Sr Principal - IAM Operations
Posted 8
views
Summary
Senior technical authority role securing GSK's enterprise identity estate — Active Directory, Microsoft Entra ID and hybrid identity sync. Day-to-day covers directory security architecture, tiered administration and privileged access hardening, driving remediation of pen-test/audit findings, incident response, and leading the Directory Services security capability and team.
Job Summary
Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.
The Senior Principal, IAM Directory Services is the senior technical authority for the security, resilience and continuous hardening of GSK s enterprise directory services. The role leads a defined area of the IAM Directory Services capability and ensures that Active Directory, Microsoft Entra ID and the supporting identity synchronisation layer are designed, operated and improved using secure-by-design and defence-in-depth principles. The role owns security outcomes across the directory estate, drives risk reduction, and provides technical leadership for remediation arising from penetration testing, security assessments, incidents and audit findings.
About the team:
IAM Directory Services owns the identity control plane that underpins authentication and authorisation across GSK. The team protects this critical foundation by maintaining secure directory architecture, enforcing tiered administration, controlling privileged access, reducing legacy exposure, continuously validating configuration, and ensuring that directory services can be securely recovered following a cyber event.
Key responsibilities:
- Act as the senior technical authority for the security architecture, hardening and operational integrity of Active Directory, Microsoft Entra ID and associated directory and synchronization services.
- Lead a defined area of the Directory Services security capability, including its delivery roadmap, technical standards, risk position and measurable security outcomes.
- Embed secure-by-design principles into new directory services, migrations, integrations and material changes, ensuring that threat modelling, security requirements and control validation are completed before production deployment.
- Design, implement and maintain a tiered administrative security model that separates identity control-plane administration from server, workstation and application administration.
- Own the architecture and security controls for privileged administration, including hardened administrative workstations, bastion or jump-host services, dedicated administrative identities, privileged group governance and restrictions on credential exposure.
- Define and maintain directory security policies, configuration baselines, Group Policy standards and technical guardrails. Ensure that exceptions are formally assessed, documented, approved, time-bound and reviewed.
- Continuously harden the directory estate by reducing attack paths and legacy exposure, including insecure authentication protocols, weak cryptography, excessive privilege, unconstrained delegation, insecure trusts, stale identities and unsupported configurations.
- Lead the Directory Services response to penetration tests, red-team exercises, vulnerability assessments and audit findings. Validate technical evidence, assess exploitability and business impact, agree remediation plans, track actions to closure and verify that fixes are effective.
- Provide directory security leadership during incidents and investigations, supporting containment, forensic analysis, eradication and secure restoration while preserving appropriate evidence.
- Own monitoring requirements and security use cases for privileged changes, authentication anomalies, directory replication, policy changes, persistence techniques and indicators of compromise affecting the identity control plane.
- Maintain a robust security assurance programme covering configuration compliance, privileged access reviews, control testing, attack-path analysis, vulnerability management and evidence production for internal and external assurance activities.
- Own secure backup and recovery requirements for directory services, including isolated and protected backups, recovery procedures, regular restoration testing and evidence that recovery objectives can be met following compromise.
- Provide technical governance for domains, forests, tenants, trusts, federation and identity synchronisation, ensuring that architecture decisions minimise privilege, limit blast radius and support secure lifecycle management.
- Manage delivery against the capability and security roadmap, prioritising work according to risk and escalating material blockers, control gaps and accepted risks through the appropriate governance forums.
- Represent Directory Services in cyber security governance, architecture review, risk, audit and cross-functional forums, translating complex technical risk into clear decisions and accountable actions.
- Develop team capability through coaching, technical review, secure engineering practices, knowledge transfer and structured feedback.
Basic Qualifications:
- Degree in a relevant discipline, or equivalent practical experience.
- Demonstrated enterprise-scale experience engineering, securing and operating Active Directory and Microsoft Entra ID.
- Deep practical knowledge of Active Directory security architecture, attack paths, authentication, authorisation, delegation, trusts, Group Policy, privileged groups and directory replication.
- Hands-on experience implementing directory hardening, tiered administration, privileged access controls, hardened administrative workstations and bastion or jump-host patterns.
- Experience defining, maintaining and assuring security configuration baselines, technical policies, standards and exception processes.
- Proven experience responding to penetration tests, red-team findings, vulnerabilities, incidents or audit observations and driving remediation through to validated closure.
- Working knowledge of directory synchronisation, identity data flows and the security implications of hybrid identity architecture.
- Practical experience with security monitoring, incident response, backup and recovery for critical identity infrastructure.
- Significant experience in cyber security within identity, directory services or a related infrastructure security domain.
- Proven experience leading a team or substantial security programme and delivering to agreed scope, quality and timelines.
- Excellent risk communication, relationship management, influencing and stakeholder engagement skills.
Preferred Qualifications:
- Deep hands-on experience hardening complex multi-domain or multi-forest Active Directory environments and hybrid identity services.
- Experience applying recognised directory security guidance and translating it into enforceable enterprise standards and measurable controls.
- Experience with privileged access management, just-in-time administration, credential isolation, attack-path management and administrative tiering.
- Knowledge of common Active Directory adversary techniques, including credential theft, Kerberos abuse, delegation abuse, directory replication abuse, persistence and lateral movement.
- Experience designing and operating secure bastion, jump-host or privileged administrative access solutions.
- Experience with security assessment, penetration testing remediation, threat modelling and technical risk assessment.
- Advanced PowerShell scripting skills for security assurance, control validation, monitoring and evidence generation.
- Experience with directory migration, consolidation, domain decommissioning or recovery programmes where security and blast-radius reduction were key outcomes.
- Relevant certifications such as CISSP, SC-300, Microsoft identity and access certifications, or comparable security qualifications.
Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.