Senior Principal - IAM Operations

This role will provide you with the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

• Act as the senior technical authority for the security architecture, hardening and operational integrity of Active Directory, Microsoft Entra ID and associated directory and synchronization services.
• Lead a defined area of the Directory Services security capability, including its delivery roadmap, technical standards, risk position and measurable security outcomes.
• Embed secure-by-design principles into new directory services, migrations, integrations and material changes, ensuring that threat modelling, security requirements and control validation are completed before production deployment.
• Design, implement and maintain a tiered administrative security model that separates identity control-plane administration from server, workstation and application administration.
• Own the architecture and security controls for privileged administration, including hardened administrative workstations, bastion or jump-host services, dedicated administrative identities, privileged group governance and restrictions on credential exposure.
• Define and maintain directory security policies, configuration baselines, Group Policy standards and technical guardrails. Ensure that exceptions are formally assessed, documented, approved, time-bound and reviewed.
• Continuously harden the directory estate by reducing attack paths and legacy exposure, including insecure authentication protocols, weak cryptography, excessive privilege, unconstrained delegation, insecure trusts, stale identities and unsupported configurations.
• Lead the Directory Services response to penetration tests, red-team exercises, vulnerability assessments and audit findings. Validate technical evidence, assess exploitability and business impact, agree remediation plans, track actions to closure and verify that fixes are effective.
• Provide directory security leadership during incidents and investigations, supporting containment, forensic analysis, eradication and secure restoration while preserving appropriate evidence.
• Own monitoring requirements and security use cases for privileged changes, authentication anomalies, directory replication, policy changes, persistence techniques and indicators of compromise affecting the identity control plane.
• Maintain a robust security assurance programme covering configuration compliance, privileged access reviews, control testing, attack-path analysis, vulnerability management and evidence production for internal and external assurance activities.
• Own secure backup and recovery requirements for directory services, including isolated and protected backups, recovery procedures, regular restoration testing and evidence that recovery objectives can be met following compromise.
• Provide technical governance for domains, forests, tenants, trusts, federation and identity synchronisation, ensuring that architecture decisions minimise privilege, limit blast radius and support secure lifecycle management.
• Manage delivery against the capability and security roadmap, prioritising work according to risk and escalating material blockers, control gaps and accepted risks through the appropriate governance forums.
• Represent Directory Services in cyber security governance, architecture review, risk, audit and cross-functional forums, translating complex technical risk into clear decisions and accountable actions.
• Develop team capability through coaching, technical review, secure engineering practices, knowledge transfer and structured feedback.

• Degree in a relevant discipline, or equivalent practical experience.
• Demonstrated enterprise-scale experience engineering, securing and operating Active Directory and Microsoft Entra ID.
• Deep practical knowledge of Active Directory security architecture, attack paths, authentication, authorisation, delegation, trusts, Group Policy, privileged groups and directory replication.
• Hands-on experience implementing directory hardening, tiered administration, privileged access controls, hardened administrative workstations and bastion or jump-host patterns.
• Experience defining, maintaining and assuring security configuration baselines, technical policies, standards and exception processes.
• Proven experience responding to penetration tests, red-team findings, vulnerabilities, incidents or audit observations and driving remediation through to validated closure.
• Working knowledge of directory synchronisation, identity data flows and the security implications of hybrid identity architecture.
• Practical experience with security monitoring, incident response, backup and recovery for critical identity infrastructure.
• Significant experience in cyber security within identity, directory services or a related infrastructure security domain.
• Proven experience leading a team or substantial security programme and delivering to agreed scope, quality and timelines.
• Excellent risk communication, relationship management, influencing and stakeholder engagement skills.

• Deep hands-on experience hardening complex multi-domain or multi-forest Active Directory environments and hybrid identity services.
• Experience applying recognised directory security guidance and translating it into enforceable enterprise standards and measurable controls.
• Experience with privileged access management, just-in-time administration, credential isolation, attack-path management and administrative tiering.
• Knowledge of common Active Directory adversary techniques, including credential theft, Kerberos abuse, delegation abuse, directory replication abuse, persistence and lateral movement.
• Experience designing and operating secure bastion, jump-host or privileged administrative access solutions.
• Experience with security assessment, penetration testing remediation, threat modelling and technical risk assessment.
• Advanced PowerShell scripting skills for security assurance, control validation, monitoring and evidence generation.
• Experience with directory migration, consolidation, domain decommissioning or recovery programmes where security and blast-radius reduction were key outcomes.
• Relevant certifications such as CISSP, SC-300, Microsoft identity and access certifications, or comparable security qualifications.
• Experience in pharmaceutical, life sciences or another highly regulated industry.
• Typical tools and technologies: Active Directory Domain Services, Microsoft Entra ID, Entra Connect, Group Policy, LDAP, Kerberos, PowerShell, privileged access and bastion technologies, security monitoring and SIEM platforms, attack-path and exposure management tooling, vulnerability management, and directory backup and recovery tooling.

#AGTech

Skills

Account Lifecycle Management, AI Agents, Authentication Systems, Automation Technology, Certificate Management, Cloud Based Services, Cloud IAM, Computer Programming, Configuration Management (CM), Database Management, Directory Services, IAM Tools, Identity Access Management (IAM), Identity Lifecycle Management, Information Technology (IT) Risk Management, Infrastructure Security, LLM Orchestration, Orchestrate, Privileged Access Management (PAM), Security Controls, System Monitors, Troubleshooting