Lead Engineer-Directory Services & Security

•    Must have Strong knowledge of Active Directory designing, Architecture, Solutioning, Integration with platforms & Applications.
•    Strong knowledge foundation in Cyber Security frameworks, Threat modelling, MITRE ATT&CK framework.
•    Strong Knowledge on security standards such as NIST, CIS benchmarking, STIG, and US DoD
•    Strong Knowledge on Knowledge of single sign-on, federation, active directory/LDAP, Kerberos/NTLM authentication & integrated Windows authentication.
•    Should possess extensive knowledge of identity related attacks, identity threats, and vulnerabilities.
•    Should be capable of developing robust resiliency solutions in response for cyber-attacks.
•    Handson experience on security use cases creation to detect threats and improve the identity security posture.
•    Strong knowledge on risk assessments and identifying attack vectors and remediation solutions to reduce the attack surface.
•    Strong familiarity with systems and security technologies, including application/OS hardening techniques, Active Directory, windows, Syslog & Security Event, and Incident Management (SIEM)
•    Ability to interact with a broad cross-section of personnel to explain and enforce security measures.
•    Strong knowledge on Cryptography, certificates, PKI, symmetric, asymmetric keys, Encryption & hash algorithms
•    Strong knowledge of security frameworks and compliance regulations.
•    Solid understanding of security protocols, cryptography, authentication, authorisation, and security
•    Strong knowledge on AD authentication protocols kerberos, NTLM, LDAP, LDAPS & LDAP-Start TLS
•    Strong knowledge on AD Backup and recovery process.
•    Good knowledge on Network log capturing & analysing the logs through the tools Wireshark, Tshark, Microsoft NM etc.,
•    Good exposure to SAML, OAuth, OpenID and other security/IAM related standards
•    Develop and implement comprehensive Active Directory security strategies and roadmaps.
•    Knowledge of single sign-on, federation, active directory/LDAP, Kerberos/NTLM authentication & integrated Windows authentication

•    Good knowledge on Identify management and Role based access control, attribute-based access control & entitlement management.
•    Good Knowledge on Security Monitoring and Recovery Solution.
•    Good Knowledge on recovery Testing Expansion for Complete Loss Recovery & Country Recovery Scenario.
•    Good Knowledge on Active Directory & windows security audit logs
•    Strong knowledge on AD trusts, forest, domain tree structures, sites, DNS, GPOs, OU, FRS, DFSR.
•    Recommend security best practices to achieve stated business objectives, advises on risk assumptions for any variances granted, and provides alternatives to achieve desired end results.
•    Strong Knowledge on Creating Active Directory Security controls, Domain controller hardening & OS Hardening (Desktop & server), Vulnerability Assessment and Management for Active Directory 
•    Strong knowledge on creating security baseline for domain controllers.
•    Good knowledge of Entra ID technologies, including authentication models, federation, Multifactor Authentication (MFA), SSO, Enterprise applications, conditional access policies, Identity protections and other relevant capabilities.
•    Strong Knowledge on IAM disciplines like PIM PAM solutions.
•    Strong Knowledge on ADFS Integration and authentication methods. Deep Understanding of Federation Protocols SAML, WS-Fed, OAuth, OIDC,
•    Proficiency in PowerShell, scripting, and automation or automation tools like Ansible
•    Good to have hands-on familiarity with host-based security solutions, Forensic & Investigation agents, and Compliance scanning and reporting.
•    Good documentation skills to write a design & configuration document.

•    Good Interpersonal skill and ability to work as part of a team.
•    The Lead Engineer – Directory Service Security Engineer is responsible for alignment of security strategy towards the goals of the organization. The lead is one of the design authorities to certify the induction of various technology solutions into the Bank. 
•    This role is also responsible for providing leadership direction and strategic solutions related to directory Services and work with various engineering streams within Workspace and all Workspace team members in Chennai and Bangalore, Malaysia, Singapore and Poland locations. 
•    The Lead Engineer should closely collaboration with red, purple, and blue teams, SOC team to enhance identity platforms security posture.
•    The Lead Engineer is accountable for the ownership of TIP documents, Test cases, Low level design documents, all the artefacts created by him/her during the design phase.  The lead should be responsible for tracking all the ADO ticket and act on those tickets on-time and set the delivery timeline for each task.  Also, the lead is responsible to create/track and monitor all the CRISP items and accountable for audit items and RFP related queries. 
•    The Lead Engineer should consult all the engineering decision /activities/tracker with reporting manager, if any BAU related activities or publishing any new product should be consulted with product owner and refer to product road map.
•    The Lead Engineer should inform regular Engineering Road map details and product releases coming from Microsoft.  Should collaboratively work with Entra ID Security team on maintaining the security posture of identity suites.

