Senior Identity Engineer - IT Risk and Security at StoneX in Bangalore

Job description

Overview Connecting clients to markets – and talent to opportunity. With 5,400+ employees and over 80,000 institutional, commercial, and payments clients, we operate from more than 80 offices spread across six continents. As a Fortune 100, Nasdaq-listed provider, we connect clients to the global markets – focusing on innovation, human connection, and providing world-class products and services to all types of investors. Whether you want to forge a career connecting our retail clients to potential trading opportunities, or ingrain yourself in the world of institutional investing, StoneX Group is made up of four business segments that offer endless potential for progression and growth. Business Segment Overview Corporate: Engage in a deep variety of business-critical activities that keep our company running efficiently. From strategic marketing and financial management to human resources and operational oversight, you’ll have the opportunity to optimize processes and implement game-changing policies. Position Purpose: As Senior Identity Engineer for IT Risk and Security, you will be a senior hands-on engineer responsible for operating, improving, automating, securing and troubleshooting the enterprise identity platforms the firm depends on. The estate of platforms include Identity Providers, legacy directory services, enterprise PKI, privileged access management, modern authentication and identity governance tooling, alongside legacy platforms now being retired. This is a senior individual contributor role, not an architect role — the ideal candidate is deeply hands-on, comfortable owning complex, ambiguous identity problems end to end with minimal supervision, and raises the standard of the engineers around them. Experience working in a regulated financial environment is a plus. Responsibilities Primary duties will include: Design, build and operate identity services across core identity provider platforms—Entra ID with hybrid directory services and Okta—including authentication journeys, application integration, federation and single sign-on at scale; implement, test, troubleshoot and monitor access policies, Conditional Access, MFA, passwordless authentication, authentication strengths, session controls, policy exclusions and emergency access safeguards. Operate and troubleshoot Active Directory in large, complex, multi-domain and multi-forest environments, including domain controllers, DNS and name resolution, Sites and Services, replication, Group Policy, trusts and cross-domain authentication, service accounts, privileged groups, delegated access and domain health; coordinate changes across dependent systems. Serve as a senior escalation point for complex identity incidents — authentication failures, provisioning issues, certificate-related outages, privileged access problems and production change failures — determining cause, escalating anything with ongoing or immediate impact, performing root cause analysis and driving the problem to a permanent fix. Plan, execute, validate and document production identity changes, including risk assessment, implementation steps, rollback planning, stakeholder coordination, functional and connectivity testing, and post-change monitoring. Grow the joiner, mover and leaver lifecycle — provisioning and deprovisioning driven from authoritative HR sources, and policy and role-based entitlement in place of ticket-by-ticket approval. Support PKI and certificate lifecycle operations as they relate to identity services — TLS certificates, certificate-based authentication, domain controller certificates, renewal, revocation checks and outage troubleshooting. Automate repeatable identity administration, reporting, validation, reconciliation and remediation using PowerShell, Microsoft Graph, REST APIs, source control and pipeline-based workflows, applying configuration-as-code to identity change rather than manual administration. Develop group policies and access control lists, design and build sys