Lead Active Directory Engineer

M&T Bank•Buffalo, NY

1d•$116,400 - $194,000•Hybrid

About The Position

Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Serves as a knowledge resource and trains less experienced engineers while completing day-to-day support activities and special projects. The role is four days onsite at the Seneca One location in Buffalo, New York, with the flexibility to work from home one day per week. The engineer provides technical authority and escalation support for directory and identity services, defines and enforces enterprise identity standards, secure configuration baselines, and operational runbooks, and partners with Information Security, IAM, risk, audit, compliance, infrastructure, cloud, and application teams. The role also mentors engineers and reviews designs using a security- and risk-first perspective.

Requirements

Bachelor's degree and a minimum of 5 years of relevant work experience, or, in lieu of a degree, a combined minimum of 9 years of higher education and/or work experience.
Expertise supporting large-scale, Tier-1 identity infrastructures with strict uptime, latency, and change-control requirements.
Strong experience with multi-domain and multi-forest designs, forest and external trusts, FSMO role placement, and Active Directory-integrated DNS.
Extensive experience integrating on-premises Active Directory with Microsoft Entra ID in regulated financial environments.
Hands-on experience with Entra Connect Cloud Sync and traditional synchronization, Password Hash Sync, Pass-through Authentication, and federation.
Experience with Conditional Access, Hybrid Join, Entra ID Join, and legacy device coexistence.
Understanding of identity lifecycle controls and separation-of-duties requirements.
Expert-level knowledge of Active Directory security hardening in financial services, including tiered administrative models, hardened administrative boundaries, privileged access workstations, least privilege, role separation, and dual control.
Familiarity with threats including credential theft, Kerberoasting, Pass-the-Hash, ticket delegation, and ACL abuse.
Hands-on experience with Privileged Identity Management, regular access reviews, and entitlement recertification.
Knowledge of Zero Trust and defense-in-depth identity strategies.
Experience supporting audits and controls for SOX, GLBA, PCI DSS, SOC 2, and internal risk management and model governance requirements.
Ability to design Active Directory environments supporting strong logging and traceability, tamper-resistant audit logs, and audit evidence generation.
Advanced PowerShell expertise for controlled and auditable changes, automated provisioning and deprovisioning, and identity reporting.
Experience building automation integrated with change management, IAM, ticketing, and security tooling.
Experience managing Active Directory replication across data centers and regions, SYSVOL (DFSR) health and recovery, and latency-sensitive authentication dependencies.
Knowledge of Active Directory backup, recovery, authoritative restore, and identity disaster recovery procedures with defined RTO/RPO.
Advanced understanding of security system development and infrastructure lifecycle and architecture, and systems design.
Experience developing and customizing tools used in the assigned cybersecurity function.
Ability to translate architecture into technical requirements.
Critical-thinking and problem-solving ability.
Excellent communication and interpersonal skills, including persuasive communication to gain buy-in.
Experience partnering with leaders to design solutions to business needs.
Ability to analyze large volumes of quantitative data from diverse sources and draw reliable conclusions.
Ability to serve effectively in an indirect leadership role.

Nice To Haves

Advanced understanding of the security system development and infrastructure lifecycle and architecture, and systems design.
Proven experience with the development and customization of tools utilized in the assigned Cybersecurity function.
Demonstrated ability to translate architecture into technical requirements.
Experience partnering with leaders to design solutions to business needs.
Ability to serve effectively in an indirect leadership role.

Responsibilities

Design, secure, and operate Microsoft Active Directory Domain Services in regulated, high-availability environments.
Support large-scale, Tier-1 identity infrastructures with strict uptime, latency, and change-control requirements.
Design multi-domain and multi-forest environments, trusts, FSMO role placement, and Active Directory-integrated DNS models.
Integrate on-premises Active Directory with Microsoft Entra ID, including synchronization, authentication, conditional access, and device-join models.
Implement identity lifecycle controls for joiners, movers, leavers, and separation-of-duties requirements.
Harden Active Directory and enforce least privilege, role separation, dual-control models, and privileged access controls.
Support regulatory audits and controls, including logging, traceability, audit evidence, and risk-management requirements.
Develop PowerShell automation for auditable administration, provisioning and deprovisioning, identity reporting, and integrations with change management, IAM, ticketing, and security tools.
Manage Active Directory replication, SYSVOL health and recovery, authentication dependencies, backups, authoritative restores, and identity disaster recovery.
Implement monitoring and alerting for early risk detection.
Act as technical authority and escalation point for directory and identity services.
Define and enforce enterprise identity standards, secure configuration baselines, operational runbooks, and procedures.
Partner with information security, IAM, risk, audit, compliance, infrastructure, cloud, and application teams.
Mentor engineers and review designs from a security- and risk-first perspective.
Complete day-to-day support activities and special projects.