Lead Active Directory Engineer

M&T Bank•Buffalo, NY

2d•$116,400 - $194,000•Hybrid

About The Position

Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as a knowledge resource and trains less experienced engineers while completing day-to-day support activities and special projects. The role provides technical authority for enterprise directory and identity services, including architecture, hybrid identity, security controls, audit readiness, automation, operations, resilience, and recovery. It partners with Information Security, IAM, risk, audit, compliance, infrastructure, cloud, and application teams. The position is four days onsite at Seneca One in Buffalo, New York, with the flexibility to work from home one day per week.

Requirements

Bachelor's degree and at least 5 years of relevant work experience, or a combined minimum of 9 years of higher education and/or work experience in lieu of a degree.
Proven expertise supporting large-scale, Tier 1 identity infrastructures with strict uptime, latency, and change-control requirements.
Strong experience with multi-domain and multi-forest designs, forest and external trusts, FSMO role placement, and Active Directory-integrated DNS.
Extensive experience integrating on-premises Active Directory with Microsoft Entra ID in regulated financial environments.
Hands-on experience with Entra Connect Cloud Sync and traditional Entra Connect, Password Hash Sync, Pass-through Authentication, and federation.
Strong experience with Conditional Access, Hybrid Join, Entra ID Join, and legacy device coexistence.
Understanding of identity lifecycle controls for joiners, movers, and leavers, and separation-of-duties requirements.
Expert-level knowledge of Active Directory security hardening in financial services, including tiered administration, hardened administrative boundaries, and Privileged Access Workstations or Secure Admin Workstations.
Experience enforcing least privilege, role separation, and dual-control models.
Deep familiarity with identity threats such as credential theft, Kerberoasting, Pass-the-Hash/Ticket, delegation abuse, and ACL abuse.
Hands-on experience with Privileged Identity Management, access reviews, and entitlement recertification.
Experience supporting financial regulations and frameworks such as SOX, GLBA, PCI DSS, and SOC 2, as well as internal risk management and model governance requirements.
Advanced PowerShell expertise and experience integrating automation with change management, IAM, ticketing, and security tooling.
Deep experience managing AD replication topology, SYSVOL (DFSR), and authentication dependencies.
Strong understanding of AD backup, recovery, authoritative restore, and identity disaster recovery procedures.
Experience implementing monitoring and alerting for early risk detection.

Nice To Haves

Advanced understanding of security system development and the infrastructure lifecycle, architecture, and systems design.
Experience developing and customizing tools used in the assigned Cybersecurity function.
Ability to translate architecture into technical requirements.
Proficient critical-thinking and problem-solving ability.
Excellent communication and interpersonal skills.
Experience partnering with leaders to design solutions for business needs.
Persuasive communication skills to gain buy-in.
Ability to analyze large volumes of quantitative data from diverse sources and draw reliable conclusions.
Ability to serve effectively in an indirect leadership role.

Responsibilities

Design, secure, and operate Microsoft Active Directory Domain Services in regulated, high-availability environments.
Provide day-to-day support and complete special projects.
Serve as a technical authority and escalation point for directory and identity services.
Define and enforce enterprise identity standards, secure configuration baselines, and operational runbooks and procedures.
Support audits and regulatory controls, including strong logging, traceability, tamper-resistant audit logs, and evidence generation for auditors.
Develop PowerShell automation for controlled administrative changes, compliant provisioning and deprovisioning, and identity reporting.
Manage Active Directory replication, SYSVOL health and recovery, and latency-sensitive authentication dependencies.
Implement monitoring and alerting focused on early risk detection, and support identity disaster recovery and defined RTO/RPO.
Partner with Information Security, IAM, risk, audit, compliance, infrastructure, cloud, and application teams.
Mentor engineers and review designs from a security- and risk-first perspective.