> Markdown version of [/jobs/ext/3227122-senior-active-directory-engineer](https://www.wearedevelopers.com/jobs/ext/3227122-senior-active-directory-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Active Directory Engineer - **Company:** M&T Bank - **Location:** Buffalo, NY, United States (Remote available) - **Experience:** Expert - **Salary:** $97,100.0 - $161,800.0 - **Contract:** Permanent contract - **Skills:** Active Directory, User Authentication, Cloud Computing, Cyber Security, Data Centers, Disaster Recovery, Domain Name System (DNS), Identity and Access Management, Name Server, PCI Data Security Standards, Windows PowerShell, Role-Based Access Control, Azure Active Directory, Zero Trust Network Access, Runbook, Systems Integration, Data Logging, Low Latency, Integration Frameworks - **Published:** September 3, 2026 - **Apply:** https://mtb.wd5.myworkdayjobs.com/MTB/job/Buffalo-NY/Senior-Active-Directory-Engineer_R89984 ## About the Role * Demonstrated experience supporting audits and controls for financial regulations and frameworks, such as: + SOX, GLBA, PCI DSS, SOC 2 + Internal risk management and model governance requirements * Ability to design AD environments that support: + Strong logging and traceability + Tamper-resistant audit logs + Evidence generation for internal and external auditors Automation & PowerShell * Advanced PowerShell expertise for: + Controlled, auditable administrative changes + Automated provisioning/deprovisioning aligned to compliance workflows + Identity reporting for risk, security, and audit teams * Experience building automation that integrates with: + Change management processes + IAM, ticketing, and security tooling Operations, Resilience & Recovery * Deep experience managing: + AD replication topology across data centers and regions + SYSVOL (DFSR) health and recovery + Latency-sensitive authentication dependencies * Strong understanding of: + AD backup, recovery, and authoritative restore procedures + Identity disaster recovery scenarios with defined RTO/RPO * Experience implementing monitoring and alerting with a focus on early risk detection, * Bachelor's degree and a minimum of 3 years' relevant work experience, or in lieu of a degree, a combined minimum of 7 years' higher education and/or work experience Education and Experience Preferred: * Intermediate understanding of the security system development and infrastructure lifecycle and architecture, and systems design * Proven experience with the tools utilized in assigned Cybersecurity function * Experience translating architecture into technical requirements. * Proficient level of critical thinking and problem solving * Excellent written and verbal communication skills * Proven experience collaborating with leaders to execute results. * Prior experience seeking buy-in of others to align on processes. * Ability to analyze and draw conclusions based on quantitative data from multiple sources. M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $97,100.00 - $161,800.00 (USD). The successful candidate's particular combination of knowledge, skills, and experience will inform their specific compensation. ## Description Responsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as knowledge resource for and trains less experienced engineers. Completes day-to-day support activities and special projects., Enterprise Active Directory Architecture * Proven expertise supporting large-scale, Tier-1 identity infrastructures with strict uptime, latency, and change-control requirements * Strong experience with: + Multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries + Forest and external trusts supporting M&A, joint ventures, and third-party integrations + FSMO role placement optimized for resilience and auditability * Advanced understanding of Active Directory-integrated DNS, split-brain DNS, and secure name resolution models Hybrid Identity & Microsoft Entra ID (Azure AD) * Extensive experience integrating on-prem AD with Microsoft Entra ID in regulated financial environments * Hands-on implementation of: + Entra Connect (Cloud Sync and Traditional) + Password Hash Sync, Pass-through Authentication, and Federation * Strong experience with: + Conditional Access aligned to regulatory and risk-based controls + Hybrid Join, Entra ID Join, and legacy device coexistence * Understanding of identity lifecycle controls to support joiners, movers, leavers, and separation-of-duties requirements Security, Compliance & Risk Controls * Expert-level knowledge of Active Directory security hardening in financial services, including: + Tiered administrative model (Tier 0/1/2) + Dedicated admin forests or hardened admin boundaries (where applicable) + Privileged Access Workstations (PAWs) / Secure Admin Workstations * Experience enforcing least privilege, role separation, and dual-control models * Deep familiarity with threats targeting financial institutions: + Credential theft, Kerberoasting, Pass-the-Hash/Ticket + Delegation and ACL abuse * Hands-on experience with: + Privileged Identity Management (PIM) + Regular access reviews and entitlement recertification * Strong alignment with Zero Trust and defense-in-depth identity strategies, * Acts as technical authority and escalation point for all directory and identity services * Defines and enforces: + Enterprise identity standards + Secure configuration baselines + Operational runbooks and procedures * Partners closely with: + Information Security and IAM teams + Risk, audit, and compliance stakeholders + Infrastructure, cloud, and application teams * Mentors engineers and reviews designs from a security and risk-first perspective ## Related Videos - [Agentic employees in world's most downloaded FinTech app](https://www.wearedevelopers.com/videos/100123-agentic-employees-in-world-s-most-downloaded-fintech-app) - [Technical Documentation - How Can I Write Them Better and Why Should I Care?](https://www.wearedevelopers.com/videos/681-technical-documentation-how-can-i-write-them-better-and-why-should-i-care) - [Swapping Low Latency Data Storage Under High Load](https://www.wearedevelopers.com/videos/746-swapping-low-latency-data-storage-under-high-load) - [The Journey of a Pixel in a React Application](https://www.wearedevelopers.com/videos/1667-the-journey-of-a-pixel-in-a-react-application) - [Operating etcd for Managed Kubernetes](https://www.wearedevelopers.com/videos/1191-operating-etcd-for-managed-kubernetes) - [Unleash the power of 5G in your code: transform your apps](https://www.wearedevelopers.com/videos/1567-unleash-the-power-of-5g-in-your-code-transform-your-apps) ## Related Articles - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Software Developer Salary in Austria [2023]](https://www.wearedevelopers.com/magazine/213-software-developer-salary-in-austria-2023) - [Data Analyst Salary Austria](https://www.wearedevelopers.com/magazine/275-data-analyst-salary-austria) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [Top-Paying Tech Jobs (with Salaries)](https://www.wearedevelopers.com/magazine/372-top-paying-tech-jobs-with-salaries)