{"id":2681596,"url":"https://alion.io/job/itesco-cz-senior-security-analyst-active-directory","title":"SENIOR SECURITY ANALYST - ACTIVE DIRECTORY","company":{"id":1901327,"name":"Tesco","domain":"itesco.cz","url":"https://alion.io/company/itesco","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Alma Career","truth_index":{"grade":"B","score":75,"open_postings":3,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-29T05:49:05Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Prague, Czech Republic"],"countries":["CZ"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":38000,"max_usd":88000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"IAM","optional":false},{"name":"PowerShell","optional":false},{"name":"Windows","optional":false},{"name":"Windows Server","optional":false},{"name":"Azure","optional":true},{"name":"CyberArk","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"SQL","optional":true}],"status":"live","first_seen_at":"2026-05-15T17:03:04Z","employer_posted_date":"2026-05-15","last_verified_at":"2026-10-29T02:38:10Z","board_verified":true,"closed_at":null,"days_open":166,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":166},"description":"About the role\nWe are seeking a highly skilled Lead IAM Security Analyst to drive the improvement of the organization's Active Directory and Microsoft Windows IAM security posture.\nThe role focuses on strengthening identity security controls, reducing risks, and ensuring secure management of identities, privileges, authentication, and access across the Windows ecosystem.\nThe successful candidate will work closely with platform engineering teams, infrastructure teams, security stakeholders, and other IAM functions to define security requirements, influence roadmaps, and deliver continuous security improvements.\nThis role is based in Prague, Czechia, operating in a hybrid model (3 days per week in the office).\nMy accountabilities in this job\nLead initiatives to improve the security posture of Microsoft Active Directory and Windows-based identity services.\nAssess, identify, and remediate IAM security risks, misconfigurations, and control gaps within Active Directory environments.\nDevelop and drive implementation of AD security hardening standards, privileged access controls, and identity protection measures.\nPartner with infrastructure and engineering teams to embed IAM security requirements into platform designs and operational processes.\nCollaborate with stakeholders across IAM functions, including PAM, Governance, Authentication, and Access Management teams, to ensure alignment of security controls and strategy.\nReview and enhance privileged access models, administrative tiering, service account management, and authentication mechanisms.\nSupport security assessments, audits, risk reviews, and remediation activities related to Active Directory and Windows platforms.\nMonitor industry best practices and emerging threats affecting identity systems and recommend security improvements.\nContribute to IAM strategy, roadmaps, standards, and governance activities.\nProvide technical leadership and guidance to security and engineering teams on identity security matters.\nWhat You Bring\nRequired Qualifications\nMinimum 8 years of experience in Active Directory administration, security, hardening, identity management, or closely related disciplines.\nStrong expertise in:\nMicrosoft Active Directory\nGroup Policy (GPO) design, management, and security hardening\nKerberos and authentication protocols\nPrivileged Access Management concepts\nActive Directory hardening and secure configuration\nIdentity threat detection and mitigation\nWindows Server security architecture\nTiered Administration and Enterprise Access Models\nStrong PowerShell scripting and automation skills.\nExperience conducting security assessments and implementing remediation plans within enterprise Windows environments.\nStrong understanding of IAM principles, access controls, privileged access security, and identity lifecycle management.\nAbility to work effectively with engineering, infrastructure, and security stakeholders across multiple teams.\nExcellent analytical, communication, and stakeholder management skills.\nPreferred Qualifications\nExperience with Microsoft Entra ID (Azure AD) and hybrid identity environments.\nKnowledge of Microsoft security technologies such as Entra ID Protection, LAPS, and Tiered Administration models.\nRelevant certifications such as CISSP, Microsoft Security certifications, or equivalent IAM-related certifications.\nKnowledge of CyberArk Privileged Access Management (PAM) solutions, including privileged account onboarding, credential management, privileged session controls, and privileged access governance, is considered a strong advantage.\nKnowledge of SQL querying for security reporting, identity analytics, audit data analysis, and integration with IAM and security platforms.\nAdditional information\nBenefits\nTesco is a diverse and exciting employer, dedicated to being #aplacetogeton, providing career-defining opportunities to all of our colleagues. If you choose to join our business, we will provide you with (for all):\nUp to 20% yearly salary bonus - based on both individual and business performance\nSick leave compensation\n1 extra week of annual leave above your legal entitlement of 4 weeks, to support your well-being and family life\nPension insurance contribution\nCafeteria benefit system & Multisport card\nTraining and Development Plan, supported by certified training and learning platforms like Udemy, Udemy Pro and LinkedIn\nReferral Bonus\nFlexible work time\nHybrid opportunity: 3 days on-site work/week\nWith our Tesco Colleague Clubcard you and your family can enjoy a 15% discount on in-store and online shopping\nMeal allowances\nVirtual doctor and Employee assistance program to support colleagues wellbeing\nJoin our team and be a part of building one of the biggest brands in the retail industry!\nLet us know you are interested by pushing the APPLY button!","description_format":"text","description_chars":4810,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Cafeteria","Flexible schedule"],"hiring_locations":[{"name":"Czech Republic","iso":"CZ","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":[],"lifecycle":[{"event":"open","at":"2026-10-16T06:27:00Z"}],"visa":[],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.297,"p_room":0.28,"age_days":166,"expected_fill_days":28,"reasons":["conf:3","win:tail","crowd:"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/itesco-cz-senior-security-analyst-active-directory","json_url":"https://alion.io/job/itesco-cz-senior-security-analyst-active-directory.json","meta":{"generated_at":"2026-10-29T06:34:37Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9963,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1901327},"rest":"https://alion.io/mcp/rest/get_company?id=1901327"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fitesco-cz-senior-security-analyst-active-directory"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fitesco-cz-senior-security-analyst-active-directory"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fitesco-cz-senior-security-analyst-active-directory"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/itesco-cz-senior-security-analyst-active-directory\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fitesco-cz-senior-security-analyst-active-directory"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2681596}},{"tool":"search_jobs","arguments":{"company":"itesco.cz","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2681596},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}