Senior Principal - IAM Operations

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.

Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Job Purpose:

The Senior Principal, IAM Directory Services is the senior technical authority for the security, resilience and continuous hardening of GSK’s enterprise directory services. The role leads a defined area of the IAM Directory Services capability and ensures that Active Directory, Microsoft Entra ID and the supporting identity synchronisation layer are designed, operated and improved using secure-by-design and defence-in-depth principles. The role owns security outcomes across the directory estate, drives risk reduction, and provides technical leadership for remediation arising from penetration testing, security assessments, incidents and audit findings.

About the team:

IAM Directory Services owns the identity control plane that underpins authentication and authorisation across GSK. The team protects this critical foundation by maintaining secure directory architecture, enforcing tiered administration, controlling privileged access, reducing legacy exposure, continuously validating configuration, and ensuring that directory services can be securely recovered following a cyber event.

Key responsibilities:

This role will provide you with the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

• Act as the senior technical authority for the security architecture, hardening and operational integrity of Active Directory, Microsoft Entra ID and associated directory and synchronization services.

• Lead a defined area of the Directory Services security capability, including its delivery roadmap, technical standards, risk position and measurable security outcomes.

• Embed secure-by-design principles into new directory services, migrations, integrations and material changes, ensuring that threat modelling, security requirements and control validation are completed before production deployment.

• Design, implement and maintain a tiered administrative security model that separates identity control-plane administration from server, workstation and application administration.

• Own the architecture and security controls for privileged administration, including hardened administrative workstations, bastion or jump-host services, dedicated administrative identities, privileged group governance and restrictions on credential exposure.

• Define and maintain directory security policies, configuration baselines, Group Policy standards and technical guardrails. Ensure that exceptions are formally assessed, documented, approved, time-bound and reviewed.

• Continuously harden the directory estate by reducing attack paths and legacy exposure, including insecure authentication protocols, weak cryptography, excessive privilege, unconstrained delegation, insecure trusts, stale identities and unsupported configurations.

• Lead the Directory Services response to penetration tests, red-team exercises, vulnerability assessments and audit findings. Validate technical evidence, assess exploitability and business impact, agree remediation plans, track actions to closure and verify that fixes are effective.

• Provide directory security leadership during incidents and investigations, supporting containment, forensic analysis, eradication and secure restoration while preserving appropriate evidence.

• Own monitoring requirements and security use cases for privileged changes, authentication anomalies, directory replication, policy changes, persistence techniques and indicators of compromise affecting the identity control plane.

• Maintain a robust security assurance programme covering configuration compliance, privileged access reviews, control testing, attack-path analysis, vulnerability management and evidence production for internal and external assurance activities.

• Own secure backup and recovery requirements for directory services, including isolated and protected backups, recovery procedures, regular restoration testing and evidence that recovery objectives can be met following compromise.

• Provide technical governance for domains, forests, tenants, trusts, federation and identity synchronisation, ensuring that architecture decisions minimise privilege, limit blast radius and support secure lifecycle management.

• Manage delivery against the capability and security roadmap, prioritising work according to risk and escalating material blockers, control gaps and accepted risks through the appropriate governance forums.

• Represent Directory Services in cyber security governance, architecture review, risk, audit and cross-functional forums, translating complex technical risk into clear decisions and accountable actions.

• Develop team capability through coaching, technical review, secure engineering practices, knowledge transfer and structured feedback.

Basic Qualifications:

• Degree in a relevant discipline, or equivalent practical experience.

• Demonstrated enterprise-scale experience engineering, securing and operating Active Directory and Microsoft Entra ID.

• Deep practical knowledge of Active Directory security architecture, attack paths, authentication, authorisation, delegation, trusts, Group Policy, privileged groups and directory replication.

• Hands-on experience implementing directory hardening, tiered administration, privileged access controls, hardened administrative workstations and bastion or jump-host patterns.

• Experience defining, maintaining and assuring security configuration baselines, technical policies, standards and exception processes.

• Proven experience responding to penetration tests, red-team findings, vulnerabilities, incidents or audit observations and driving remediation through to validated closure.

• Working knowledge of directory synchronisation, identity data flows and the security implications of hybrid identity architecture.

• Practical experience with security monitoring, incident response, backup and recovery for critical identity infrastructure.

• Significant experience in cyber security within identity, directory services or a related infrastructure security domain.

• Proven experience leading a team or substantial security programme and delivering to agreed scope, quality and timelines.
• Excellent risk communication, relationship management, influencing and stakeholder engagement skills.

Preferred Qualifications:

• Deep hands-on experience hardening complex multi-domain or multi-forest Active Directory environments and hybrid identity services.

• Experience applying recognised directory security guidance and translating it into enforceable enterprise standards and measurable controls.

• Experience with privileged access management, just-in-time administration, credential isolation, attack-path management and administrative tiering.

• Knowledge of common Active Directory adversary techniques, including credential theft, Kerberos abuse, delegation abuse, directory replication abuse, persistence and lateral movement.

• Experience designing and operating secure bastion, jump-host or privileged administrative access solutions.

• Experience with security assessment, penetration testing remediation, threat modelling and technical risk assessment.

• Advanced PowerShell scripting skills for security assurance, control validation, monitoring and evidence generation.

• Experience with directory migration, consolidation, domain decommissioning or recovery programmes where security and blast-radius reduction were key outcomes.

• Relevant certifications such as CISSP, SC-300, Microsoft identity and access certifications, or comparable security qualifications.

• Experience in pharmaceutical, life sciences or another highly regulated industry.
• Typical tools and technologies: Active Directory Domain Services, Microsoft Entra ID, Entra Connect, Group Policy, LDAP, Kerberos, PowerShell, privileged access and bastion technologies, security monitoring and SIEM platforms, attack-path and exposure management tooling, vulnerability management, and directory backup and recovery tooling.

#AGTech

Skills

Account Lifecycle Management, AI Agents, Authentication Systems, Automation Technology, Certificate Management, Cloud Based Services, Cloud IAM, Computer Programming, Configuration Management (CM), Database Management, Directory Services, IAM Tools, Identity Access Management (IAM), Identity Lifecycle Management, Information Technology (IT) Risk Management, Infrastructure Security, LLM Orchestration, Orchestrate, Privileged Access Management (PAM), Security Controls, System Monitors, Troubleshooting

 

 

Why GSK?

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK:

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.

Please contact our Recruitment Team at IN.recruitment-adjustments@gsk.com to discuss your needs.

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way.

GlaxoSmithKline does not charge any fee whatsoever for recruitment process. Please do not make payments to any individuals / entities in connection with recruitment with any GlaxoSmithKline (or GSK) group company at any worldwide location. Even if they claim that the money is refundable.

If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in “gsk.com”, you should disregard the same and inform us by emailing askus@gsk.com, so that we can confirm to you if the job is genuine.