums, test suites, pip/virtual-environment behavior, and compatibility with internal artifact repositories.
• Shared Django platform ownership. Modernize shared Django infrastructure libraries and related packages; deliver Python 3.12+ compatibility, automated tests, versioning, deprecation paths, architecture diagrams, runbooks, and coordinated adoption by dependent applications.
• PIV, SSO, authentication, and authorization. Implement and troubleshoot NIH Login/SiteMinder, CAS and django-cas-ng, AWS Cognito, JWT/OAuth2, Django authentication backends, authorization decorators, role and permission mapping, and secure session handling.
• Secure database integration. Connect Django applications to Oracle, PostgreSQL, AWS RDS, and other approved data sources through centralized password-lookup and secrets-management services; support credential rotation, least privilege, and removal of hard-coded secrets.
• Application security. Enforce Content Security Policy (CSP), XSS/CSRF protections, HSTS, secure headers and cookies, dependency remediation, and penetration-test findings; favor external scripts or nonce/hash-based CS