Senior Active Directory Engineer
- Location
- Buffalo, NY
- Work mode
- On-site
- Employment type
- Full-time
About the job
This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week Overview: Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as knowledge resource for and trains less experienced engineers. Completes day-to-day support activities and special projects.
Primary Responsibilities: Enterprise Active Directory Architecture
- Proven expertise supporting large-scale, Tier‑1 identity infrastructures with strict uptime, latency, and change‑control requirements
- Strong experience with:
- Multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries
- Forest and external trusts supporting M&A, joint ventures, and third-party integrations
- FSMO role placement optimized for resilience and auditability
- Advanced understanding of Active Directory–integrated DNS , split‑brain DNS, and secure name resolution models
Hybrid Identity & Microsoft Entra ID (Azure AD)
- Extensive experience integrating on-prem AD with Microsoft Entra ID in regulated financial environments
- Hands-on implementation of:
- Entra Connect (Cloud Sync and Traditional)
- Password Hash Sync, Pass-through Authentication, and Federation
- Strong experience with:
- Conditional Access aligned to regulatory and risk-based controls
- Hybrid Join, Entra ID Join, and legacy device coexistence
- Understanding of identity lifecycle controls to support joiners, movers, leavers, and separation-of-duties requirements
Security, Compliance & Risk Controls
- Expert-level knowledge of Active Directory security hardening in financial services, including:
- Tiered administrative model (Tier 0/1/2)
- Dedicated admin forests or hardened admin boundaries (where applicable)
- Privileged Access Workstations (PAWs) / Secure Admin Workstations
- Experience enforcing least privilege , role separation, and dual‑control models
- Deep familiarity with threats targeting financial institutions:
- Credential theft, Kerberoasting, Pass-the-Hash/Ticket
- Delegation and ACL abuse
- Hands-on experience with:
- Privileged Identity Management (PIM)
- Regular access reviews and entitlement recertification
- Strong alignment with Zero Trust and defense-in-depth identity strategies
Regulatory & Audit Readiness
- Demonstrated experience supporting audits and controls for financial regulations and frameworks, such as:
- SOX, GLBA, PCI DSS, SOC 2
- Internal risk management and model governance requirements
- Ability to design AD environments that support:
- Strong logging and traceability
- Tamper-resistant audit logs
- Evidence generation for internal and external auditors
Automation & PowerShell
- Advanced PowerShell expertise for:
- Controlled, auditable administrative changes
- Automated provisioning/deprovisioning aligned to compliance workflows
- Identity reporting for risk, security, and audit teams
- Experience building automation that integrates with:
- Change management processes
- IAM, ticketing, and security tooling
Operations, Resilience & Recovery
- Deep experience managing:
- AD replication topology across data centers and regions
- SYSVOL (DFSR) health and recovery
- Latency-sensitive authentication dependencies
- Strong understanding of:
- AD backup, recovery, and authoritative restore procedures
- Identity disaster recovery scenarios with defined RTO/RPO
- Experience implementing monitoring and alerting with a focus on early risk detection
Leadership & Governance
- Acts as technical authority and escalation point for all directory and identity services
- Defines and enforces:
- Enterprise identity standards
- Secure configuration baselines
- Operational runbooks and procedures
- Partners closely with:
- Information Security and IAM teams
- Risk, audit, and compliance stakeholders
- Infrastructure, cloud, and application teams
- Mentors engineers and reviews designs from a security and risk-first perspective
Education and Exp erience Required:
- Bachelor's degree and a minimum of 3 years’ relevant work experience, or in lieu of a degree, a combined minimum of 7 years’ higher education and/or work experience
Education and Experience Preferred:
- Intermediate understanding of the security system development and infrastructure lifecycle and architecture, and systems design
- Proven experience with the tools utilized in assigned Cybersecurity function
- Experience translating architecture into technical requirements.
- Proficient level of critical thinking and problem solving
- Excellent written and verbal communication skills
- Proven experience collaborating with leaders to execute results.
- Prior experience seeking buy-in of others to align on processes.
- Ability to analyze and draw conclusions based on quantitative data from multiple sources.
M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $97,100.00 - $161,800.00 (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation.
Location Buffalo, New York, United States of America
From M&T Bank's careers page (Workday), checked 31 Oct 2026.
How to apply
- Select Apply on mtb.wd5.myworkdayjobs.com. It opens M&T Bank's own application form in a new tab, run on Workday.
- Fill in the form and upload your résumé there. Jobiwork never sees your application.
- M&T Bank will reply to you directly. No real employer asks you for money to apply.
Posted 4 Sept 2026 · checked 31 Oct 2026 · Report this job
