Senior Principal - IAM Operations

Overview

Senior technical authority for the security, resilience and continuous hardening of GSK's enterprise directory services, leading a defined area of the IAM Directory Services capability across Active Directory, Microsoft Entra ID and the identity synchronisation layer.

What you'll do

• Act as the senior technical authority for the security architecture, hardening and operational integrity of Active Directory, Microsoft Entra ID and associated directory and synchronization services.
• Lead a defined area of the Directory Services security capability, including its delivery roadmap, technical standards, risk position and measurable security outcomes.
• Embed secure-by-design principles into new directory services, migrations, integrations and material changes, ensuring that threat modelling, security requirements and control validation are completed before production deployment.
• Design, implement and maintain a tiered administrative security model that separates identity control-plane administration from server, workstation and application administration.
• Own the architecture and security controls for privileged administration, including hardened administrative workstations, bastion or jump-host services, dedicated administrative identities, privileged group governance and restrictions on credential exposure.
• Define and maintain directory security policies, configuration baselines, Group Policy standards and technical guardrails. Ensure that exceptions are formally assessed, documented, approved, time-bound and reviewed.
• Continuously harden the directory estate by reducing attack paths and legacy exposure, including insecure authentication protocols, weak cryptography, excessive privilege, unconstrained delegation, insecure trusts, stale identities and unsupported configurations.
• Lead the Directory Services response to penetration tests, red-team exercises, vulnerability assessments and audit findings. Validate technical evidence, assess exploitability and business impact, agree remediation plans, track actions to closure and verify that fixes are effective.
• Provide directory security leadership during incidents and investigations, supporting containment, forensic analysis, eradication and secure restoration while preserving appropriate evidence.
• Own monitoring requirements and security use cases for privileged changes, authentication anomalies, directory replication, policy changes, persistence techniques and indicators of compromise affecting the identity control plane.
• Maintain a robust security assurance programme covering configuration compliance, privileged access reviews, control testing, attack-path analysis, vulnerability management and evidence production for internal and external assurance activities.
• Own secure backup and recovery requirements for directory services, including isolated and protected backups, recovery procedures, regular restoration testing and evidence that recovery objectives can be met following compromise.
• Provide technical governance for domains, forests, tenants, trusts, federation and identity synchronisation, ensuring that architecture decisions minimise privilege, limit blast radius and support secure lifecycle management.
• Manage delivery against the capability and security roadmap, prioritising work according to risk and escalating material blockers, control gaps and accepted risks through the appropriate governance forums.
• Represent Directory Services in cyber security governance, architecture review, risk, audit and cross-functional forums, translating complex technical risk into clear decisions and accountable actions.
• Develop team capability through coaching, technical review, secure engineering practices, knowledge transfer and structured feedback.

What you'll need

• Degree in a relevant discipline, or equivalent practical experience.
• Demonstrated enterprise-scale experience engineering, securing and operating Active Directory and Microsoft Entra ID.
• Deep practical knowledge of Active Directory security architecture, attack paths, authentication, authorisation, delegation, trusts, Group Policy, privileged groups and directory replication.
• Hands-on experience implementing directory hardening, tiered administration, privileged access controls, hardened administrative workstations and bastion or jump-host patterns.
• Experience defining, maintaining and assuring security configuration baselines, technical policies, standards and exception processes.
• Proven experience responding to penetration tests, red-team findings, vulnerabilities, incidents or audit observations and driving remediation through to validated closure.
• Working knowledge of directory synchronisation, identity data flows and the security implications of hybrid identity architecture.
• Practical experience with security monitoring, incident response, backup and recovery for critical identity infrastructure.
• Significant experience in cyber security within identity, directory services or a related infrastructure security domain.
• Proven experience leading a team or substantial security programme and delivering to agreed scope, quality and timelines.
• Excellent risk communication, relationship management, influencing and stakeholder engagement skills.

Nice to have

• Deep hands-on experience hardening complex multi-domain or multi-forest Active Directory environments and hybrid identity services.
• Experience applying recognised directory security guidance and translating it into enforceable enterprise standards and measurable controls.
• Experience with privileged access management, just-in-time administration, credential isolation, attack-path management and administrative tiering.
• Knowledge of common Active Directory adversary techniques, including credential theft, Kerberos abuse, delegation abuse, directory replication abuse, persistence and lateral movement.
• Experience designing and operating secure bastion, jump-host or privileged administrative access solutions.
• Experience with security assessment, penetration testing remediation, threat modelling and technical risk assessment.
• Advanced PowerShell scripting skills for security assurance, control validation, monitoring and evidence generation.
• Experience with directory migration, consolidation, domain decommissioning or recovery programmes where security and blast-radius reduction were key outcomes.
• Relevant certifications such as CISSP, SC-300, Microsoft identity and access certifications, or comparable security qualifications.
• Experience in pharmaceutical, life sciences or another highly regulated industry.

Details

• Location: Bengaluru, India (Luxor North Tower).