Lead Active Directory Engineer

Overview

Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as knowledge resource for and trains less experienced engineers. Completes day-to-day support activities and special projects.

Primary Responsibilities

• Enterprise Active Directory Architecture
• Proven expertise supporting large-scale, Tier‑1 identity infrastructures with strict uptime, latency, and change‑control requirements
• Strong experience with:
• Multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries
• Forest and external trusts supporting M&A, joint ventures, and third-party integrations
• FSMO role placement optimized for resilience and auditability
• Advanced understanding of Active Directory–integrated DNS, split‑brain DNS, and secure name resolution models
• Hybrid Identity & Microsoft Entra ID (Azure AD)
• Extensive experience integrating on-prem AD with Microsoft Entra ID in regulated financial environments
• Hands-on implementation of:
• Entra Connect (Cloud Sync and Traditional)
• Password Hash Sync, Pass-through Authentication, and Federation
• Strong experience with:
• Conditional Access aligned to regulatory and risk-based controls
• Hybrid Join, Entra ID Join, and legacy device coexistence
• Security, Compliance & Risk Controls
• Expert-level knowledge of Active Directory security hardening in financial services, including:
• Tiered administrative model (Tier 0/1/2)
• Dedicated admin forests or hardened admin boundaries (where applicable)
• Privileged Access Workstations (PAWs) / Secure Admin Workstations
• Experience enforcing least privilege, role separation, and dual‑control models
• Deep familiarity with threats targeting financial institutions:
• Credential theft, Kerberoasting, Pass-the-Hash/Ticket
• Delegation and ACL abuse
• Advanced PowerShell expertise for:
• Controlled, auditable administrative changes
• Automated provisioning/deprovisioning aligned to compliance workflows
• Identity reporting for risk, security, and audit teams
• Experience building automation that integrates with:
• Change management processes
• IAM, ticketing, and security tooling
• Operations, Resilience & Recovery
• Deep experience managing:
• AD replication topology across data centers and regions
• SYSVOL (DFSR) health and recovery
• Latency-sensitive authentication dependencies
• Strong understanding of:
• AD backup, recovery, and authoritative restore procedures
• Identity disaster recovery scenarios with defined RTO/RPO
• Leadership & Governance
• Acts as technical authority and escalation point for all directory and identity services
• Defines and enforces:
• Enterprise identity standards
• Secure configuration baselines
• Operational runbooks and procedures
• Partners closely with:
• Information Security and IAM teams
• Risk, audit, and compliance stakeholders
• Infrastructure, cloud, and application teams
• Mentors engineers and reviews designs from a security and risk-first perspective

Education and Experience

• Required: Bachelor's degree and a minimum of 5 years’ relevant work experience, or in lieu of a degree, a combined minimum of 9 years’ higher education and/or work experience
• PREFERRED: Advanced understanding of the security system development and infrastructure lifecycle and architecture, and systems design
• Proven experience with the development and customization of tools utilized in assigned Cybersecurity function
• Demonstrated ability to translate architecture into technical requirements
• Proficient level of critical thinking and problem solving ability
• Excellent communication and interpersonal skills
• Experience partnering with leaders to design solutions to business needs
• Proficient persuasive communication skills to gain buy-in of others
• Strong ability to analyze and draw reliable conclusions based on large volumes of quantitative data from diverse sources
• Able to effectively serve in an indirect leadership role

Pay

#Hybrid M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $128,100.00 - $213,500.00 (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation.

Location

Wilmington, Delaware, United States of America