Strategy
•     We are seeking an experienced Directory services security engineer to lead the design, implementation, and optimization of Active Directory across the enterprise. This role involves architecting identity solutions that ensure security, scalability, and integration with on-premises and cloud services. The engineer will collaborate with cross-functional teams to deliver identity and access management (IAM) solutions that support business requirements and meet security compliance standards.
Business
•     Technology and Operations 
Processes
•    Manage the appropriate Product Lifecycle Management process to ensure.
•    Monitor End-Of-Sale, End-Of-Manufacturer-Support, End-Of-Life etc.
•    Maintaining the Invest, Contain & Disinvest state of each product.
•    Update all this information in the Product Roadmap Portal.
•    Product Selection and PoC: Play a key role in the selection of relevant Products to be used in the Bank.  The Engineering lead must be involved in the final decision-making process to ensure that decisions made are in line with the Banks’s strategic direction.
•    Innovation and R&D Lab Environment.  The Lead Engineer, Directory Services & Security role will have the overall ownership R&D, PoC and testing activities carried out in the Hybrid Cloud Lab environments, this includes managing;
•    Funding requests for additional lab equipment (software, hardware, etc)
•    Annual maintenance costs
•    The Lead Engineer, Directory Services & Security is responsible to manage the workload to track the deliverables.

•    Maintain an Engineering Book of Work.
•    Provide Reporting information to management & other domains (i.e. key items delivered).
•    Resource management – identifying & justifying need for new resources.
•    Collaboration and internal training: Provide expertise to internal groups on AD and Hybrid Cloud Products.  
•    Document, track, and mitigate relevant risks related to products (if any).
•    Work closely with Bank’s internal security teams to address security concerns.

People & Talent
•    Responsible Responsible for a team of high performing Directory services Engineering function. 
•    Responsible to ensure career paths are offered to employees to help internal mobility and improve employee engagement and motivation 
•    Lead through example and build the appropriate culture and values. Set appropriate tone and expectations from their team and work in collaboration with risk and control partners.
•    Ensure the provision of ongoing training and development of people and ensure that holders of all critical functions are suitably skilled and qualified for their roles ensuring that they have effective supervision in place to mitigate any risks.
•    Set and monitor job objectives for direct reports and provide feedback and rewards in line with their performance against those responsibilities and objectives
Risk Management
•     Manage all the Risk control and should be responsible for the audit and review the products owned by Engineering team. 
Governance
•     Should create Governance document for the products owned by Active Directory team and manage the governance document for the life cycle 

Regulatory & Business Conduct
•    Display exemplary conduct and live by the Group’s Values and Code of Conduct. 
•    Take personal responsibility for embedding the highest standards of ethics, including regulatory and business conduct, across Standard Chartered Bank. This includes understanding and ensuring compliance with, in letter and spirit, all applicable laws, regulations, guidelines and the Group Code of Conduct.
•    Effectively and collaboratively identify, escalate, mitigate and resolve risk, conduct and compliance matters.
Key stakeholders
•     Domain Architects of all Business functions
•     Engineering & Hive Leads of all Business functions
•     Operation Leads of all Business functions
•     ICS teams
•     CISO teams
Other Responsibilities
•    Lead the engineering streams related to Active Directory services, provide leadership direction and strategy to the engineering functions spread across Poland, Chennai, Malaysia.
•    Work with engineering work stream to certify the various technology solutions and business applications based on business requirement. Create and maintain various artefacts before rolling out a new solution into the Bank, maintain Secure by design principles. 
•    Technical Security Standards 
•    High Level Design, Low Level Design 
•    Configuration Standard Documents
•    Create the Technology On-boarding process for new tools on-boarding.
•    Create Solution Design Documents
•    Create Artefacts related to new tools/Software/SaaS application On-boarding
•    Test Plan, Test Cases, Test evidence and Test Summary report for all the production on-boarding
•    Participate SIA, RAT, Risk Assessment Forum, ETTC, SACA, ITRG discussion and provide necessary information for on-boarding the tools.
•    Create necessary Technical Implementation Procedure for the Technical Security Standards for the products own by Content Engg Team
•    Initiate Annual Review of TIP, RBAC for all the products 
•    Creating Application Installation Guide, implementation Plan, 

