Staff Platform Engineer - Active Directory - Identity Services

Commonwealth Bank; Sydney; On-site; AUD 170,000 - 210,000; Full time

Job summary

Commonwealth Bank is seeking a Staff Platform Engineer - Active Directory to own the technical direction of enterprise AD in a hybrid environment. You will design, build and improve secure identity services spanning on-premises and AWS, while guiding the evolution of the hybrid identity architecture.

You will balance engineering with mentoring, automation and uplift of secure engineering practices across the identity services community, collaborating with Cyber Security, Infrastructure and Cloud

Qualifications

• Extensive practical Active Directory experience across forest and domain design, GPO, DNS and replication.
• Experience operating hybrid Active Directory estates spanning on-premises and AWS.
• Strong identity security knowledge including least privilege and credential hygiene.
• Working knowledge of Microsoft Entra ID, hybrid identity and modern authentication.
• Proficient scripting and automation for identity operations and repeatable delivery.

Responsibilities

• Act as senior technical authority for Active Directory across on‑premises, AWS-hosted and AWS-managed environments.
• Design and engineer hybrid directory topologies, domain controller placement, DNS, sites and services.
• Strengthen identity security and reduce identity-based attack paths via privileged access controls.
• Lead transitions toward target identity architectures and cloud migrations.
• Shape technical roadmaps for identity products and translate priorities into engineering plans.
• Champion automation and infrastructure-as-code for identity services.
• Mentor engineers and align identity designs across technical teams.
• Use metrics and new technologies to improve identity security, reliability and cost efficiency.

Skills

Active Directory

Hybrid identity

Entra ID

Terraform

AWS

Scripting

CI/CD

Security engineering

Mentoring

Tools

Terraform

AWS CDK

CloudFormation

Ansible

GitHub Actions

Grafana

Prometheus

Job description

Staff Platform Engineer - Active Directory - Identity Services

• Own the technical direction of enterprise Active Directory across a complex hybrid identity environment.
• Solve challenging identity and security problems spanning on-premises infrastructure, AWS and Microsoft Entra ID.
• Join a senior, hands-on engineering role where your technical depth will help shape secure, resilient identity services.

Do Work That Matters

Identity sits at the heart of secure and reliable technology.

As a Staff Platform Engineer - Active Directory, you'll help shape the technical direction of our identity ecosystem, combining deep Active Directory expertise with an identity security mindset.

This is a hands-on senior individual contributor role where you'll design, build and improve secure identity services spanning on-premises and AWS environments, while helping guide the evolution of our hybrid identity architecture. You'll balance engineering and technical design with mentoring, automation and the uplift of secure engineering practices across the community.

See yourself in our team

You'll join our Identity Services team, helping deliver reliable, secure and cost-effective identity services for the end-user computing environment.

Working collaboratively with engineers and partners across Cyber Security, Infrastructure, Cloud and product teams, you'll apply your technical depth to complex identity challenges while helping establish reusable engineering patterns, standards and practices.

Your responsibilities will include

• Act as a senior technical authority for Active Directory across on-premises, AWS-hosted and AWS-managed directory environments, while contributing expertise across Microsoft Entra ID.
• Design and engineer hybrid directory topologies, including domain controller placement, replication, sites and services, DNS, network connectivity and trust patterns.
• Strengthen identity security through privileged access controls, tiered administration, hardening standards, credential protection and reduction of identity-based attack paths.
• Lead the transition towards target identity architectures, including Active Directory modernisation, cloud migration, hybrid identity integration and retirement of legacy authentication.
• Shape the technical roadmap for identity products and translate strategic priorities into clear, executable engineering plans.
• Champion automation, infrastructure as code, secure engineering standards and reusable patterns across identity services.
• Mentor engineers and build alignment on identity designs and standards across technical teams.
• Use metrics, feedback and emerging technologies to continuously improve identity security, reliability, supportability and cost effectiveness.

We're interested in hearing from people who:

Bring deep, practical Active Directory expertise together with a strong identity security mindset. You'll be comfortable operating at enterprise scale, solving complex directory problems hands-on while influencing architecture, security standards and engineering direction.

You'll ideally bring:

• Extensive practical Active Directory experience across forest and domain design, Group Policy, DNS, DFS, sites and services, replication, trusts, delegation, schema and object lifecycle management.
• Experience operating hybrid Active Directory estates spanning on-premises infrastructure and AWS, including EC2-hosted domain controllers and AWS Directory Service / AWS Managed Microsoft AD.
• Strong identity security knowledge covering least privilege, tiered administration, credential hygiene, Kerberos and NTLM hardening, LDAP security, identity threat detection and attack-path reduction.
• Working knowledge of Microsoft Entra ID, including hybrid identity, directory synchronisation, Conditional Access and modern authentication and authorisation.
• Strong scripting and automation capability applied to identity operations and repeatable engineering delivery.
• Experience with infrastructure-as-code and CI/CD technologies such as Terraform, AWS CDK, CloudFormation, Ansible, GitHub or GitHub Actions.
• Exposure to AWS services supporting directory workloads and automation, alongside observability technologies such as Grafana and Prometheus.
• Strong technical communication and influencing skills, with the ability to mentor engineers and explain complex identity and security concepts clearly.

Working with us

At CommBank, we're committed to creating an accessible, inclusive and respectful workplace. If you require support or adjustments, please let us know. We welcome applications from people of all backgrounds and we're particularly committed to making a positive difference for Aboriginal and/or Torres Strait Islander Peoples. For support please contact 1800 989 ***.

We're aware of some accessibility issues on this site, particularly for screen reader users. We want to make finding your dream job as easy as possible, so if you require additional support please contact HR Direct on 1800 989 ***.