Impress employers and recruiters.
Choose from hundreds of resume examples.
Impress employers and recruiters.
Choose from hundreds of resume examples.
Target Resume Now
Tailor your resume to this Lead Active Directory Engineer role.
Rezi rewrites your resume against M&T Bank's job description. Free.
Tailor your resume to this Lead Active Directory Engineer role.
Rezi rewrites your resume against M&T Bank's job description. Free.
Don't guess if your resume is good enough.
See how it scores against the Lead Active Directory Engineer posting at M&T Bank — free, in seconds.
Don't guess if your resume is good enough.
See how it scores against the Lead Active Directory Engineer posting at M&T Bank — free, in seconds.
About the Role
Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as a knowledge resource and trains less experienced engineers, completing day-to-day support activities and special projects.
Responsibilities
- Design, secure, and operate Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments.
- Provide expertise and training to less experienced engineers.
- Complete day-to-day support activities and special projects.
- Support large-scale, Tier-1 identity infrastructures with strict uptime, latency, and change-control requirements.
- Implement multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries.
- Configure forest and external trusts supporting M&A, joint ventures, and third-party integrations.
- Optimize FSMO role placement for resilience and auditability.
- Manage Active Directory–integrated DNS, split-brain DNS, and secure name resolution models.
- Integrate on-prem AD with Microsoft Entra ID in regulated financial environments.
- Implement Entra Connect (Cloud Sync and Traditional).
- Configure Password Hash Sync, Pass-through Authentication, and Federation.
- Implement Conditional Access aligned to regulatory and risk-based controls.
- Manage Hybrid Join, Entra ID Join, and legacy device coexistence.
- Implement identity lifecycle controls for joiners, movers, leavers, and separation-of-duties requirements.
- Apply expert-level knowledge of Active Directory security hardening in financial services, including tiered administrative models and dedicated admin forests.
- Enforce least privilege, role separation, and dual-control models.
- Implement Privileged Identity Management (PIM).
- Conduct regular access reviews and entitlement recertification.
- Align with Zero Trust and defense-in-depth identity strategies.
- Support audits and controls for financial regulations and frameworks (SOX, GLBA, PCI DSS, SOC 2).
- Design AD environments that support strong logging, traceability, tamper-resistant audit logs, and evidence generation.
- Utilize advanced PowerShell for administrative changes, automated provisioning/deprovisioning, and identity reporting.
- Build automation that integrates with change management processes, IAM, ticketing, and security tooling.
- Manage AD replication topology across data centers and regions.
- Ensure SYSVOL (DFSR) health and recovery.
- Address latency-sensitive authentication dependencies.
- Perform AD backup, recovery, and authoritative restore procedures.
- Manage identity disaster recovery scenarios with defined RTO/RPO.
- Implement monitoring and alerting for early risk detection.
- Act as a technical authority and escalation point for directory and identity services.
- Define and enforce enterprise identity standards, secure configuration baselines, and operational runbooks.
- Partner with Information Security, IAM, risk, audit, compliance, infrastructure, cloud, and application teams.
- Mentor engineers and review designs from a security and risk-first perspective.
Requirements
- Proven expertise supporting large-scale, Tier-1 identity infrastructures with strict uptime, latency, and change-control requirements.
- Strong experience with multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries.
- Strong experience with forest and external trusts supporting M&A, joint ventures, and third-party integrations.
- Advanced understanding of Active Directory–integrated DNS, split-brain DNS, and secure name resolution models.
- Extensive experience integrating on-prem AD with Microsoft Entra ID in regulated financial environments.
- Hands-on implementation of Entra Connect (Cloud Sync and Traditional).
- Hands-on implementation of Password Hash Sync, Pass-through Authentication, and Federation.
- Strong experience with Conditional Access aligned to regulatory and risk-based controls.
- Strong experience with Hybrid Join, Entra ID Join, and legacy device coexistence.
- Understanding of identity lifecycle controls to support joiners, movers, leavers, and separation-of-duties requirements.
- Expert-level knowledge of Active Directory security hardening in financial services, including Tier 0/1/2 administrative models and dedicated admin forests.
- Experience enforcing least privilege, role separation, and dual-control models.
- Deep familiarity with threats targeting financial institutions: Credential theft, Kerberoasting, Pass-the-Hash/Ticket, Delegation and ACL abuse.
- Hands-on experience with Privileged Identity Management (PIM).
- Hands-on experience with regular access reviews and entitlement recertification.
- Strong alignment with Zero Trust and defense-in-depth identity strategies.
- Demonstrated experience supporting audits and controls for financial regulations and frameworks, such as SOX, GLBA, PCI DSS, SOC 2.
- Demonstrated experience supporting internal risk management and model governance requirements.
- Ability to design AD environments that support strong logging and traceability, tamper-resistant audit logs, and evidence generation for internal and external auditors.
- Advanced PowerShell expertise for controlled, auditable administrative changes, automated provisioning/deprovisioning aligned to compliance workflows, and identity reporting.
- Experience building automation that integrates with change management processes, IAM, ticketing, and security tooling.
- Deep experience managing AD replication topology across data centers and regions.
- Deep experience managing SYSVOL (DFSR) health and recovery.
- Deep experience managing latency-sensitive authentication dependencies.
- Strong understanding of AD backup, recovery, and authoritative restore procedures.
- Strong understanding of identity disaster recovery scenarios with defined RTO/RPO.
- Experience implementing monitoring and alerting with a focus on early risk detection.
- Acts as technical authority and escalation point for all directory and identity services.
- Defines and enforces enterprise identity standards, secure configuration baselines, and operational runbooks and procedures.
- Partners closely with Information Security and IAM teams, Risk, audit, and compliance stakeholders, and Infrastructure, cloud, and application teams.
- Mentors engineers and reviews designs from a security and risk-first perspective.
- Bachelor's degree and a minimum of 5 years’ relevant work experience, or in lieu of a degree, a combined minimum of 9 years’ higher education and/or work experience.
- Advanced understanding of the security system development and infrastructure lifecycle and architecture, and systems design.
- Proven experience with the development and customization of tools utilized in assigned Cybersecurity function.
- Demonstrated ability to translate architecture into technical requirements.
- Proficient level of critical thinking and problem solving ability.
- Excellent communication and interpersonal skills.
- Experience partnering with leaders to design solutions to business needs.
- Proficient persuasive communication skills to gain buy-in of others.
- Strong ability to analyze and draw reliable conclusions based on large volumes of quantitative data from diverse sources.
- Ability effectively serves in indirect leadership role.
Skills
- Microsoft Active Directory Domain Services (AD DS)
- Microsoft Entra ID (Azure AD)
- Entra Connect
- PowerShell
- Identity and Access Management (IAM)
- Security Hardening
- Privileged Identity Management (PIM)
- Zero Trust
- Defense-in-Depth
- SOX
- GLBA
- PCI DSS
- SOC 2
- Critical Thinking
- Problem Solving
- Communication
- Interpersonal Skills
- Persuasive Communication
- Data Analysis
Location
- Buffalo, New York, United States of America
Work Type
- Onsite
- Hybrid
Experience Level
- 5+ years relevant work experience
- 9+ years combined higher education and/or work experience (in lieu of degree)
Education Level
- Bachelor's degree
- Higher education
Salary/Compensations
- $116,400.00 - $194,000.00 Annual (USD)
About the Company
- M&T Bank is committed to fair, competitive, and market-informed pay for our employees.