Lead Active Directory Engineer

This role is four days onsite at our Wilmington, DE Tech Hub location, with the flexibility to work from home one day per week Overview: Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as knowledge resource for and trains less experienced engineers. Completes day-to-day support activities and special projects.

Primary Responsibilities: Enterprise Active Directory Architecture Proven expertise supporting large-scale, Tier‑1 identity infrastructures with strict uptime, latency, and change‑control requirements

Strong experience with: Multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries

Forest and external trusts supporting M&A, joint ventures, and third-party integrations

FSMO role placement optimized for resilience and auditability

Advanced understanding of Active Directory–integrated DNS , split‑brain DNS, and secure name resolution models

Hybrid Identity & Microsoft Entra ID (Azure AD) Extensive experience integrating on-prem AD with Microsoft Entra ID in regulated financial environments

Hands-on implementation of: Entra Connect (Cloud Sync and Traditional)

Password Hash Sync, Pass-through Authentication, and Federation

Strong experience with: Conditional Access aligned to regulatory and risk-based controls

Hybrid Join, Entra ID Join, and legacy device coexistence

Understanding of identity lifecycle controls to support joiners, movers, leavers, and separation-of-duties requirements

Security, Compliance & Risk Controls Expert-level knowledge of Active Directory security hardening in financial services, including: Tiered administrative model (Tier 0/1/2)

Dedicated admin forests or hardened admin boundaries (where applicable)

Privileged Access Workstations (PAWs) / Secure Admin Workstations

Experience enforcing least privilege , role separation, and dual‑control models

Deep familiarity with threats targeting financial institutions: Credential theft, Kerberoasting, Pass-the-Hash/Ticket

Delegation and ACL abuse

Hands-on experience with: Privileged Identity Management (PIM)

Regular access reviews and entitlement recertification

Strong alignment with Zero Trust and defense-in-depth identity strategies

Regulatory & Audit Readiness Demonstrated experience supporting audits and controls for financial regulations and frameworks, such as: SOX, GLBA, PCI DSS, SOC 2

Internal risk management and model governance requirements

Ability to design AD environments that support: Strong logging and traceability

Tamper-resistant audit logs

Evidence generation for internal and external auditors

Automation & PowerShell Advanced PowerShell expertise for: Controlled, auditable administrative changes

Automated provisioning/deprovisioning aligned to compliance workflows

Identity reporting for risk, security, and audit teams

Experience building automation that integrates with: Change management processes

IAM, ticketing, and security tooling

Operations, Resilience & Recovery Deep experience managing: AD replication topology across data centers and regions

SYSVOL (DFSR) health and recovery

Latency-sensitive authentication dependencies

Strong understanding of: AD backup, recovery, and authoritative restore procedures

Identity disaster recovery scenarios with defined RTO/RPO

Experience implementing monitoring and alerting with a focus on early risk detection

Leadership & Governance Acts as technical authority and escalation point for all directory and identity services

Defines and enforces: Enterprise identity standards

Secure configuration baselines

Operational runbooks and procedures

Partners closely with: Information Security and IAM teams

Risk, audit, and compliance stakeholders

Infrastructure, cloud, and application teams

Mentors engineers and reviews designs from a security and risk-first perspective

Education and Experience Required: Bachelor's degree and a minimum of 5 years’ relevant work experience, or in lieu of a degree, a combined minimum of 9 years’ higher education and/or work experience

Education and Experience Preferred: Advanced understanding of the security system development and infrastructure lifecycle and architecture, and systems design

Proven experience with the development and customization of tools utilized in assigned Cybersecurity function

Demonstrated ability to translate architecture into technical requirements

Proficient level of critical thinking and problem solving ability

Excellent communication and interpersonal skills

Experience partnering with leaders to design solutions to business needs.

Proficient persuasive communication skills to gain buy-in of others

Strong ability to analyze and draw reliable conclusions based on large volumes of quantitative data from diverse sources

Ability effectively serves in indirect leadership role

#LI-JB3 #Hybrid

M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $128,100.00 - $213,500.00 (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation.

Location Wilmington, Delaware, United States of America