Senior Identity Engineer - IT Risk and Security

Overview

Connecting clients to markets - and talent to opportunity. With 5,400+ employees and over 80,000 institutional, commercial, and payments clients, we operate from more than 80 offices spread across six continents. As a Fortune 100, Nasdaq-listed provider, we connect clients to the global markets - focusing on innovation, human connection, and providing world-class products and services to all types of investors.Whether you want to forge a career connecting our retail clients to potential trading opportunities, or ingrain yourself in the world of institutional investing, StoneX Group is made up of four business segments that offer endless potential for progression and growth.

Business Segment Overview

Corporate: Engage in a deep variety of business-critical activities that keep our company running efficiently. From strategic marketing and financial management to human resources and operational oversight, you’ll have the opportunity to optimize processes and implement game-changing policies.

Position Purpose: As Senior Identity Engineer for IT Risk and Security, you will be a senior hands-on engineer responsible for operating, improving, automating, securing and troubleshooting the enterprise identity platforms the firm depends on. The estate of platforms include Identity Providers, legacy directory services, enterprise PKI, privileged access management, modern authentication and identity governance tooling, alongside legacy platforms now being retired. This is a senior individual contributor role, not an architect role - the ideal candidate is deeply hands-on, comfortable owning complex, ambiguous identity problems end to end with minimal supervision, and raises the standard of the engineers around them. Experience working in a regulated financial environment is a plus.

Responsibilities

Primary duties will include:

• Design, build and operate identity services across core identity provider platforms-Entra ID with hybrid directory services and Okta-including authentication journeys, application integration, federation and single sign-on at scale; implement, test, troubleshoot and monitor access policies, Conditional Access, MFA, passwordless authentication, authentication strengths, session controls, policy exclusions and emergency access safeguards.
• Operate and troubleshoot Active Directory in large, complex, multi-domain and multi-forest environments, including domain controllers, DNS and name resolution, Sites and Services, replication, Group Policy, trusts and cross-domain authentication, service accounts, privileged groups, delegated access and domain health; coordinate changes across dependent systems.
• Serve as a senior escalation point for complex identity incidents - authentication failures, provisioning issues, certificate-related outages, privileged access problems and production change failures - determining cause, escalating anything with ongoing or immediate impact, performing root cause analysis and driving the problem to a permanent fix.
• Plan, execute, validate and document production identity changes, including risk assessment, implementation steps, rollback planning, stakeholder coordination, functional and connectivity testing, and post-change monitoring.
• Grow the joiner, mover and leaver lifecycle - provisioning and deprovisioning driven from authoritative HR sources, and policy and role-based entitlement in place of ticket-by-ticket approval.
• Support PKI and certificate lifecycle operations as they relate to identity services - TLS certificates, certificate-based authentication, domain controller certificates, renewal, revocation checks and outage troubleshooting.
• Automate repeatable identity administration, reporting, validation, reconciliation and remediation using PowerShell, Microsoft Graph, REST APIs, source control and pipeline-based workflows, applying configuration-as-code to identity change rather than manual administration.
• Develop group policies and access control lists, design and build system administration and management functionality for privileged access users, maintain baseline system security, and resolve vulnerabilities in identity systems and components through documented remediation plans.
• Maintain the resilience of the service: define availability levels, determine disaster recovery and continuity of operations requirements, and develop, test and execute recovery and alternate-site procedures for identity platforms.
• Own operational documentation for the identity services you support - SOPs, runbooks, implementation records, troubleshooting guides, escalation procedures, known-error documentation and workflow diagrams - kept current with the deployed design and to a standard that allows work to move between regions without loss.
• Produce audit-ready evidence for identity controls - privileged access, access reviews, account lifecycle events, group membership, policy changes, app permissions, certificate ownership and remediation actions - supporting internal audit, external audit and client or scheme assessments including SWIFT CSP, defending design decisions and closing findings to agreed dates.
• Collect metrics and trending data, develop cybersecurity and performance success metrics, and examine service performance reports for issues and variances so identity risk is visible without a manual data pull.
• Mentor and upskill engineers across the team through code and design reviews, interactive training and knowledge transfer, building genuine cover so that every platform has more than one engineer, in more than one region, who can safely operate it.
• Establish internal and external cross-team relationships - with security architecture, security operations, enterprise IT, HR, compliance and application teams - to gather requirements, translate proposed capabilities into technical requirements and deliver identity solutions that meet business needs.

