Senior Principal - IAM Operations

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems. Our diverse portfolio consists of vaccines, specialty medicines, and general medicines. Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges. Job Purpose: The Senior Principal, IAM Directory Services is the senior technical authority for the security, resilience and continuous hardening of GSK’s enterprise directory services. The role leads a defined area of the IAM Directory Services capability and ensures that Active Directory, Microsoft Entra ID and the supporting identity synchronisation layer are designed, operated and improved using secure-by-design and defence-in-depth principles. The role owns security outcomes across the directory estate, drives risk reduction, and provides technical leadership for remediation arising from penetration testing, security assessments, incidents and audit findings. About the team : IAM Directory Services owns the identity control plane that underpins authentication and authorisation across GSK. The team protects this critical foundation by maintaining secure directory architecture, enforcing tiered administration, controlling privileged access, reducing legacy exposure, continuously validating configuration, and ensuring that directory services can be securely recovered following a cyber event. Key responsibilities: This role will provide you with the opportunity to lead key activities to progress your career. These responsibilities include some of the following: • Act as the senior technical authority for the security architecture, hardening and operational integrity of Active Directory, Microsoft Entra ID and associated directory and synchronization services. • Lead a defined area of the Directory Services security capability, including its delivery roadmap, technical standards, risk position and measurable security outcomes. • Embed secure-by-design principles into new directory services, migrations, integrations and material changes, ensuring that threat modelling, security requirements and control validation are completed before production deployment. • Design, implement and maintain a tiered administrative security model that separates identity control-plane administration from server, workstation and application administration. • Own the architecture and security controls for privileged administration, including hardened administrative workstations, bastion or jump-host services, dedicated administrative identities, privileged group governance and restrictions on credential exposure. • Define and maintain directory security policies, configuration baselines, Group Policy standards and technical guardrails. Ensure that exceptions are formally assessed, documented, approved, time-bound and reviewed. • Continuously harden the directory estate by reducing attack paths and legacy exposure, including insecure authentication protocols, weak cryptography, excessive privilege, unconstrained delegation, insecure trusts, stale identities and unsupported configurations. • Lead the Directory Services response to penetration tests, red-team exercises, vulnerability assessments and audit findings. Validate technical evidence, assess exploitability and business impact, agree remediation plans, track actions to