Staff Platform Engineer - Active Directory - Identity Services

Junee Southern Cross; Canberra; On-site; AUD 180,000 - 240,000; Full time

Job summary

CommBank in Canberra seeks a Staff Platform Engineer – Active Directory to own the technical direction of our hybrid identity environment. You’ll design, build and secure identity services across on-premises and AWS, balancing engineering depth with security and reliability.

You’ll lead architecture discussions, mentor engineers, and advance automation and infrastructure-as-code practices. This senior IC role emphasizes practical AD expertise and collaboration across cyber security, infra and

Qualifications

• Extensive practical AD expertise across forest and domain design.
• Experience operating hybrid AD estates in on-prem and AWS.
• Strong identity security knowledge incl. least privilege and credential hygiene.
• Experience with Entra ID hybrid identity and modern authentication.
• Proficiency in automation and scripting for identity operations.

Responsibilities

• Act as a senior technical authority for Active Directory across environments.
• Design and engineer hybrid directory topologies and trust patterns.
• Strengthen identity security with privileged access controls and hardening.
• Lead the transition towards target identity architectures and cloud migration.
• Shape the technical roadmap for identity products and plans.
• Champion automation and reusable patterns across identity services.
• Mentor engineers and align identity designs across teams.
• Use metrics and emerging tech to improve security and reliability.

Skills

Active Directory

Identity security

Automation

Scripting

IaC

CI/CD

Technical communication

Mentoring

Tools

Terraform

AWS CDK

CloudFormation

Ansible

GitHub Actions

Grafana

Prometheus

AWS Directory Service

AWS Managed Microsoft AD

Job description

• Own the technical direction of enterprise Active Directory across a complex hybrid identity environment.
• Solve challenging identity and security problems spanning on-premises infrastructure, AWS and Microsoft Entra ID.
• Join a senior, hands-on engineering role where your technical depth will help shape secure, resilient identity services.

Do Work That Matters

Identity sits at the heart of secure and reliable technology.

As a Staff Platform Engineer – Active Directory, you’ll help shape the technical direction of our identity ecosystem, combining deep Active Directory expertise with an identity security mindset.

This is a hands-on senior individual contributor role where you’ll design, build and improve secure identity services spanning on-premises and AWS environments, while helping guide the evolution of our hybrid identity architecture. You’ll balance engineering and technical design with mentoring, automation and the uplift of secure engineering practices across the community.

See yourself in our team

You’ll join our Identity Services team, helping deliver reliable, secure and cost-effective identity services for the end-user computing environment.

Working collaboratively with engineers and partners across Cyber Security, Infrastructure, Cloud and product teams, you’ll apply your technical depth to complex identity challenges while helping establish reusable engineering patterns, standards and practices.

Your responsibilities will include

• Act as a senior technical authority for Active Directory across on-premises, AWS-hosted and AWS-managed directory environments, while contributing expertise across Microsoft Entra ID.
• Design and engineer hybrid directory topologies, including domain controller placement, replication, sites and services, DNS, network connectivity and trust patterns.
• Strengthen identity security through privileged access controls, tiered administration, hardening standards, credential protection and reduction of identity-based attack paths.
• Lead the transition towards target identity architectures, including Active Directory modernisation, cloud migration, hybrid identity integration and retirement of legacy authentication.
• Shape the technical roadmap for identity products and translate strategic priorities into clear, executable engineering plans.
• Champion automation, infrastructure as code, secure engineering standards and reusable patterns across identity services.
• Mentor engineers and build alignment on identity designs and standards across technical teams.
• Use metrics, feedback and emerging technologies to continuously improve identity security, reliability, supportability and cost effectiveness.

We’re interested in hearing from people who:

Bring deep, practical Active Directory expertise together with a strong identity security mindset. You’ll be comfortable operating at enterprise scale, solving complex directory problems hands-on while influencing architecture, security standards and engineering direction.

You’ll ideally bring:

• Extensive practical Active Directory experience across forest and domain design, Group Policy, DNS, DFS, sites and services, replication, trusts, delegation, schema and object lifecycle management.
• Experience operating hybrid Active Directory estates spanning on-premises infrastructure and AWS, including EC2-hosted domain controllers and AWS Directory Service / AWS Managed Microsoft AD.
• Strong identity security knowledge covering least privilege, tiered administration, credential hygiene, Kerberos and NTLM hardening, LDAP security, identity threat detection and attack-path reduction.
• Working knowledge of Microsoft Entra ID, including hybrid identity, directory synchronisation, Conditional Access and modern authentication and authorisation.
• Strong scripting and automation capability applied to identity operations and repeatable engineering delivery.
• Experience with infrastructure-as-code and CI/CD technologies such as Terraform, AWS CDK, CloudFormation, Ansible, GitHub or GitHub Actions.
• Exposure to AWS services supporting directory workloads and automation, alongside observability technologies such as Grafana and Prometheus.
• Strong technical communication and influencing skills, with the ability to mentor engineers and explain complex identity and security concepts clearly.

Working with us

At CommBank, we're committed to creating an accessible, inclusive and respectful workplace. If you require support or adjustments, please let us know. We welcome applications from people of all backgrounds and we're particularly committed to making a positive difference for Aboriginal and/or Torres Strait Islander Peoples. For support please contact 1800 989 696.