Role Description We are looking for a Senior OTX Runtime Engineer to design and ship a production-grade runtime for the ISO 13209 Open Test sequence eXchange (OTX) standard. This is a deeply technical, high-ownership role at the core of Salvo's diagnostic toolchain. You will own the full runtime stack — from XML deserialization and the object model through the type system, evaluator, executor, and extension framework — and integrate it with a D-Server layer that speaks ODX, UDS, and the D-PDU API. The work demands equal fluency in language-implementation concepts, Kotlin Multiplatform engineering, and automotive diagnostic protocols. Key Responsibilities - OTX Runtime Core - Design and implement an ISO 13209-compliant OTX runtime, covering the full object model, deserializer, and type system. - Build a tree-walking interpreter for the OTX XML-based DSL, including AST design using sealed/algebraic data types. - Implement a variable scoping and parameter binding engine faithful to the OTX specification. - Develop the evaluator and executor pipeline, ensuring correct handling of procedural flows, conditions, loops, and exception handling as defined in ISO 13209-1/2. - Design and implement the OTX extension framework to support runtime-loadable extensions. - Handle streaming XML parsing with namespace resolution and xsi:type polymorphic deserialization. - D-Server & Diagnostic Integration - Integrate the runtime with a D-Server layer: implement ODX parsing, service catalog management, and UDS request/response encoding and decoding. - Implement built-in OTX extensions including DiagCom adapter, PDU-to-J2534 adapter, and log:/file:/str:/ext:/flash:/even: extensions. - Develop diagnostic application logic targeting J2534 and D-PDU API (ISO 22900-2) diagnostic interfaces. - Support flash programming workflows across multiple OEM configurations. - Kotlin Multiplatform & Quality - Ship the runtime as a Kotlin Multiplatform (KMP) library targeting JVM and native platforms. - Write robust concurrent code using Kotlin Coroutines and Mutex primitives; debug and resolve production deadlocks. - Define and maintain a comprehensive test suite covering OTX conformance, edge cases in diagnostic protocol encoding, and runtime stability. - Participate in design reviews, contribute to internal documentation, and mentor team members on OTX and diagnostic protocol topics. Qualifications - Shipped an OTX-compliant runtime to production in any language. - Participated in development of a D-Server diagnostic interface, including ODX parsing and executing UDS services across multiple OEMs. - Deep, subject-matter-expert knowledge of ISO 13209-1/2 (OTX) and ISO 22901-1 (ODX). - Shipped at least one Kotlin Multiplatform (KMP) library to production. - Production experience debugging concurrency issues using Kotlin Coroutines and Mutex. - Implemented a tree-walking interpreter for an XML-based DSL. - Designed ASTs using sealed or algebraic data types. - Handled streaming XML parsing with namespace resolution and xsi:type polymorphism. - Strong command of Kotlin; candidates with equivalent depth in Java, Scala, or C# will also be considered. Diagnostic Protocol Knowledge - Subject-matter expert in UDS (ISO 14229), ISO-TP (ISO 15765), and CAN/CAN-FD (ISO 11898). - Experience developing diagnostic applications targeting J2534 and/or D-PDU API (ISO 22900-2). - Working knowledge of KW2000 and OBD-II (SAE J1979). - Experience with flash programming is a strong plus. Nice to Have - Hands-on experience with commercial OTX authoring tools (e.g., ETAS EDIABAS OTX Studio, SOFTING). - Familiarity with commercial ODX authoring tools (e.g., Mazel & Quack OTX/ODX Editor). - Experience with heavy-duty vehicle diagnostics (SAE J1939). - Background in automotive OEM or Tier-1 supplier environments.

• Build and deploy integration solutions — EDI (214, 315), callbacks, custom payload mapping, and API integrations — with production-grade quality and full test coverage • Deploy agentic AI workflows that orchestrate supply chain operations live with customers present — configuring and deploying in the call, not gathering requirements to build later • Write and extend LangGraph-based workflow extensions and wrapped action customizations in Agent Studio • Use Claude, OpenAI, and other LLMs across the entire workflow — requirements documentation, integration design, code generation, testing and deployment; LLMs are not a convenience tool, they are how this team works • Participate in customer discovery and technical clarification calls — answering complex technical and product questions with concrete, innovative solutions in real time • Write thorough root cause analyses for integration failures and own the fix through to resolution • Perform code reviews on integration and AI workflow work and maintain the team's quality standards before any customer deployment • Contribute to the team's reusable integration package and AI workflow template library as you build • Mentor incoming FDEs — pair on hard problems, accelerate their ramp-up, and share institutional knowledge • Collaborate with Implementation Managers, Customer Success Managers, Solutions Consultants, Product Managers, and Engineering to deliver seamless customer outcomes

• Engage with customers, partners, and prospects to understand their problems, scope technical requirements, prototype and propose effective solutions • Work with cross-functional teams across Primer to satisfy the unique requirements of our national security customers and deploy our products in secure environments • Partner with our Product Management and Engineering teams to identify and prioritize feature development based on customer feedback • Train, deploy, and tune machine learning models on customer data sets • Dig into software source code to customize, integrate, and troubleshoot onsite customer product deployments • Provide subject matter expertise to advise our DevOps and Engineering teams on feature and deployment enhancements

• Lead and perform detection content development within the SIEM platform (Elastic, Palo XSIAM, Crowdstrike), including: • Creation, tuning, and lifecycle management of detection rules, correlation rules, and analytic stories/use cases • Definition and maintenance of data models, normalization, and enrichment required to support high‑quality detections • Mapping detections to frameworks such as MITRE ATT&CK where applicable • Identify gaps in detection coverage based on incident trends, threat intelligence, and hunt activities • Reduce false positives and improve alert signal‑to‑noise ratio through iterative tuning • Translate playbooks and incident response workflows into robust, testable detection. • Monitor and manage the health and performance of SIEM detection content, including: • Tracking detection firing patterns, volumes, and performance impact. • Conducting post-incident reviews to refine detections and create new coverage. • Ensuring detections remain aligned with client use cases, risk profiles, and contracted scope. • New and existing detections are prioritized based on risk, impact, and available data • Partner with AHEAD Managed Security and client resources in the design and implementation of new data visualizations and detection rules, including: • Building dashboards, visualizations, and investigative views that support triage and hunting • Collaborate with AHEAD Managed Security SOAR (Swimlane) engineering resources to: • Integrate SIEM detections with SOAR workflows for enrichment, triage, and response • Continuously improve incident investigation workflows and automation quality based on detection output • Engage with client security and IT infrastructure teams for new data source onboarding activities, including: • Defining logging, parsing, normalization, and enrichment requirements to support current and planned detections • Validating that ingested data is complete, normalized, and usable for detection engineering • Tune rules, filters, and policies across SIEM and related security technologies (IDS, EDR, firewalls, etc.) to: • Improve accuracy, visibility, and coverage while minimizing noise • Ensure consistent correlation and context across multiple technologies • Perform data mining and exploratory analysis of log sources to: • Uncover and investigate anomalous activity and potential undetected attack patterns • Identify new detection opportunities and support proactive threat hunting • Assist with the development and improvement of processes and procedures for: • Detection lifecycle management (design, testing, deployment, monitoring, retirement) • Improving incident response times, incident quality, and overall Managed Security functions • Participate in client-facing security meetings to: • Explain detection strategy, coverage, and improvements.