Lead Active Directory Engineer

This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week

Overview:   

Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as knowledge resource for and trains less experienced engineers. Completes day-to-day support activities and special projects.

Primary Responsibilities:

• Enterprise Active Directory Architecture
  • Proven expertise supporting large-scale, Tier‑1 identity infrastructures with strict uptime, latency, and change‑control requirements
  • Strong experience with:
    • Multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries
    • Forest and external trusts supporting M&A, joint ventures, and third-party integrations
    • FSMO role placement optimized for resilience and auditability
  • Advanced understanding of Active Directory–integrated DNS, split‑brain DNS, and secure name resolution models
• Hybrid Identity & Microsoft Entra ID (Azure AD)
  • Extensive experience integrating on-prem AD with Microsoft Entra ID in regulated financial environments
  • Hands-on implementation of:
    • Entra Connect (Cloud Sync and Traditional)
    • Password Hash Sync, Pass-through Authentication, and Federation
  • Strong experience with:
    • Conditional Access aligned to regulatory and risk-based controls
    • Hybrid Join, Entra ID Join, and legacy device coexistence
  • Understanding of identity lifecycle controls to support joiners, movers, leavers, and separation-of-duties requirements
• Security, Compliance & Risk Controls
  • Expert-level knowledge of Active Directory security hardening in financial services, including:
    • Tiered administrative model (Tier 0/1/2)
    • Dedicated admin forests or hardened admin boundaries (where applicable)
    • Privileged Access Workstations (PAWs) / Secure Admin Workstations
  • Experience enforcing least privilege, role separation, and dual‑control models
  • Deep familiarity with threats targeting financial institutions:
    • Credential theft, Kerberoasting, Pass-the-Hash/Ticket
    • Delegation and ACL abuse
  • Hands-on experience with:
    • Privileged Identity Management (PIM)
    • Regular access reviews and entitlement recertification
  • Strong alignment with Zero Trust and defense-in-depth identity strategies
• Regulatory & Audit Readiness
  • Demonstrated experience supporting audits and controls for financial regulations and frameworks, such as:
    • SOX, GLBA, PCI DSS, SOC 2
    • Internal risk management and model governance requirements
  • Ability to design AD environments that support:
    • Strong logging and traceability
    • Tamper-resistant audit logs
    • Evidence generation for internal and external auditors
• Automation & PowerShell
  • Advanced PowerShell expertise for:
    • Controlled, auditable administrative changes
    • Automated provisioning/deprovisioning aligned to compliance workflows
    • Identity reporting for risk, security, and audit teams
  • Experience building automation that integrates with:
    • Change management processes
    • IAM, ticketing, and security tooling
• Operations, Resilience & Recovery
  • Deep experience managing:
    • AD replication topology across data centers and regions
    • SYSVOL (DFSR) health and recovery
    • Latency-sensitive authentication dependencies
  • Strong understanding of:
    • AD backup, recovery, and authoritative restore procedures
    • Identity disaster recovery scenarios with defined RTO/RPO
  • Experience implementing monitoring and alerting with a focus on early risk detection
• Leadership & Governance
  • Acts as technical authority and escalation point for all directory and identity services
  • Defines and enforces:
    • Enterprise identity standards
    • Secure configuration baselines
    • Operational runbooks and procedures
  • Partners closely with:
    • Information Security and IAM teams
    • Risk, audit, and compliance stakeholders
    • Infrastructure, cloud, and application teams
  • Mentors engineers and reviews designs from a security and risk-first perspective

Education and Experience Required:

• Bachelor's degree and a minimum of 5 years’ relevant work experience, or in lieu of a degree, a combined minimum of 9 years’ higher education and/or work experience

Education and Experience Preferred:

• Advanced understanding of the security system development and infrastructure lifecycle and architecture, and systems design
• Proven experience with the development and customization of tools utilized in assigned Cybersecurity function
• Demonstrated ability to translate architecture into technical requirements
• Proficient level of critical thinking and problem solving ability
• Excellent communication and interpersonal skills
• Experience partnering with leaders to design solutions to business needs.
• Proficient persuasive communication skills to gain buy-in of others
• Strong ability to analyze and draw reliable conclusions based on large volumes of quantitative data from diverse sources
• Ability effectively serves in indirect leadership role

M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $116,400.00 - $194,000.00 Annual (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation.

Location

Buffalo, New York, United States of America