•    Active Directory designing, Architecture, Solutioning, Integration with platforms & Applications.
•    Good exposure in Solution Design, Securing AD,
•    Resiliency solution, Administrative AD Tier Model
•    Knowledge on Security standards such as NIST, CIS benchmarking, STIG, and US DoD
•    Work experience with Dev Ops for automation
•    Cyber Security frameworks, threat modelling, MITRE ATT&CK framework reviews
•    Migration experiences. Should have strong experience on migration of AD, ADFS and AAD Connect.
•    Expertise in risk assessments and identifying attack vectors
•    Designing complex Identity solutions, leading work-streams on transformational programs and ensuring conformance to agreed design standards, methods, and tools, including prototyping new tools and applications where appropriate
•    A good working knowledge of the entire M365 stack, including their interactions and use cases
•    Identify and access management; tracking and creating/enforcing policies that govern access sensitive technology resource.  
•    Strong knowledge on Directory service architecture and preparing solution design for migration activities and POCs.

•    Academic or Professional Education/Qualifications: 
•    Bachelor’s or Master’s Degree 
•    IAM technology certifications
•    CISSP certification, and exposure to other security domains 
•    Strong documentation and communication skills.
•    Good analytical and strong technical skills in L3/L4 level trouble shooting. 
•    Experience: 12 -15 years (IT Consultancy, Solution Design, Engineering, Support, Administration)
•    Architect level expertise and specialization (Level-300, Level-400) in Identity Products

We're an international bank, nimble enough to act, big enough for impact. For more than 170 years, we've worked to make a positive difference for our clients, communities, and each other. We question the status quo, love a challenge and enjoy finding new opportunities to grow and do better than before. If you're looking for a career with purpose and you want to work for a bank making a difference, we want to hear from you. You can count on us to celebrate your unique talents and we can't wait to see the talents you can bring us.

Our purpose, to drive commerce and prosperity through our unique diversity, together with our brand promise, to be here for good are achieved by how we each live our valued behaviours. When you work with us, you'll see how we value difference and advocate inclusion.

Together we:

• Do the right thing and are assertive, challenge one another, and live with integrity, while putting the client at the heart of what we do
• Never settle, continuously striving to improve and innovate, keeping things simple and learning from doing well, and not so well
• Are better together, we can be ourselves, be inclusive, see more good in others, and work collectively to build for the long term

In line with our Fair Pay Charter, we offer a competitive salary and benefits to support your mental, physical, financial and social wellbeing.

• Core bank funding for retirement savings, medical and life insurance, with flexible and voluntary benefits available in some locations.
• Time-off including annual leave, parental/maternity (20 weeks), sabbatical (12 months maximum) and volunteering leave (3 days), along with minimum global standards for annual and public holiday, which is combined to 30 days minimum.
• Flexible working options based around home and office locations, with flexible working patterns.
• Proactive wellbeing support through Unmind, a market-leading digital wellbeing platform, development courses for resilience and other human skills, global Employee Assistance Programme, sick leave, mental health first-aiders and all sorts of self-help toolkits
• A continuous learning culture to support your growth, with opportunities to reskill and upskill and access to physical, virtual and digital learning.
• Being part of an inclusive and values driven organisation, one that embraces and celebrates our unique diversity, across our teams, business functions and geographies - everyone feels respected and can realise their full potential.