{"id":3777076,"url":"https://alion.io/job/mt-bank-lead-active-directory-engineer","title":"Lead Active Directory Engineer","company":{"id":4312,"name":"M&T Bank","domain":"mtb.com","url":"https://alion.io/company/mtb","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":84,"open_postings":70,"ghost_share":0,"stale_share":0.643,"repost_share":0.014,"time_to_fill_p50_days":35,"computed_at":"2026-11-08T05:47:12Z"}},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Buffalo, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":116400,"max":194000,"currency":"USD","period":"year","gross":null,"usd_annual":194000},"salary_estimate":null,"experience_years_min":9,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Azure","optional":false},{"name":"Defense in Depth","optional":false},{"name":"DNS","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"PCI DSS","optional":false},{"name":"PowerShell","optional":false},{"name":"SOC 2","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-11-04T23:37:19Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-07T05:32:57Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week\nOverview: \nResponsible for designing, securing, and operating Microsoft Active Directory Domain Services (AD DS) in regulated, high-availability environments. Acts as knowledge resource for and trains less experienced engineers. Completes day-to-day support activities and special projects.\nPrimary Responsibilities:\nEnterprise Active Directory ArchitectureProven expertise supporting large-scale, Tier-1 identity infrastructures with strict uptime, latency, and change-control requirements\nStrong experience with:Multi-domain and multi-forest designs aligned to business units, regions, or regulatory boundaries\nForest and external trusts supporting M&A, joint ventures, and third-party integrations\nFSMO role placement optimized for resilience and auditability\n\nAdvanced understanding of Active Directory-integrated DNS, split-brain DNS, and secure name resolution models\n\n Hybrid Identity & Microsoft Entra ID (Azure AD)Extensive experience integrating on-prem AD with Microsoft Entra ID in regulated financial environments\nHands-on implementation of:Entra Connect (Cloud Sync and Traditional)\nPassword Hash Sync, Pass-through Authentication, and Federation\n\nStrong experience with:Conditional Access aligned to regulatory and risk-based controls\nHybrid Join, Entra ID Join, and legacy device coexistence\n\nUnderstanding of identity lifecycle controls to support joiners, movers, leavers, and separation-of-duties requirements\n\nSecurity, Compliance & Risk ControlsExpert-level knowledge of Active Directory security hardening in financial services, including:Tiered administrative model (Tier 0/1/2)\nDedicated admin forests or hardened admin boundaries (where applicable)\nPrivileged Access Workstations (PAWs) / Secure Admin Workstations\n\nExperience enforcing least privilege, role separation, and dual-control models\nDeep familiarity with threats targeting financial institutions:Credential theft, Kerberoasting, Pass-the-Hash/Ticket\nDelegation and ACL abuse\n\nHands-on experience with:Privileged Identity Management (PIM)\nRegular access reviews and entitlement recertification\n\nStrong alignment with Zero Trust and defense-in-depth identity strategies\n\nRegulatory & Audit ReadinessDemonstrated experience supporting audits and controls for financial regulations and frameworks, such as:SOX, GLBA, PCI DSS, SOC 2\nInternal risk management and model governance requirements\n\nAbility to design AD environments that support:Strong logging and traceability\nTamper-resistant audit logs\nEvidence generation for internal and external auditors\n\nAutomation & PowerShellAdvanced PowerShell expertise for:Controlled, auditable administrative changes\nAutomated provisioning/deprovisioning aligned to compliance workflows\nIdentity reporting for risk, security, and audit teams\n\nExperience building automation that integrates with:Change management processes\nIAM, ticketing, and security tooling\n\n Operations, Resilience & RecoveryDeep experience managing:AD replication topology across data centers and regions\nSYSVOL (DFSR) health and recovery\nLatency-sensitive authentication dependencies\n\nStrong understanding of:AD backup, recovery, and authoritative restore procedures\nIdentity disaster recovery scenarios with defined RTO/RPO\n\nExperience implementing monitoring and alerting with a focus on early risk detection\n\nLeadership & GovernanceActs as technical authority and escalation point for all directory and identity services\nDefines and enforces:Enterprise identity standards\nSecure configuration baselines\nOperational runbooks and procedures\n\nPartners closely with:Information Security and IAM teams\nRisk, audit, and compliance stakeholders\nInfrastructure, cloud, and application teams\n\nMentors engineers and reviews designs from a security and risk-first perspective\n\nEducation and Experience Required:\nBachelor's degree and a minimum of 5 years’ relevant work experience, or in lieu of a degree, a combined minimum of 9 years’ higher education and/or work experience\nEducation and Experience Preferred:\nAdvanced understanding of the security system development and infrastructure lifecycle and architecture, and systems design\nProven experience with the development and customization of tools utilized in assigned Cybersecurity function\nDemonstrated ability to translate architecture into technical requirements\nProficient level of critical thinking and problem solving ability\nExcellent communication and interpersonal skills\nExperience partnering with leaders to design solutions to business needs.\nProficient persuasive communication skills to gain buy-in of others\nStrong ability to analyze and draw reliable conclusions based on large volumes of quantitative data from diverse sources\nAbility effectively serves in indirect leadership role\nM&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $116,400.00 - $194,000.00 Annual (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation.Location\nBuffalo, New York, United States of America","description_format":"text","description_chars":5209,"description_truncated":false,"requirements":{"experience_years_min":9,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Services","Commercial & Retail Banks","Wealth Management & Financial Advisors"],"lifecycle":[{"event":"open","at":"2026-11-04T23:37:19Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 67 · green card filings: 29","filings_12m":67,"filings_prev_12m":118,"green_card_filings_12m":29,"median_offered_wage_usd":132031,"route":null,"cap_exempt":false,"checked_at":"2026-11-08T10:45:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":3,"expected_fill_days":35,"reasons":["conf:24","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-11-08T05:47:12Z"},"pay":{"stated_usd_annual":194000,"is_top_pay":true},"html_url":"https://alion.io/job/mt-bank-lead-active-directory-engineer","json_url":"https://alion.io/job/mt-bank-lead-active-directory-engineer.json","meta":{"generated_at":"2026-11-08T17:14:02Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":36258,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4312},"rest":"https://alion.io/mcp/rest/get_company?id=4312"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmt-bank-lead-active-directory-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmt-bank-lead-active-directory-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmt-bank-lead-active-directory-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/mt-bank-lead-active-directory-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmt-bank-lead-active-directory-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3777076}},{"tool":"search_jobs","arguments":{"company":"mtb.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3777076},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}