About this opportunity
At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.
The Position
Senior Software Engineer, Identity & Customer Platform (CIAM)
Experience: 3–5 years | Stack: Java 21 · Spring Boot · Keycloak · AWS · React/TypeScript
About the role
You'll build and operate the services behind our Customer Identity & Access Management (CIAM) platform, authentication, authorisation, user account management, and the migration of legacy identity systems onto Keycloak. This is a polyglot, multi-repo environment: most of the weight is backend Java, with meaningful frontend and infrastructure work alongside it.
What you'll do
Design and ship backend services in Java 21 / Spring Boot (REST via Spring MVC, Jersey/JAX-RS, and Spring Cloud Gateway on WebFlux).
Extend Keycloak 26 through custom SPIs, authentication flows, and themes; contribute to realm configuration managed as code.
Build event-driven and data-backed features on AWS, SQS/SNS, S3, Secrets Manager, with PostgreSQL and Liquibase schema migrations.
Drive the strangler-pattern migration of legacy identity services with zero-downtime cutovers.
Design API contracts first (OpenAPI/springdoc, generated clients, contract diffing in CI) and keep them backward compatible.
Write meaningful tests at every level: JUnit 5, AssertJ, Mockito, ArchUnit, Testcontainers (Postgres + LocalStack), WireMock, REST Assured.
Own your services in production: Datadog APM/RUM, Micrometer/OpenTelemetry, structured JSON logging, and on-call participation.
Ship through GitHub Actions pipelines with SonarQube quality gates, JaCoCo coverage, CycloneDX SBOMs, and strict Gradle dependency locking.
Review peers' code and participate in architecture decisions, not just implement tickets.
Must have (4–5 years)
4+ years of professional JVM development, with recent work on Java 17/21 and Spring Boot.
Solid grasp of OAuth 2.0, OIDC, JWT, and SAML, you can explain authorization code + PKCE, token exchange, and refresh token rotation without looking them up.
Hands-on relational database work: schema design, indexing, query tuning, and versioned migrations (Liquibase or Flyway).
Practical AWS experience running production workloads (messaging, storage, secrets, IAM).
Docker and container-based local development; comfort with Docker Compose and Testcontainers.
Strong automated testing discipline, you treat tests as part of the deliverable, not an afterthought.
Git-based trunk/feature-branch workflow, CI/CD pipelines, and code review as a daily habit.
Clear written communication in English; ability to document decisions and trade-offs.
Strongly preferred
Direct Keycloak experience (custom providers, SPIs, admin client, theming) or comparable IdP work (Auth0, Gigya, Okta, ForgeRock).
Gradle (Kotlin DSL) in a multi-module / platform-BOM setup.
React 18 + TypeScript with Vite, enough to own a full vertical slice through the UI.
Node.js/Express services in TypeScript.
Kubernetes and Helm; Terraform for infrastructure and IdP configuration as code.
Observability practice: dashboards, SLOs, alerting, and debugging distributed traces.
Experience in a regulated environment (healthcare/life sciences, GxP, HIPAA/GDPR), data privacy is a first-class concern here.
Nice to have
Python (tooling/automation), Ruff/pytest.
Playwright or Cypress end-to-end testing; visual regression testing.
Performance/load testing (k6, JMeter).
Application security background: OWASP Top 10, SAST/DAST, dependency and SBOM hygiene.
Who we are
A healthier future drives us to innovate. Together, more than 100’000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a global impact.
Let’s build a healthier future, together.
Roche is an Equal Opportunity Employer.
Job details
How this role compares
Computed from every other active Manufacturing & CMC role in our database, not just this employer's listings.
We currently track 3720 comparable Manufacturing & CMC roles across 172 biopharma companies.
Salary context
906 of 3720 peers report a salary range (USD, annualized)
Peers share this role's job function. This posting doesn't list a seniority level, so peers aren't narrowed by seniority either -- the range below may span more levels than usual.
Where these roles are based
Top locations among the 3720 comparable roles
+ 58 more countries
Seniority mix
1647 of 3720 peers have a known seniority level
Therapeutic area mix
24 of 3720 peers have a known therapeutic area; the rest are genuinely unlabeled, not hidden
Similar opportunities
The closest matches from our peer group, ranked by how similar they are, not how well you'd qualify for them -- treat this as market context, not a guaranteed shortlist; a weak match is labeled as one below.
Notify me about similar jobs
Get an email when we spot other openings like this one – same job function, comparable seniority, roles you'd actually want to see.
Or follow a whole field: get every new Manufacturing & CMC job in India, and choose locations and companies.
How we calculate "similar"
No black box, no LLM guesswork: a deterministic score built from four normalized attributes. Here's this role's own peer group at different match levels, so you can see the mechanism, not just the result.
Every comparison starts from the same 100-point budget: 25 for working in the same function, 40 for the same therapeutic area, 20 for the same or adjacent seniority, 15 for the same country. A dimension we can't confirm on both sides contributes nothing, never a guess, never a free pass.
0 points, never a partial guess. A role we know almost nothing about beyond its function bottoms out at 25%; it never inflates to 100% just because there's little to compare against. Seniority uses a defined ladder (Associate → Manager → Associate Director → Senior → Principal → Director → Senior Director → Executive/VP) so "Director" and "Senior Director" count as adjacent, but "Director" and "Executive/VP" do not.