Senior Security Identity Engineer - (MS AD/EntraID)

Role purpose

Key responsibilities

Identity-security assessment and vulnerability discovery

• Conduct regular security assessments of Active Directory and Microsoft Entra ID.
• Run, interpret and report on findings from:
  • Purple Knight.
  • PingCastle.
  • Forest Druid.
  • Microsoft Defender for Identity recommendations.
  • Microsoft Entra recommendations and Secure Score.
  • Vulnerability scanners and other approved security-assessment tools.
• Validate assessment findings and remove false positives.
• Correlate findings across tools to identify common root causes and attack paths.
• Assess the security posture of:
  • AD domains, forests and trusts.
  • Domain controllers and member servers.
  • Privileged and administrative accounts.
  • Service accounts and managed service accounts.
  • Group Policy and delegated permissions.
  • Microsoft Entra roles, applications and service principals.
  • Hybrid identity synchronisation components.
• Produce a prioritised identity-vulnerability and remediation register.
• Map findings to agreed security standards, control objectives and risk categories.
• Provide clear reporting to technical teams, project governance and risk owners.

Active Directory remediation

• Remediate security weaknesses identified through Purple Knight, PingCastle, Forest Druid, Defender for Identity and other approved assessments.
• Review and improve:
  • Privileged-group membership.
  • Domain and enterprise administrator access.
  • Administrative delegation.
  • Group Policy configuration.
  • Service accounts and managed service accounts.
  • Kerberos security settings.
  • LDAP signing and channel binding.
  • NTLM usage.
  • Unconstrained and constrained delegation.
  • Kerberoasting and credential-exposure risks.
  • Stale, inactive and unmanaged accounts.
  • Domain-controller security configuration.
  • Replication and trust relationships.
  • Administrative tiering and privileged-access boundaries.
• Investigate and remediate identity attack paths identified through assessment tooling.
• Support hardening of domain controllers and associated infrastructure.
• Validate that changes have removed or reduced the relevant security finding.
• Record exceptions where remediation cannot be completed and ensure they are risk-assessed.

Microsoft Entra ID remediation

• Review and remediate Microsoft Entra ID security recommendations and configuration weaknesses.
• Improve controls relating to:
  • Privileged roles and role assignments.
  • Privileged Identity Management.
  • Conditional Access.
  • Multi-factor authentication.
  • Risk-based sign-in and user-risk policies.
  • Legacy authentication.
  • Guest and external-user access.
  • Application registrations and consent.
  • Enterprise applications and service principals.
  • Managed identities.
  • Authentication methods.
  • Emergency-access or break-glass accounts.
  • Access reviews and entitlement governance.
  • Secure administrative access.
• Review and reduce excessive permissions granted to applications and service principals.
• Identify and remediate stale certificates, secrets and credentials.
• Review Microsoft Graph permissions and administrative consent.
• Implement or improve monitoring for suspicious authentication and privilege activity.
• Validate remediation against Microsoft Entra recommendations, Secure Score and agreed security standards.

Tooling and assessment responsibilities

• Install, configure or execute Purple Knight assessments in accordance with approved security and access requirements.
• Run PingCastle health checks and security assessments across relevant AD environments.
• Use Forest Druid to assess forest configuration, trust relationships, attack paths and identity-security risks.
• Review and action Microsoft Defender for Identity recommendations, exposure findings, identity alerts and secure-score improvements.
• Maintain controlled and repeatable assessment procedures.
• Protect assessment outputs, which may contain sensitive identity and infrastructure information.
• Compare results over time to demonstrate improvements in the security posture.
• Ensure tools are used in accordance with licensing, security, privacy and change-management requirements.
• Document tool versions, assessment dates, scope, assumptions and limitations.
• Avoid treating automated tool output as evidence of a vulnerability without appropriate technical validation.

Vulnerability remediation delivery

• Prioritise remediation according to severity, exploitability, exposure, business criticality and programme objectives.
• Develop technical remediation plans, implementation procedures and rollback plans.
• Coordinate testing with infrastructure, application, endpoint, cloud and service owners.
• Implement changes through approved change-management processes.
• Validate remediation through repeat assessments and technical testing.
• Maintain evidence of:
  • The original finding.
  • The agreed remediation.
  • Testing and approvals.
  • The implemented change.
  • Post-remediation validation.
• Track residual risks, accepted exceptions and dependencies.
• Escalate risks that cannot be remediated within agreed timescales.

