Event-Streaming Recovery Authority — Instant Payments

The mandate

The former platform executive departed during an independent review of a duplicate-event episode that posted inconsistent settlement positions at two participant banks. Operations contained the financial exposure, but replay semantics, schema ownership and producer certification remain contested across payments and infrastructure teams. The regulator expects a single accountable leader before the year-end resilience attestation.

The interim will start within three weeks and occupy the executive platform seat for twelve months while a redesigned permanent role is benchmarked globally. The first ninety days are dedicated to control recovery; platform simplification follows once deterministic processing is proven. A six-week overlap with the selected successor is planned, and any extension requires committee approval based on the permanent search, not unfinished remediation.

Handover occurs only after six months without an unreconciled duplicate, lost or out-of-order settlement event; every critical topic has a named owner, versioned schema and tested replay rule; and participant failover exercises complete within the agreed recovery objective twice. The successor must chair a live incident simulation and accept the capacity model, residual-risk register and vendor exit options in writing.

The interim may suspend producers, freeze schema changes, redirect sanctioned engineering capacity, approve temporary specialists and decide recovery sequencing within an A$18 million envelope. Replacement of the core broker, changes to scheme settlement policy, public incident statements and permanent appointments require CTO or board consent. The seat cannot waive regulatory findings or accept unresolved participant financial differences.

Merchant-product features, consumer fraud policy and wholesale pricing sit outside this assignment. The authority may demand evidence from those areas when event behaviour affects settlement, but it does not own mobile-channel redesign, participant commercial terms or the enterprise cloud migration beyond the streaming estate.

Why this seat is open

The incident exposed split accountability between middleware operations and product engineering, followed by the executive’s exit before remediation was agreed. A conventional search cannot supply immediate signing authority for the resilience attestation. The board wants an experienced operator to stabilise processing and leave a role that a permanent platform leader can inherit without hidden incident debt.

What you will own

• Decide and publish canonical delivery, ordering, deduplication and replay semantics for every event class contributing to settlement or participant notification.
• Quarantine unsafe producers and require corrective certification tests before their traffic can re-enter the critical transaction path.
• Rebuild incident reconstruction around immutable event identity, traceable schema versions, consumer offsets and ledger outcomes across both resilience sites.
• Direct failure-injection exercises covering broker loss, network partition, poison messages, clock skew, consumer lag and cross-region recovery under peak load.
• Resolve platform ownership by assigning accountable executives, operational custodians and change approvers to topics, schemas, connectors and replay tooling.
• Govern the A$18 million recovery portfolio against measurable integrity, latency, capacity and recovery outcomes rather than component-delivery percentages.
• Induct the permanent successor through participant briefings, regulator evidence review, a witnessed simulation and explicit acceptance of remaining technical risks.

Candidate qualifications

• Held executive accountability for a high-volume event platform supporting regulated payments, market infrastructure or another financially irreversible transaction flow.
• Led recovery from duplicate, lost or misordered events and can explain how application idempotency, broker guarantees and ledger reconciliation interacted.
• Set schema-governance and producer-certification rules across autonomous engineering groups without creating an unworkable central approval queue.
• Directed multi-region streaming failover at sustained production-equivalent throughput and measured recovery using business outcomes rather than broker availability alone.
• Presented causal evidence and remediation commitments to a financial regulator or systemically important participant after a material platform failure.
• Handed an unstable executive technology seat to a permanent leader with operating controls, investment choices and residual risks independently understood.

Non-negotiables

• Available inside three weeks for an exclusive Sydney assignment, including overnight command during severe payment-platform incidents.
• Has personally operated distributed event systems at regulated transaction scale; architecture advisory without accountable production ownership is insufficient.
• No undisclosed financial interest in broker, cloud, observability or managed-service suppliers that could benefit from the recovery decisions.
• Will preserve incident evidence and participant transparency even where disclosure complicates the programme narrative or vendor relationship.

1. 49 words maximum. State your earliest Sydney start date and the largest regulated event estate for which you held production authority.
2. 49 words maximum. Explain one duplicate-event incident you led, identifying the failed semantic guarantee and the control that prevented recurrence.
3. 49 words maximum. Which two business-level tests would you require before declaring cross-region streaming recovery successful?