Identity Security Engineer

Constellation Brands • San Antonio, TX

23h

About The Position

The Identity Security Engineer is a hands-on security engineer responsible for designing, implementing, and operating Identity Security and IAM capabilities at Constellation Brands in support of a converged security model. The role requires deep technical knowledge of the identity security tool landscape and a proven ability to automate and optimize identity platforms, integrations, and controls to improve reliability, scalability, and measurable security outcomes. As a senior technical contributor, this engineer works closely with security architecture and engineering, security operations, OT and ICS teams, GRC, infrastructure, and network engineering to deliver secure, resilient identity solutions across enterprise and operational environments.

Requirements

• Bachelors in one of the following disciplines: Cybersecurity, Information Assurance, Computer Engineering, Electrical Engineering, Systems Engineering, Management Information Systems, or similar technical field and minimum of 8+ years related experience with a CISSP or equivalent.
• Strong understanding of identity security architecture and engineering concepts at the enterprise level.
• Demonstrated past contributor and “plugged-in” to the threat intelligence community and various industry sources.
• Understand what it means to “think like a hacker” and take the attacker viewpoint.
• Hands-on experience improving the overall IAM user experience.
• Authentication space knowledge: Multi-factor authentication (MFA). Identity Federation & Single Sign-On (SSO). Implementing SAML, OIDC, and OAuth. Security knowledge of various technology & protocols - FIDO, PKI, Mobile MFA, OTP, FIDO key, Biometric authentication, behavior & risk-based authentication. Implementation experience with web, device (laptop, etc.), infrastructure, and API authentication use cases.
• Access Management space knowledge: Privileged Access Management for admin and privileged accounts. Access control solution for Linux, Windows servers, Kubernetes/docker, databases, Clouds, and other PAM use cases. Integration with cloud systems including AWS, Azure, GCP, etc. Active Directory integration experience.
• Identity Governance space knowledge: Experience with onboarding applications into an IGA solution such as SailPoint ISC, Saviynt, etc. Experience with creating and managing user access review campaigns. Experience with automating IAM critical workflows. Familiarity with financial audit, Sarbanes-Oxley (SOX), and regulatory compliance processes. Collaborate with internal and external auditors as required.
• Experience with implementing JIT or Zero Standing Privilege access models
• Experience implementing real-time behavioral analytics to detect anomalies such as "impossible travel," credential misuse, or lateral movement, and automate responses like session termination or account isolation
• Experience with creating a centralized inventory and lifecycle management process for autonomous AI agents, service accounts, and IoT devices to prevent "identity dark matter" (unmanaged accounts)
• Experience implementing automated lifecycle management for machine identities, service accounts, and IoT devices, ensuring they are not "orphaned" or over-privileged.
• Hands-on experience performing incident response duties.
• Ability to communicate effectively with various levels of technical expertise or non-expertise (written, verbal, presentation skills).
• Organized and detail-oriented, able to work well under deadlines in a changing environment and complete multiple projects effectively and concurrently.

Nice To Haves

• Security operations and threat intelligence experience.
• Strong communicator who can partner internationally with senior security and enterprise team members.
• Self-starter who takes initiative with strong conviction.

Responsibilities

• Serve as a hands-on subject matter expert for Identity Security and IAM, with deep technical ownership of core identity platforms, protocols, and control implementations.
• Provide engineering-driven input into IAM technical strategy, roadmaps, and milestones, and translate complex identity concepts into executive-ready technical summaries.
• Lead IAM engineering efforts including architecture design, tool and vendor evaluations, system integrations, deployments, upgrades, and performance tuning, while providing technical mentorship to peer engineers.
• Design and implement identity security controls and processes aligned to security architecture standards and engineering best practices, leveraging frameworks such as ISO/IEC, NIST, and MITRE ATT&CK for identity threat coverage.
• Own day-to-day IAM platform operations, including policy and rule configuration, role and entitlement modeling, access lifecycle automation, and continuous optimization across the identity stack.
• Conduct secure design and architecture reviews with a focus on identity threat modeling, privilege boundaries, authentication flows, and attack surface reduction.
• Develop and automate identity security metrics, logging, and telemetry to measure control effectiveness, detection coverage, and incident response performance, using historical data to drive technical improvements.
• Integrate IAM platforms with SecOps workflows, SOAR tooling, and OT and ICS environments, supporting solution selection, production deployment, and development of detailed technical runbooks.
• Participate in on-call rotations and incident response to support 24/7/365 identity platform availability and security operations.

Benefits

• We offer comprehensive package of benefits including paid time off, medical/dental/vision insurance, 401(k), and any other benefits to eligible employees.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level