Software Engineer (Partner Identity & Access Management, ABU)

Booking.com; Amsterdam; On-site; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Health insurance

Free Headspace access

Pension plan

Annual time off

Job summary

Booking.com is seeking a hands-on Senior Backend/Identity Engineer to own authentication services across partner systems. You’ll design, build, run, and evolve services that broker authentication between Booking.com’s partner systems and the identity provider, Auth0, including data models, APIs, caching, and failure modes.

You will lead migration workstreams from legacy Perl to Auth0 on live traffic, implement coexistence strategies, dual-write, rollout and rollback plans, while maintaining the

Qualifications

• Strong grasp of OAuth 2.0, OpenID Connect, JWT, and session management.
• Experience running services in a cloud environment with production ownership: deployment, observability, alerting, and incident response.
• Clear written and spoken English with stakeholder communication habits.
• Reading and safely changing large legacy codebases; Perl knowledge is required.
• Experience migrating authentication from legacy systems to a new identity provider on live traffic.
• Independent, evidence-led investigation of production problems spanning multiple systems.

Responsibilities

• Build and operate backend services across partner authentication.
• Lead migration workstreams from legacy Perl to Auth0 with phased cutovers.
• Maintain and modify long-lived Perl services carrying production traffic.
• Configure and extend the identity platform in Auth0 and related components.
• Lead technical investigations for login-path incidents and anomalies.
• Measure login health and run controlled experiments on migration steps.
• Support engineers and reviewers; unblock integrations and share domain knowledge.
• Participate in on-call rotations with partner-visible blast radius.

Skills

OAuth 2.0

OpenID Connect

JWT

Session management

Perl

Java

CIAM

Education

Bachelor’s degree or equivalent

Tools

Auth0

Job description

• You will work across the partner authentication estate: the services that broker authentication flows, the long-lived systems that still carry production traffic, the identity platform they run against, and the integrations that hundreds of downstream consumers depend on
• Ownership here is of problems and outcomes rather than a fixed component — what you hold changes as the migration moves, and engineers on this team are expected to follow the work rather than defend a boundary
• This is a hands‑on engineering role in a live, complex, production‑critical system, not a greenfield build. Much of the value is in understanding systems you did not write deeply enough to change them safely, and in being the person others can rely on when the login path misbehaves
• Build and operate backend services across partner authentication. Design, build, run, and evolve services that broker authentication between Booking.com’s partner systems and the identity provider — their data models, APIs, caching and consistency behaviour, and failure modes — taking full ownership of what you ship
• Deliver migration workstreams. Design and execute phased cutovers of partner authentication from the legacy Perl stack to Auth0 — coexistence strategies, dual-write and reconciliation paths, staged rollouts, and rollback plans that hold under live traffic
• Maintain and change the legacy estate. Read, debug, and safely modify long‑lived Perl services that still carry production authentication traffic, and progressively reduce our dependency on them
• Configure and extend the identity platform. Implement authentication and authorization behaviour in Auth0 — tenant and application configuration, custom logic in the authentication pipeline, connection and directory strategy, token and session design — and encode that configuration as reviewable, versioned artifacts rather than console changes
• Lead technical investigations. Act as a primary investigator for login‑path incidents and anomalies spanning our services, the identity provider, edge infrastructure, and partner integrations. Drive these to root cause, write them up, and turn findings into changes
• Measure changes on real traffic. Instrument authentication flows, define and defend the metrics that describe login health, and run controlled experiments to validate that migration steps are neutral or positive for partners
• Support the wider team and its consumers. Act as a go‑to technical reference on partner identity for engineers inside and outside PIAM: unblock integrations, review designs that touch authentication, and raise the team’s collective understanding of the domain
• Participate in on‑call for services with a direct partner‑visible blast radius

Benefits

• Health insurance
• Free access to Headspace for you and your loved ones
• Global Employee Assistance Program
• Meditation and Breastfeeding rooms at the office
• Booking Cares - 2 days per year to volunteer and learn
• Life insurance
• Disability insurance
• Pension plan
• Annual paid time off
• Parental leave - 22 weeks
• Grandparent leave - 10 days
• Care leave - 10 days
• Bereavement leave - up to 4 weeks
• Anniversary leave
• Working from Home Furniture and Ergonomic Support
• Working from Abroad - up to 20 days per year
• Discounts & Wallet credits to spend on our products
• Upgrade to Booking.com Genius Level 3
• Friends & Family Booking.com discount vouchers
• Free access to online learning platforms
• Development and mentorship programs to support career growth
• Access to trainings and workshops
• Team development opportunities
• Local discount programs
• Game rooms in offices
• On‑site meals, coffee and snacks including vegan options

Qualifications

• Strong grasp of the underlying protocols and standards — OAuth 2.0, OpenID Connect, JWT, session management — at the level of debugging, not just configuring
• Experience running services in a cloud environment, with production ownership: deployment, observability, alerting, and incident response
• Clear written and spoken English, and the communication habits that come with supporting many stakeholders: precise incident write‑ups, readable design documents, and patient explanation of identity concepts to non‑specialists
• Demonstrated ability to work productively in large legacy codebases, including reading and safely changing code in languages you did not choose. Working knowledge of Perl is required, given that our legacy authentication estate is written in it
• Experience migrating authentication from an incumbent system to a new identity provider on live traffic, including coexistence between old and new stacks, staged rollout, user and credential migration, and rollback
• A track record of independent, evidence‑led investigation of production problems that span multiple systems and organizational boundaries
• Professional backend engineering experience building and operating production services at scale in Java and Perl
• Practical, in‑depth experience with Auth0 in production: tenant and application configuration, extending the authentication pipeline with custom logic, connection and user‑store strategy, token and session design, and the operational realities of running on it
• Hands‑on delivery of customer identity and access management (CIAM) for an external, non‑employee user population — partners, merchants, customers, or similar. You have built authentication systems, not only consumed them
• Experience with controlled experimentation (A/B testing) on authentication or funnel‑critical paths, including interpreting results where traffic quality is not uniform
• Familiarity with bot, automation, and abuse traffic patterns on login endpoints, and how they distort conventional success metrics
• Experience with mobile authentication (native app OIDC flows, token lifecycle, biometric or device‑bound credentials)
• Exposure to AI‑assisted engineering workflows — coding agents, automated review, or agentic tooling in the software development lifecycle — and an interest in helping the team adopt them well
• Experience with machine‑to‑machine and API authentication for third‑party integrators