Senior Cybersecurity Analyst - Policy Based Access

At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.

The Position

Senior Cybersecurity Analyst - Policy Based Access

As part of Roche Digital Technology (RDT), our Identity and Access Management (IAM) team protects the organization’s global digital assets by developing and operating sophisticated security platforms. We work at the forefront of identity governance, fine-grained authorization, and hybrid cloud security to support users and business-critical systems in a highly regulated global healthcare ecosystem.

As a Senior Cybersecurity Analyst - Policy Based Access, you will be part of a global team responsible for the design, implementation, and lifecycle management of our Policy Based Access Control (PBAC) infrastructure. You will play a critical role in protecting our information and assets by moving beyond traditional access models toward a dynamic, fine-grained authorization framework that supports our global Zero Trust strategy. In this role, you will act as a trusted advisor to global application owners, ensuring that our security policies are scalable, resilient, and deployed seamlessly through automated code pipelines.

The Opportunity

- Architect PBAC Infrastructure: Serve as the technical owner of core PBAC components (PDP/PEP) across a hybrid global landscape, ensuring high availability and peak performance.

- Drive Strategic Implementation: Lead the enterprise transition from initial access use cases to global adoption, defining organization-wide standards for policy-based authorization.

- Consult on Integration Pathways: Act as the primary technical consultant for application and data owners, integrating critical systems via RESTful APIs, SQL/JDBC, and LDAP.

- Pioneer Policy as Code (PaC): Drive the shift to PaC by designing automated pipelines for versioning, testing, and deploying authorization logic like modern software.

- Manage Platform Lifecycles: Own the tactical lifecycle of the authorization platforms, including version upgrades, continuous performance tuning, and security patching.