Senior Active Directory Engineer

This role is **four** days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week **Overview:**    ================ Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as knowledge resource for and trains less experienced engineers. Completes day-to-day support activities and special projects. **Primary Responsibilities:** ----------------------------- **Enterprise Active Directory Architecture** * Proven expertise supporting **large-scale, Tier‑1 identity infrastructures** with strict uptime, latency, and change‑control requirements * Strong experience with: * Multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries * Forest and external trusts supporting M&A, joint ventures, and third-party integrations * FSMO role placement optimized for resilience and auditability * Advanced understanding of **Active Directory–integrated DNS**, split‑brain DNS, and secure name resolution models **Hybrid Identity & Microsoft Entra ID (Azure AD)** * Extensive experience integrating on-prem AD with **Microsoft Entra ID** in regulated financial environments * Hands-on implementation of: * Entra Connect (Cloud Sync and Traditional) * Password Hash Sync, Pass-through Authentication, and Federation * Strong experience with: * Conditional Access aligned to regulatory and risk-based controls * Hybrid Join, Entra ID Join, and legacy device coexistence * Understanding of **identity lifecycle controls** to support joiners, movers, leavers, and separation-of-duties requirements **Security, Compliance & Risk Controls** * Expert-level knowledge of **Active Directory security hardening** in financial services, including: * Tiered administrative model (Tier 0/1/2) * Dedicated admin forests or hardened admin boundaries (where applicable) * Privileged Access Workstations (PAWs) / Secure Admin Workstations * Experience enforcing **least privilege**, role separation, and **dual‑control** models * Deep familiarity with threats targeting financial institutions: * Credential theft, Kerberoasting, Pass-the-Hash/Ticket * Delegation and ACL abuse * Hands-on experience with: * Privileged Identity Management (PIM) * Regular access reviews and entitlement recertification * Strong alignment with **Zero Trust** and defense-in-depth identity strategies **Regulatory & Audit Readiness** * Demonstrated experience supporting audits and controls for financial regulations and frameworks, such as: * SOX, GLBA, PCI DSS, SOC 2 * Internal risk management and model governance requirements * Ability to design AD environments that support: * Strong logging and traceability * Tamper-resistant audit logs * Evidence generation for internal and external auditors **Automation & PowerShell** * Advanced **PowerShell** expertise for: * Controlled, auditable administrative changes * Automated provisioning/deprovisioning aligned to compliance workflows * Identity reporting for risk, security, and audit teams * Experience building automation that integrates with: * Change management processes * IAM, ticketing, and security tooling **Operations, Resilience & Recovery** * Deep experience managing: * AD replication topology across data centers and regions * SYSVOL (DFSR) health and recovery * Latency-sensitive authentication dependencies * Strong understanding of: * AD backup, recovery, and **authoritative restore procedures** * Identity disaster recovery scenarios with defined RTO/RPO * Experience implementing **monitoring and alerting** with a focus on early risk detection **Leadership & Governance** * Acts as **technical authority and escalation point** for all directory and identity services * Defines and enforces: * Enterprise identity standards * Secure configuration baselines * Operational runbooks and procedures * Partners closely with: * Information Security and IAM teams * Risk, audit, and compliance stakeholders * Infrastructure, cloud, and application teams * Mentors engineers and reviews designs from a **security and risk-first** perspective **Education and Exp****erience Required:** ------------------------------------------ * Bachelor's degree and a minimum of 3 years’ relevant work experience, or in lieu of a degree, a combined minimum of 7 years’ higher education and/or work experience **Education and Experience Preferred:** --------------------------------------- * Intermediate understanding of the security system development and infrastructure lifecycle and architecture, and systems design * Proven experience with the tools utilized in assigned Cybersecurity function * Experience translating architecture into technical requirements. * Proficient level of critical thinking and problem solving * Excellent written and verbal communication skills * Proven experience collaborating with leaders to execute results. * Prior experience seeking buy-in of others to align on processes. * Ability to analyze and draw conclusions based on quantitative data from multiple sources. M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $97,100.00 - $161,800.00 (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation. **Location** ============ Buffalo, New York, United States of America