Engineering and automation

• Develop PowerShell scripts and automation to support identity assessment, remediation and reporting.
• Use Microsoft Graph and approved APIs to assess and manage Entra ID configuration.
• Automate checks for privileged access, stale accounts, risky configurations and policy compliance where appropriate.
• Create repeatable reporting from Purple Knight, PingCastle, Forest Druid and Defender for Identity outputs.
• Ensure scripts and automation are tested, documented, access-controlled and reviewed before production use.

Operational transition

• Produce technical documentation, configuration records and operational runbooks.
• Provide knowledge transfer to internal identity and infrastructure teams.
• Define repeatable assessment schedules and ownership for ongoing reviews.
• Establish processes for reviewing Purple Knight, PingCastle, Forest Druid and Defender for Identity results.
• Support transition of remediation controls into business-as-usual operations.
• Contribute to post-remediation reporting, lessons learned and continuous improvement.

Essential experience and skills

• Strong hands-on experience securing Microsoft Active Directory.
• Strong hands-on experience securing Microsoft Entra ID.
• Demonstrable experience delivering identity vulnerability-remediation programmes.
• Practical experience using:
  • Purple Knight.
  • PingCastle.
  • Forest Druid.
  • Microsoft Defender for Identity.
• Ability to interpret and remediate findings from these tools rather than simply producing assessment reports.
• Deep understanding of:
  • AD domains, forests, trusts and replication.
  • Group Policy.
  • Kerberos and NTLM.
  • LDAP.
  • Privileged access management.
  • Service accounts and managed service accounts.
  • Delegation and access control lists.
  • Microsoft Entra roles and permissions.
  • Conditional Access and multi-factor authentication.
  • Application registrations and service principals.
  • Microsoft Graph permissions.
  • Hybrid identity and directory synchronisation.
• Strong PowerShell capability.
• Experience with Microsoft Graph or equivalent identity APIs.
• Experience implementing secure changes in production environments.
• Understanding of change management, risk management and security assurance.
• Strong documentation and stakeholder-management skills.

Desirable experience

• Experience in financial services or another regulated industry.
• Experience with Microsoft Entra Connect or Microsoft Cloud Sync.
• Experience with privileged-access workstations and administrative tiering.
• Experience with identity governance, access reviews and entitlement management.
• Familiarity with zero-trust principles.
• Experience integrating identity-security findings with SIEM, SOAR, vulnerability-management or service-management platforms.
• Knowledge of Microsoft Defender XDR and related security recommendations.
• Experience with infrastructure-as-code or configuration-management tools.
• Relevant Microsoft, identity or cyber-security certifications.

Expected deliverables

• Purple Knight assessment reports and remediation plans.
• PingCastle assessment reports and remediation plans.
• Forest Druid assessment outputs and remediation actions.
• Microsoft Defender for Identity recommendation reviews and remediation evidence.
• Microsoft Entra ID security-recommendation reviews.
• Validated identity-vulnerability and control-gap registers.
• Prioritised remediation plans.
• Active Directory hardening and privileged-access improvements.
• Entra ID configuration and access-control remediation.
• PowerShell and Microsoft Graph automation.
• Test and validation evidence.
• Exception and residual-risk records.
• Security and audit evidence.
• Operational runbooks and configuration documentation.
• Knowledge-transfer materials.
• Post-remediation reports demonstrating measurable improvement.

Measures of success

• Reduction in validated high- and critical-risk findings from Purple Knight, PingCastle, Forest Druid and Defender for Identity.
• Reduction in Microsoft Entra ID security recommendations and material Secure Score gaps.
• Reduction in excessive privilege and unmanaged administrative access.
• Improved protection of privileged and emergency-access accounts.
• Reduction in legacy authentication and insecure protocols.
• Improved control of service principals, application permissions, credentials and secrets.
• Timely completion of agreed remediation milestones.
• Successful validation of remediation through repeat assessments.
• Quality and completeness of evidence supporting closure.
• Effective transition of ongoing assessment and remediation activities into business-as-usual operations.

Important control requirements

• Follow approved access-control, security and change-management procedures.
• Use appropriately controlled administrative accounts.
• Treat Purple Knight, PingCastle, Forest Druid and Defender for Identity outputs as sensitive security information.
• Avoid making unapproved changes to production identity services.
• Ensure remediation activity is tested, peer-reviewed and appropriately approved.
• Maintain accurate implementation and validation evidence.
• Record residual risks where remediation is not technically or operationally possible.
• Support independent review, audit and assurance activities where required.
• Handle employee, identity and infrastructure information in accordance with applicable data-protection and confidentiality requirements.