This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week
Overview:
Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as knowledge resource for and trains less experienced engineers. Completes day-to-day support activities and special projects.
Primary Responsibilities:
Enterprise Active Directory Architecture Proven expertise supporting large-scale, Tier‑1 identity infrastructures with strict uptime, latency, and change‑control requirements
Strong experience with: Multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries
Forest and external trusts supporting M&A, joint ventures, and third-party integrations
FSMO role placement optimized for resilience and auditability
Advanced understanding of Active Directory–integrated DNS , split‑brain DNS, and secure name resolution models
Hybrid Identity & Microsoft Entra ID (Azure AD) Extensive experience integrating on-prem AD with Microsoft Entra ID in regulated financial environments
Hands-on implementation of: Entra Connect (Cloud Sync and Traditional)
Password Hash Sync, Pass-through Authentication, and Federation
Strong experience with: Conditional Access aligned to regulatory and risk-based controls
Hybrid Join, Entra ID Join, and legacy device coexistence
Understanding of identity lifecycle controls to support joiners, movers, leavers, and separation-of-duties requirements
Security, Compliance & Risk Controls Expert-level knowledge of Active Directory security hardening in financial services, including: Tiered administrative model (Tier 0/1/2)
Dedicated admin forests or hardened admin boundaries (where applicable)
Privileged Access Workstations (PAWs) / Secure Admin Workstations
Experience enforcing least privilege , role separation, and dual‑control models
Deep familiarity with threats targeting financial institutions: Credential theft, Kerberoasting, Pass-the-Hash/Ticket
Delegation and ACL abuse
Hands-on experience with: Privileged Identity Management (PIM)
Regular access reviews and entitlement recertification
Strong alignment with Zero Trust and defense-in-depth identity strategies
Regulatory & Audit Readiness Demonstrated experience supporting audits and controls for financial regulations and frameworks, such as: SOX, GLBA, PCI DSS, SOC 2
Internal risk management and model governance requirements
Ability to design AD environments that support: Strong logging and traceability
Tamper-resistant audit logs
Evidence generation for internal and external auditors
Automation & PowerShell Advanced PowerShell expertise for: Controlled, auditable administrative changes
Automated provisioning/deprovisioning aligned to compliance workflows
Identity reporting for risk, security, and audit teams
Experience building automation that integrates with: Change management processes
IAM, ticketing, and security tooling
Operations, Resilience & Recovery Deep experience managing: AD replication topology across data centers and regions
SYSVOL (DFSR) health and recovery
Latency-sensitive authentication dependencies
Strong understanding of: AD backup, recovery, and authoritative restore procedures
Identity disaster recovery scenarios with defined RTO/RPO
Experience implementing monitoring and alerting with a focus on early risk detection
Leadership & Governance Acts as technical authority and escalation point for all directory and identity services
Defines and enforces: Enterprise identity standards
Secure configuration baselines
Operational runbooks and procedures
Partners closely with: Information Security and IAM teams
Risk, audit, and compliance stakeholders
Infrastructure, cloud, and application teams
Mentors engineers and reviews designs from a security and risk-first perspective
Education and Experience Required:
Bachelor's degree and a minimum of 5 years’ relevant work experience, or…