Principal Enterprise Identity Engineer

About the role

Roche is looking for a Principal Enterprise Identity Engineer in Madrid to act as the technical authority for its global Enterprise Identity Management (EIM) and Identity Governance and Administration (IGA) landscape. The role defines the multi-year identity strategy, drives zero-trust initiatives across a complex global ecosystem and bridges executive business strategy with deep technical execution.

Key responsibilities

• Lead the multi-year roadmap and end-to-end technical strategy for enterprise identity, aligning IGA architectures with global security policies and zero-trust frameworks.
• Establish and enforce enterprise-wide architecture patterns, engineering standards and reusable frameworks across identity, cloud and infrastructure domains.
• Architect and oversee the deployment of next-generation, SailPoint-based EIM solutions at massive, distributed scale.
• Translate complex security paradigms and regulatory requirements into board-level technical strategies.
• Pioneer emerging identity technologies such as decentralized identity, ML-driven access analytics and microservice/API integrations.
• Mentor senior engineers and lead Tier 4 escalation and root-cause analysis for complex systemic issues.

Required profile

• Minimum 12 years of hands-on engineering experience in cybersecurity and identity management, with at least 5 years at an enterprise architecture or principal level.
• 5+ years steering identity strategies in highly regulated, multinational environments (healthcare, finance or similar highly preferred).
• Bachelor's or advanced degree (master's preferred) in computer science, cyber security, information technology or a related field.
• CISSP, CISM or CIAM strongly preferred; advanced AWS/Azure/GCP or SailPoint certifications highly desirable.

Required skills

• SailPoint (IdentityNow/IdentityIQ) at enterprise scale, including custom development, performance tuning and global deployment.
• Java and Python for complex connectors, custom rules and automated workflows.
• Multi-cloud integration (AWS, Azure, GCP), CI/CD pipelines, DevOps and microservices.
• RBAC, PBAC, segregation of duties and access governance.