Roche Posted August 6, 2026

Principal Enterprise Identity Engineer

Madrid, Spain FULL_TIME
Information Technology Principal

Roche is the source of truth for this posting and owns the application process. We surface normalized context and market comparison you won't find on the original listing.

About this opportunity

At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections,  where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.

The Position

As the Principal Enterprise Identity Engineer, you are the ultimate technical authority and visionary for our global Enterprise Identity Management (EIM) and Identity Governance and Administration (IGA) landscape. Moving beyond individual contribution, you will define the multi-year identity strategy, driving zero-trust initiatives across a highly complex, global ecosystem.

Operating at the highest levels of our technical ladder, you will bridge the gap between executive business strategy and deep technical execution. You will architect resilient, massively scalable identity frameworks, mentor senior engineering talent, and lead cross-functional transformations that protect our most critical global assets while enabling frictionless business operations.

Job Responsibilities

Lead the multi-year roadmap and end-to-end technical strategy for enterprise identity, aligning IGA architectures with global security policies and zero-trust frameworks.

Establish and enforce enterprise-wide architecture patterns, engineering standards, and reusable frameworks across identity, cloud, and infrastructure domains.

Architect and oversee the deployment of next-generation, SailPoint-based EIM solutions that operate flawlessly at a massive, distributed scale.

Translate complex security paradigms and regulatory requirements into actionable, board-level technical strategies.

Pioneer the adoption of emerging identity technologies, including decentralized identity, advanced ML-driven access analytics, and complex microservice/API integrations.

Act as the technical cornerstone for the identity organization, mentoring senior engineers and leading Tier 4 escalation and root-cause analysis for catastrophic or highly complex systemic issues.

Qualifications and Core Expertise

Minimum of 12 years of hands-on engineering experience in Cybersecurity and Identity Management, with at least 5 years operating at an enterprise architecture or principal level.

5+ years of experience steering identity strategies in highly regulated, multinational enterprise environments (Healthcare, Finance, or similar industries highly preferred).

Deep-tier technical expertise in SailPoint (IdentityNow/IdentityIQ), encompassing enterprise-scale design, custom development, performance tuning, and global deployment.

Expert-level proficiency in Java and Python for developing highly complex connectors, custom rules, and automated workflows.

Proven track record of architecting integration solutions across complex multi-cloud environments (AWS, Azure, GCP) and profound familiarity with CI/CD pipelines, DevOps methodologies, and microservices.

Deep, authoritative understanding of RBAC, PBAC, Segregation of Duties (SoD), and advanced access governance frameworks.

Exceptional executive presence with the ability to communicate deeply technical concepts to non-technical C-suite stakeholders and lead distributed global engineering teams autonomously.

Education & Certifications

Degree: Bachelor’s or Advanced degree (Master’s preferred) in Computer Science, Cyber Security, Information Technology, or a related field.

Required Certifications: CISSP, CISM, or CIAM is strongly preferred for this leadership level.

Technical Certifications: Advanced certifications in AWS/Azure/GCP Architecture or SailPoint highly desirable.

#RDT

 

 

Who we are

A healthier future drives us to innovate. Together, more than 100’000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a global impact.

Let’s build a healthier future, together.

Roche is an Equal Opportunity Employer.

Job details

Seniority
Principal
Function
Information Technology
Therapeutic area
Not listed
Location
Madrid, Spain
Employment type
FULL_TIME

How this role compares

Computed from every other active Information Technology role in our database, not just this employer's listings.

We currently track 367 comparable Principal Information Technology roles across 36 biopharma companies.

367Comparable roles tracked
344Currently active
36Companies hiring similar roles
20Countries represented

Salary context

46 of 367 peers report a salary range (USD, annualized)

Peers share this role's job function and a matching or adjacent seniority level -- not necessarily the same therapeutic area or country.

This roleSubject Not listed on this posting
Lowest disclosed · Senior Data Security Engineer (Insider Risk Management – Engineering) · AbbVie $0/hr – $0/hr (≈ $0–$0/yr)
Highest disclosed · Director, Product Management · $223,642/yr – $305,200/yr
Peer group range $0 – $264,421 (median $151,100)

Where these roles are based

Top locations among the 367 comparable roles

India197
United States75
Spain16
Poland14
Portugal11
Greece9

+ 14 more countries

Seniority mix

367 of 367 peers have a known seniority level

Senior290
Principal49
Director28

Therapeutic area mix

1 of 367 peers have a known therapeutic area; the rest are genuinely unlabeled, not hidden

Oncology1

Similar opportunities

The closest matches from our peer group, ranked by how similar they are, not how well you'd qualify for them -- treat this as market context, not a guaranteed shortlist; a weak match is labeled as one below.

50%similar
Roche Sant Cugat del Vallès, Barcelona, Spain Senior
Same function Adjacent seniority Same country
50%similar
Roche Madrid, Spain Senior
Same function Adjacent seniority Same country
50%similar
Roche Madrid, Spain Senior
Same function Adjacent seniority Same country
50%similar
Roche Sant Cugat del Vallès, Barcelona, Spain Senior
Same function Adjacent seniority Same country
50%similar
Roche Madrid, Spain Senior
Same function Adjacent seniority Same country
50%similar
Roche Sant Cugat del Vallès, Barcelona, Spain Senior
Same function Adjacent seniority Same country

How we calculate "similar"

No black box, no LLM guesswork: a deterministic score built from four normalized attributes. Here's this role's own peer group at different match levels, so you can see the mechanism, not just the result.

Every comparison starts from the same 100-point budget: 25 for working in the same function, 40 for the same therapeutic area, 20 for the same or adjacent seniority, 15 for the same country. A dimension we can't confirm on both sides contributes nothing, never a guess, never a free pass.

50%
Senior Software Developer/Scrum Master C#
Roche · Sant Cugat del Vallès, Barcelona, Spain · Senior
Function Therapeutic area Adjacent seniority Country
50%
Senior DevOps Automation Engineer
Roche · Sant Cugat del Vallès, Barcelona, Spain · Senior
Function Therapeutic area Adjacent seniority Country
50%
Senior Software Engineer
Roche · Sant Cugat del Vallès, Barcelona, Spain · Senior
Function Therapeutic area Adjacent seniority Country
50%
Senior Cloud Security Engineer
Roche · Madrid, Spain · Senior
Function Therapeutic area Adjacent seniority Country
Unmatched or unknown dimensions score exactly the same: 0 points, never a partial guess. A role we know almost nothing about beyond its function bottoms out at 25%; it never inflates to 100% just because there's little to compare against. Seniority uses a defined ladder (Associate → Manager → Associate Director → Senior → Principal → Director → Senior Director → Executive/VP) so "Director" and "Senior Director" count as adjacent, but "Director" and "Executive/VP" do not.