Java Developer ( AWS & IAM experience)

Overview

Build and operate the services behind Roche's Customer Identity & Access Management (CIAM) platform, covering authentication, authorisation, user account management, and migration of legacy identity systems onto Keycloak.

What you'll do

• Design and ship backend services in Java 21 / Spring Boot (REST via Spring MVC, Jersey/JAX-RS, and Spring Cloud Gateway on WebFlux).
• Extend Keycloak 26 through custom SPIs, authentication flows, and themes; contribute to realm configuration managed as code.
• Build event-driven and data-backed features on AWS (SQS/SNS, S3, Secrets Manager) with PostgreSQL and Liquibase schema migrations.
• Drive the strangler-pattern migration of legacy identity services with zero-downtime cutovers.
• Design API contracts first (OpenAPI/springdoc, generated clients, contract diffing in CI) and keep them backward compatible.
• Write meaningful tests at every level using JUnit 5, AssertJ, Mockito, ArchUnit, Testcontainers (Postgres and LocalStack), WireMock, and REST Assured.
• Own services in production using Datadog APM/RUM, Micrometer/OpenTelemetry, structured JSON logging, and on-call participation.
• Ship through GitHub Actions pipelines with SonarQube quality gates, JaCoCo coverage, CycloneDX SBOMs, and strict Gradle dependency locking.
• Review peers' code and participate in architecture decisions.

What you'll need

• 4+ years of professional JVM development, with recent work on Java 17/21 and Spring Boot.
• Solid grasp of OAuth 2.0, OIDC, JWT, and SAML, including authorization code + PKCE, token exchange, and refresh token rotation.
• Hands-on relational database work: schema design, indexing, query tuning, and versioned migrations (Liquibase or Flyway).
• Practical AWS experience running production workloads (messaging, storage, secrets, IAM).
• Docker and container-based local development; comfort with Docker Compose and Testcontainers.
• Strong automated testing discipline.
• Git-based trunk/feature-branch workflow, CI/CD pipelines, and code review as a daily habit.
• Clear written communication in English; ability to document decisions and trade-offs.

Nice to have

• Direct Keycloak experience (custom providers, SPIs, admin client, theming) or comparable IdP work (Auth0, Gigya, Okta, ForgeRock).
• Gradle (Kotlin DSL) in a multi-module / platform-BOM setup.
• React 18 + TypeScript with Vite, enough to own a full vertical slice through the UI.
• Node.js/Express services in TypeScript.
• Kubernetes and Helm; Terraform for infrastructure and IdP configuration as code.
• Observability practice: dashboards, SLOs, alerting, and debugging distributed traces.
• Experience in a regulated environment (healthcare/life sciences, GxP, HIPAA/GDPR).
• Python (tooling/automation), Ruff/pytest.
• Playwright or Cypress end-to-end testing; visual regression testing.
• Performance/load testing (k6, JMeter).
• Application security background: OWASP Top 10, SAST/DAST, dependency and SBOM hygiene.