Senior Principal, IAM Directory Services

The Senior Principal, IAM Directory Services is the senior technical authority for the security, resilience and continuous hardening of GSK’s enterprise directory services.

The role leads a defined area of the IAM Directory Services capability and ensures that Active Directory, Microsoft Entra ID and the supporting identity synchronisation layer are designed, operated and improved using secure-by-design and defence-in-depth principles.

Key responsibilities:

• Act as the senior technical authority for the security architecture, hardening and operational integrity of Active Directory, Microsoft Entra ID and associated directory and synchronization services.
• Lead a defined area of the Directory Services security capability, including its delivery roadmap, technical standards, risk position and measurable security outcomes.
• Embed secure-by-design principles into new directory services, migrations, integrations and material changes.
• Design, implement and maintain a tiered administrative security model.
• Own the architecture and security controls for privileged administration.
• Define and maintain directory security policies, configuration baselines, Group Policy standards and technical guardrails.
• Continuously harden the directory estate by reducing attack paths and legacy exposure.
• Lead the Directory Services response to penetration tests, red-team exercises, vulnerability assessments and audit findings.
• Provide directory security leadership during incidents and investigations.
• Own monitoring requirements and security use cases for privileged changes, authentication anomalies, directory replication, policy changes, persistence techniques and indicators of compromise.
• Maintain a robust security assurance programme.
• Own secure backup and recovery requirements for directory services.
• Provide technical governance for domains, forests, tenants, trusts, federation and identity synchronisation.
• Manage delivery against the capability and security roadmap.
• Represent Directory Services in cyber security governance, architecture review, risk, audit and cross-functional forums.
• Develop team capability through coaching, technical review, secure engineering practices, knowledge transfer and structured feedback.

Basic Qualifications:

• Degree in a relevant discipline, or equivalent practical experience.
• Demonstrated enterprise-scale experience engineering, securing and operating Active Directory and Microsoft Entra ID.
• Deep practical knowledge of Active Directory security architecture, attack paths, authentication, authorisation, delegation, trusts, Group Policy, privileged groups and directory replication.
• Hands-on experience implementing directory hardening, tiered administration, privileged access controls, hardened administrative workstations and bastion or jump-host patterns.
• Experience defining, maintaining and assuring security configuration baselines, technical policies, standards and exception processes.
• Proven experience responding to penetration tests, red-team findings, vulnerabilities, incidents or audit observations and driving remediation through to validated closure.

Preferred Qualifications:

• Deep hands-on experience hardening complex multi-domain or multi-forest Active Directory environments and hybrid identity services.
• Experience applying recognised directory security guidance and translating it into enforceable enterprise standards and measurable controls.
• Experience with privileged access management, just-in-time administration, credential isolation, attack-path management and administrative tiering.