Application Security and Identity Manager

Job Posting External

Primary Responsibilities

• Team Leadership: Lead application security and identity professionals responsible for access governance, authentication services, application security assessments, and identity administration.
• Program Management: Develop and execute strategic roadmaps for identity governance, privileged access management, application security, and authentication modernization.
• Stakeholder Engagement: Partner with business units, IT leaders, developers, and system owners to align security requirements with business needs.
• Process Improvement: Establish standards, procedures, and operational metrics to improve security effectiveness and operational efficiency.
• Identity Governance: Oversee user lifecycle processes, including provisioning, modifications, transfers, and terminations across enterprise systems.
• Access Reviews and Compliance: Ensure periodic access certifications, segregation of duties reviews, and access governance controls are executed effectively.
• Privileged Access Management: Lead implementation and operation of privileged account controls, credential vaulting, and least-privilege initiatives.
• Authentication Services: Manage multifactor authentication, single sign-on, federation, and directory service capabilities to improve security and user experience.
• Secure Development Practices: Partner with development teams to integrate security requirements into the software development lifecycle.
• Application Security Testing: Oversee security assessments, including static and dynamic application security testing, code reviews, penetration testing, and vulnerability remediation.
• Risk Management: Identify and prioritize application and identity-related risks and drive remediation efforts with application owners.
• Security Architecture Reviews: Evaluate new applications and technology solutions to ensure alignment with Crown cybersecurity standards.
• Strategic Planning: Define and execute long-term identity and application security strategies aligned with organizational risk management objectives.
• Metrics and Reporting: Develop dashboards and executive reports on access governance, privileged access, application vulnerabilities, remediation efforts, and program maturity.
• Executive Communications: Present cybersecurity risks, program progress, and investment priorities to leadership and audit stakeholders.

Minimum Qualifications

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related discipline, along with at least 5 years related experience
• Non-degree candidates may be considered with 12 or more years of related experience and a high school diploma or GED.
• Occasional travel and overnight stays, approximately 0-5%

Preferred Qualifications

• Experience managing identity governance and administration platforms such as SailPoint or Saviynt.
• Experience with Microsoft Entra ID, Active Directory, multifactor authentication, single sign-on, privileged access management, and access governance solutions.
• Strong knowledge of secure software development lifecycle practices.
• Experience with application security testing tools, vulnerability management, and remediation programs.
• Relevant certifications such as CISSP, CISM, CRISC, identity management, or cloud security certifications are preferred.
• Excellent leadership, communication, problem-solving, analytical, and stakeholder management skills.
• Knowledge of the company's culture and values and the ability to facilitate positive relationships between business groups.