This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week

Overview:   

Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as knowledge resource for and trains less experienced engineers. Completes day-to-day support activities and special projects.

Primary Responsibilities:

Enterprise Active Directory Architecture

• Proven expertise supporting large-scale, Tier‑1 identity infrastructures with strict uptime, latency, and change‑control requirements
• Strong experience with:
  • Multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries
  • Forest and external trusts supporting M&A, joint ventures, and third-party integrations
  • FSMO role placement optimized for resilience and auditability
• Advanced understanding of Active Directory–integrated DNS, split‑brain DNS, and secure name resolution models

Hybrid Identity & Microsoft Entra ID (Azure AD)

• Extensive experience integrating on-prem AD with Microsoft Entra ID in regulated financial environments
• Hands-on implementation of:
  • Entra Connect (Cloud Sync and Traditional)
  • Password Hash Sync, Pass-through Authentication, and Federation
• Strong experience with:
  • Conditional Access aligned to regulatory and risk-based controls
  • Hybrid Join, Entra ID Join, and legacy device coexistence
• Understanding of identity lifecycle controls to support joiners, movers, leavers, and separation-of-duties requirements

Security, Compliance & Risk Controls

• Expert-level knowledge of Active Directory security hardening in financial services, including:
  • Tiered administrative model (Tier 0/1/2)
  • Dedicated admin forests or hardened admin boundaries (where applicable)
  • Privileged Access Workstations (PAWs) / Secure Admin Workstations
• Experience enforcing least privilege, role separation, and dual‑control models
• Deep familiarity with threats targeting financial institutions:
  • Credential theft, Kerberoasting, Pass-the-Hash/Ticket
  • Delegation and ACL abuse
• Hands-on experience with:
  • Privileged Identity Management (PIM)
  • Regular access reviews and entitlement recertification
• Strong alignment with Zero Trust and defense-in-depth identity strategies

Regulatory & Audit Readiness

• Demonstrated experience supporting audits and controls for financial regulations and frameworks, such as:
  • SOX, GLBA, PCI DSS, SOC 2
  • Internal risk management and model governance requirements
• Ability to design AD environments that support:
  • Strong logging and traceability
  • Tamper-resistant audit logs
  • Evidence generation for internal and external auditors

Automation & PowerShell

• Advanced PowerShell expertise for:
  • Controlled, auditable administrative changes
  • Automated provisioning/deprovisioning aligned to compliance workflows
  • Identity reporting for risk, security, and audit teams
• Experience building automation that integrates with:
  • Change management processes
  • IAM, ticketing, and security tooling

Operations, Resilience & Recovery

• Deep experience managing:
  • AD replication topology across data centers and regions
  • SYSVOL (DFSR) health and recovery
  • Latency-sensitive authentication dependencies
• Strong understanding of:
  • AD backup, recovery, and authoritative restore procedures
  • Identity disaster recovery scenarios with defined RTO/RPO
• Experience implementing monitoring and alerting with a focus on early risk detec