Qualifications

To land this role you will need:

• This individual must be capable of working with internal and customer-facing teams to facilitate process improvement and customer support resulting in an enhanced security posture, reduction in risk and improvement in end-user experience. Excellent communication, strong organizational skills and attention to detail are essential.
• 5+ years in identity and access management in a hands-on engineering or operations role, with a track record of independently delivering complex identity change in a large, distributed estate; experience in financial services a plus.
• Deep, current, hands-on experience operating Active Directory in large, complex environments - domain controllers, Sites and Services, replication, Group Policy, trusts, service accounts, privileged groups and domain health troubleshooting - including multi-domain or multi-forest estates with cross-domain authentication and delegated access.
• Equivalent depth in Microsoft Entra ID - tenant configuration, directory synchronization, conditional access, privileged role management, entitlement models, enterprise applications and app registrations - and in Okta, covering policy architecture, authentication journeys, application integration, lifecycle management and federation at scale.
• Strong troubleshooting skills across authentication, authorization, federation, directory synchronization, MFA, Conditional Access, certificates, DNS, LDAP, Kerberos, SAML 2.0, OIDC, OAuth 2.0 and SCIM.
• Working knowledge of PKI and certificate lifecycle operations as they relate to identity services, including TLS certificates, certificate-based authentication, domain controller certificates, renewal, revocation checks and outage troubleshooting.
• Demonstrated experience governing non-human identities - service accounts, managed identities, app registrations, API clients and automation accounts - including secrets and certificate handling, ownership records, permission reviews and decommissioning.
• Strong automation ability using PowerShell, Microsoft Graph and REST APIs, including the Okta management APIs, with practical use of source control, pipelines and configuration-as-code applied to identity administration, reporting, validation, reconciliation and remediation.
• Knowledge and implementation of key security concepts such as RBAC, zero trust, identity lifecycle automation, least privilege and identity governance.
• Expert command of change management process and discipline; you are expected to plan, document and execute high-risk identity change on production platforms with minimal guidance, including rollback planning and post-change validation.
• Demonstrated operational engineering discipline: incident, problem and change management, root cause analysis, service level reporting, and the development and maintenance of standard operating procedures, runbooks and known-error documentation.
• Direct experience supporting identity controls through audit - preparing evidence, defending design decisions to auditors or regulators, and closing findings.
• Understanding of a broad range of general information security domains, including networking, cybersecurity, governance and risk, and cloud.
• Advanced written and verbal communication skills, sufficient to explain identity design decisions to technical and non-technical stakeholders, answer requests for information directly, and communicate critical or time-sensitive information to leadership.
• Experience with a cohesive PAM/IGA program

What makes you stand out:

• You have an engineer's instinct; you see an inefficient process and immediately think of how to automate it away rather than staff it.
• You thrive in a fast-paced, collaborative environment and are comfortable carrying live service ownership and a delivery backlog at the same time.
• You are equally comfortable in both platforms and can reason about where a capability belongs - Entra ID or Okta - rather than defaulting to the one you know best.
• You are the person others escalate to, and you close the loop by documenting what you found so the next engineer does not have to rediscover it.
• You leave the estate better documented and better understood than you found it, and you deliberately build capability in the engineers around you.
• You have experience in a Zero Trust program, or with securing non-human identities including service accounts, workload identities and emerging agentic and AI workloads.
• Education / Certification Requirements:
• Bachelor's or master's degree in computer science, information security or a related field (or equivalent experience).
• Microsoft Certified: Identity and Access Administrator Associate (SC-300) preferred.
• Okta Certified Professional or Okta Certified Administrator preferred; Okta Certified Consultant a plus.
• CISSP, CISM, CyberArk Defender or Sentry, or an equivalent identity governance credential preferred; ITIL foundation or equivalent service management training is a plus.
• Significant experience with demonstrated examples of growing PAM and/or IGA programs
• Production delivery experience across at least three of: identity governance and administration tooling, privileged access management such as CyberArk, PKI and certificate lifecycle management, federation and single sign-on, and multi-factor or passwordless authentication.

Working environment:

• Team distributed across UK, US and GCC locations; expected business start time (2:00 - 2:30 PM IST) to overlap some of US business hours and participation in an escalation and on-call rotation should be expected.
• 4 days' a week in office.