Lead Active Directory Engineer (Microsoft Entra ID)

Location: Hybrid role in Buffalo, New York, United States; four days onsite at the Seneca One Buffalo location and one day working from home per week.

Salary: $116,400–$194,000 annual USD.

Company

M&T Bank provides banking and financial services in a regulated environment.

What you will do

• Design, secure, operate, and govern large-scale, Tier-1 Microsoft Active Directory Domain Services environments.
• Architect multi-domain, multi-forest, trust, FSMO, and Active Directory-integrated DNS solutions for business, regional, regulatory, and integration requirements.
• Integrate on-premises Active Directory with Microsoft Entra ID using Entra Connect, Cloud Sync, Password Hash Sync, Pass-through Authentication, and federation.
• Implement identity security controls including tiered administration, privileged access workstations, least privilege, dual control, PIM, access reviews, and Zero Trust practices.
• Build auditable PowerShell automation for provisioning, deprovisioning, reporting, change management, IAM, ticketing, and security tooling.
• Manage replication, SYSVOL, backup and authoritative recovery, disaster recovery, monitoring, alerting, audit readiness, standards, runbooks, escalations, and technical mentorship.

Requirements

• Bachelor’s degree and at least 5 years of relevant work experience, or, in lieu of a degree, a combined minimum of 9 years of higher education and/or work experience.
• Proven expertise supporting large-scale, Tier-1 Active Directory infrastructures with strict uptime, latency, and change-control requirements.
• Strong experience with multi-domain and multi-forest designs, external and forest trusts, FSMO placement, Active Directory-integrated DNS, split-brain DNS, and secure name resolution.
• Extensive experience integrating on-premises Active Directory with Microsoft Entra ID in regulated financial environments, including hybrid join, Entra ID Join, legacy device coexistence, Conditional Access, and identity lifecycle controls.
• Expert knowledge of Active Directory security hardening, tiered administrative models, dedicated or hardened administrative boundaries, PAWs, least privilege, role separation, dual control, credential threats, delegation, and ACL abuse.
• Hands-on experience with PIM, access reviews, entitlement recertification, SOX, GLBA, PCI DSS, SOC 2, audit logging, traceability, tamper-resistant logs, and evidence generation.
• Advanced PowerShell expertise for controlled administrative changes, compliance-aligned provisioning and deprovisioning, identity reporting, and tool integrations.
• Deep experience with AD replication across data centers and regions, SYSVOL/DFSR health and recovery, authentication dependencies, backup, authoritative restore, RTO/RPO, monitoring, and alerting.
• Ability to act as a technical authority, define enterprise identity standards and secure configuration baselines, partner with security, IAM, risk, audit, compliance, infrastructure, cloud, and application teams, mentor engineers, and review designs from a security- and risk-first perspective.

Nice to have

• Advanced understanding of security system development, infrastructure lifecycle, architecture, and systems design.
• Experience developing and customizing tools for cybersecurity functions and translating architecture into technical requirements.
• Proficient critical thinking, problem-solving, communication, interpersonal, persuasive communication, quantitative analysis, and conclusion-drawing skills.
• Experience partnering with leaders to design solutions for business needs and serving effectively in an indirect leadership role.

Culture & Benefits

• Hybrid work arrangement with four onsite days and one work-from-home day per week.
• Work in a regulated financial-services environment with formal risk, audit, compliance, change-control, and governance requirements.
• Collaborate across information security, IAM, risk, audit, compliance, infrastructure, cloud, and application functions.