Identity Security Engineer

Job Description

Company Summary

We're the producers, creators and marketers of beer, wine and spirits brands that people love. At Constellation Brands, we're driven to push boundaries and think beyond today to deliver products and experiences that resonate now, tomorrow and well into the future. With operations in the U.S., Mexico, New Zealand and Italy, our premium portfolio of iconic brands includes Modelo Especial, Corona Extra, Modelo Cheladas, Pacifico, Victoria, The Prisoner Wine Company, Robert Mondavi Winery, Kim Crawford, Schrader Cellars, Lingua Franca, Casa Noble Tequila, and High West Whiskey. But we're just getting started. Our ability to stay on the forefront of consumer trends has fueled our success since our founding in 1945 and will guide us in creating the next generation of products and experiences Worth Reaching For.

Position Summary:

• Serve as a hands-on subject matter expert for Identity Security and IAM, with deep technical ownership of core identity platforms, protocols, and control implementations.
• Provide engineering-driven input into IAM technical strategy, roadmaps, and milestones, and translate complex identity concepts into executive-ready technical summaries.
• Lead IAM engineering efforts including architecture design, tool and vendor evaluations, system integrations, deployments, upgrades, and performance tuning, while providing technical mentorship to peer engineers.
• Design and implement identity security controls and processes aligned to security architecture standards and engineering best practices, leveraging frameworks such as ISO/IEC, NIST, and MITRE ATT&CK for identity threat coverage.
• Own day-to-day IAM platform operations, including policy and rule configuration, role and entitlement modeling, access lifecycle automation, and continuous optimization across the identity stack.
• Conduct secure design and architecture reviews with a focus on identity threat modeling, privilege boundaries, authentication flows, and attack surface reduction.
• Develop and automate identity security metrics, logging, and telemetry to measure control effectiveness, detection coverage, and incident response performance, using historical data to drive technical improvements.
• Integrate IAM platforms with SecOps workflows, SOAR tooling, and OT and ICS environments, supporting solution selection, production deployment, and development of detailed technical runbooks.
• Participate in on-call rotations and incident response to support 24/7/365 identity platform availability and security operations.

• Bachelors in one of the following disciplines: Cybersecurity, Information Assurance, Computer Engineering, Electrical Engineering, Systems Engineering, Management Information Systems, or similar technical field and minimum of 8+ years related experience with a CISSP or equivalent.
• Strong understanding of identity security architecture and engineering concepts at the enterprise level.
• Demonstrated past contributor and "plugged-in" to the threat intelligence community and various industry sources.
• Understand what it means to "think like a hacker" and take the attacker viewpoint.
• Hands-on experience improving the overall IAM user experience.
• Authentication space knowledge:
  • Multi-factor authentication (MFA).
  • Identity Federation & Single Sign-On (SSO).
  • Implementing SAML, OIDC, and OAuth.
  • Security knowledge of various technology & protocols - FIDO, PKI, Mobile MFA, OTP, FIDO key, Biometric authentication, behavior & risk-based authentication.
  • Implementation experience with web, device (laptop, etc.), infrastructure, and API authentication use cases.
• Access Management space knowledge:
  • Privileged Access Management for admin and privileged accounts.
  • Access control solution for Linux, Windows servers, Kubernetes/docker, databases, Clouds, and other PAM use cases.
  • Integration with cloud systems including AWS, Azure, GCP, etc.
  • Active Directory integration experience.
• Identity Governance space knowledge:
  • Experience with onboarding applications into an IGA solution such as SailPoint ISC, Saviynt, etc.
  • Experience with creating and managing user access review campaigns.
  • Experience with automating IAM critical workflows.
  • Familiarity with financial audit, Sarbanes-Oxley (SOX), and regulatory compliance processes.
  • Collaborate with internal and external auditors as required.
• Experience with implementing JIT or Zero Standing Privilege access models
• Experience implementing real-time behavioral analytics to detect anomalies such as "impossible travel," credential misuse, or lateral movement, and automate responses like session termination or account isolation
• Experience with creating a centralized inventory and lifecycle management process for autonomous AI agents, service accounts, and IoT devices to prevent "identity dark matter" (unmanaged accounts)
• Experience implementing automated lifecycle management for machine identities, service accounts, and IoT devices, ensuring they are not "orphaned" or over-privileged.
• Hands-on experience performing incident response duties.
• Ability to communicate effectively with various levels of technical expertise or non-expertise (written, verbal, presentation skills).
• Organized and detail-oriented, able to work well under deadlines in a changing environment and complete multiple projects effectively and concurrently.

• Security operations and threat intelligence experience.
• Strong communicator who can partner internationally with senior security and enterprise team members.
• Self-starter who takes initiative with strong conviction.

• Occasional lifting up to 25 lbs.
• Sitting, working at desk/personal computer for extended periods of time
• Primary work environment is professional corporate office
• Ability to travel commercially and internationally