Career Prep Roadmap — On-Prem Focus (2026) Built from your current base: Java 26, ReactJS, Next.js, Jenkins CI/CD, Kubernetes, Ubuntu Linux, Kafka. No AWS/Azure/GCP anywhere in this doc — everything below is on-prem / self-hosted / bare-metal / private-datacenter capable. 1. DevSecOps Developer Core (you already have a head start): Kubernetes, Jenkins, Linux Must-learn: GitOps: Argo CD or FluxCD (self-hosted, works great with an on-prem cluster) IaC for bare metal / private infra: Terraform (with the libvirt, vSphere, or bare-metal providers — not cloud providers), Ansible for config management, Packer for image builds Security scanning pipeline: SAST: SonarQube (self-hosted), Semgrep SCA / dependency scanning: OWASP Dependency-Check, Trivy Container image scanning: Trivy, Grype, Clair Secrets scanning: Gitleaks, TruffleHog DAST: OWASP ZAP Secrets management: HashiCorp Vault (self-hosted) Policy-as-code: Open Policy Agent (OPA) / Gatekeeper, Kyverno Supply chain security: Sigstore/Cosign for image signing, SBOM generation (Syft), SLSA framework basics Observability: Prometheus + Grafana + Loki + Tempo (the self-hosted "LGTM" stack), Alertmanager Service mesh (security layer): Istio or Linkerd for mTLS, zero-trust between services — Istio is considered feature-rich for enterprise-scale apps while Linkerd is lighter for smaller clusters CIS/NSA-CISA Kubernetes hardening benchmarks, kube-bench, kube-hunter Certs worth targeting: CKA, CKS (Certified Kubernetes Security Specialist), possibly OSCP if you want deep security cred 2. Big Data Developer Core (you already have a head start): Kafka, Java, Linux Must-learn: Batch/stream processing: Apache Spark (Structured Streaming), Apache Flink (increasingly the standard for real-time on-prem pipelines) Storage layer (on-prem data lake): Apache Hadoop HDFS or MinIO (S3-compatible, fully self-hosted object storage) as your lakehouse storage Lakehouse table formats: Apache Iceberg or Delta Lake (open-source/OSS mode, not Databricks-hosted) Orchestration: Apache Airflow or Dagster (self-hosted) Kafka ecosystem depth: Kafka Streams, ksqlDB, Kafka Connect, Schema Registry (Apicurio or Confluent's open-source registry), and consider Apache Pulsar as an alternative/complement you should at least know conceptually OLAP engines for analytics on-prem: ClickHouse, Apache Druid, or Trino (Presto) for federated SQL queries across data sources Data governance/catalog: Apache Atlas or OpenMetadata Workflow for CDC (Change Data Capture): Debezium (pairs naturally with your Kafka skills) Certs worth targeting: Databricks certs are cloud-flavored so skip; look at Confluent Certified Developer for Kafka instead 3. Application Architect Core (you already have a head start): Java, Spring ecosystem, React/Next.js Must-learn: Architecture patterns: Hexagonal/Clean Architecture, Domain-Driven Design (DDD), CQRS + Event Sourcing, Saga pattern for distributed transactions API design: REST maturity model, GraphQL (for BFF layers), gRPC/Protobuf for internal service-to-service calls, AsyncAPI for event-driven contracts Microservices resilience: Resilience4j (circuit breakers, retries, bulkheads — Java-native, pairs with your Spring Boot background) Messaging/event backbone: Kafka (deepen), plus RabbitMQ for task-queue style patterns Caching: Redis (self-hosted) or Hazelcast for distributed in-memory data grids Database breadth: PostgreSQL (deep), plus at least conceptual fluency in a distributed SQL DB (CockroachDB or YugabyteDB — both fully self-hostable) and a document store (MongoDB self-hosted) Frontend architecture: Micro-frontends (Module Federation with Webpack/Vite), server components in Next.js 15, edge-rendering concepts (even if you self-host) Documentation/modeling: C4 model, ArchiMate, UML refresher Certs worth targeting: none strictly required, but a Spring Professional cert or TOGAF (foundation level) helps signal architecture credibility 4. Solution Architect This role is broader than Application Architect — spans infra + app + integration + business alignment. Must-learn: Everything from Application Architect above, plus: Enterprise integration patterns: ESB concepts, Apache Camel, MuleSoft (community edition) for legacy system integration — very relevant for banking On-prem infra fundamentals: VMware vSphere / Proxmox VE (increasingly popular self-hosted alternative), storage (Ceph for software-defined storage), networking basics (VLANs, load balancers — HAProxy, NGINX, MetalLB for on-prem K8s LoadBalancer services) Identity & access: Keycloak (self-hosted IAM/SSO — extremely relevant for banking), LDAP/Active Directory integration, OAuth2/OIDC/SAML deep understanding Disaster recovery / HA architecture: active-active vs active-passive datacenter design, backup strategy (Velero for K8s), RTO/RPO planning Compliance frameworks relevant to banking: PCI-DSS, ISO 27001, SOC 2, RBI/regional banking regulations depending on where you're targeting TOGAF certification is genuinely valuable at this level — worth pursuing seriously Cost/capacity planning for on-prem (unlike cloud, you must forecast hardware procurement cycles) 5. System Design Expert This isn't a single tool stack — it's the synthesis layer across everything above. Must-learn (concepts, practiced through your existing stack): Scalability patterns: horizontal sharding, read replicas, CQRS, database partitioning strategies (practice on PostgreSQL) Consistency models: CAP theorem trade-offs, eventual vs strong consistency, distributed consensus (Raft — study etcd, which K8s already uses internally) Load balancing & traffic management: L4 vs L7, NGINX/HAProxy/Envoy configuration Caching strategies: cache-aside, write-through, write-behind, TTL/eviction policies (practice with Redis) Rate limiting & backpressure: token bucket, leaky bucket algorithms Idempotency & exactly-once semantics: especially critical for banking (you've already touched this via your Kafka consumer-lag prep work) Distributed transactions: 2PC vs Saga pattern, outbox pattern (pairs with Kafka + Debezium) Practice format: mock system design interviews — design a payments system, a ledger system, a fraud-detection pipeline (all map directly to banking) Resource: "Designing Data-Intensive Applications" (Kleppmann) is the standard text; also useful to study real bank engineering blog post-mortems