Systems Engineer II

Job description

**About the role** This role sits within the workplace Identity team which is part of the Tesco **Workplace Technology engineering team** , part of a global engineering function delivering secure, scalable, and modern workplace solutions for Tesco colleagues. As advanced engineer with expertise in **Identity technologies** , you will contribute (with opportunity to lead) to full technology lifecycle — from strategy and design through to engineering, testing, and delivery — for the services that underpin our digital colleague experience. **You will be responsible for** **Strategic Leadership** - Act as an advanced engineer for Identity within the Workplace Technology team, contributing to **direction, roadmap, and architectural standards** for core identity services including **Active Directory, Entra ID, PKI** , and modern authentication protocols. - Understanding the Identity strategy in relation to Tesco’s broader digital workplace vision, collaborating closely with senior engineers, project management, architects, product managers, security, and infrastructure teams. - Keep yourself up to date with market trends and emerging technologies in identity and access management, contribute to advocation for their adoption where beneficial. **Engineering & Delivery** - Deliver secure, scalable identity platforms that support global business needs and enable modern digital workplace capabilities. Contribute to the design with opportunity to lead. - Engineer solutions across the identity lifecycle: concept, evaluation, prototyping, testing, production deployment, and service transition. - Implement automation, codification (IaC), and integration with CI/CD practices to drive efficiency and resilience. - Contribute to escalations for complex issues related to authentication, replication, certificate lifecycle, hybrid identity, and directory services. **Operational Excellence** - Build systems that are **secure, stable, and easy to operate** , with monitoring, alerting, and lifecycle planning embedded by design. - Champion remediation of legacy identity components and uplift the security and operational posture of all identity services. - Ensure knowledge is well documented and transitions smoothly into operational support with clear SLAs and handover practices. **Governance & Security** - Contribute to adoption of Zero Trust principles, secure admin tiering, modern auth standards, conditional access, and multifactor authentication. - Co-own the health, design, and policy of PKI infrastructure and associated services (including certificate templates, CRLs, and HSMs). - Work closely with the Security and Risk teams to ensure compliance with internal controls, regulatory obligations, and audit findings. **Leadership & Influence** - Represent **Workplace Technology Identity Engineering** across Tesco Technology and into broader cross-functional initiatives. - Lead by example in engineering excellence, stakeholder engagement, and mentoring of less experienced engineers. - Promote a culture of simplification, technical rigour, and continuous improvement. **You will need** **Required Skills & Experience** - Deep expertise in at least one, and experience with all: - **Active Directory** : design, hardening, replication, domain controller lifecycle, GPOs, admin tiering. - **Azure AD / Entra ID** : hybrid identity, conditional access, MFA, identity protection, SSO, SCIM. - **Public Key Infrastructure (PKI)** : policy, lifecycle, templates, automation, CRL/OCSP, HSMs. - **Authentication protocols** : OAuth2, OpenID Connect, SAML, Kerberos, NTLM, WS-Fed. - Demonstrated ability to significantly contribute to design and delivery of identity platforms in large, complex environments. - Understanding of identity’s role in enterprise security frameworks and compliance requirements. - Proficiency with scripting and automation tools (PowerShell, Terraform, etc.). - Familiar with monitoring, backup, recovery, and DR practices for identity systems. - Ensure identity services are designed with built-in resilience, supporting high availability, fault tolerance, and fast recovery across hybrid environments. - Contribute to Business Continuity Plans (BCPs), ensuring critical identity components are documented with clear recovery priorities. - Contribute to design and validation of Disaster Recovery (DR) strategies for directory services, authentication systems, and PKI, with regular failover testing and documented RTO/RPO. - Contribute to defining, and verify backup and recovery plans for identity infrastructure, including domain controllers, certificate authorities, and configuration artifacts. - Estimate engineering effort and support the costing of identity-related projects, including resource planning, licensing, infrastructure, and delivery timelines. - Partner with senior colleagues to help shaping and managing budgets, forecasts, and business cases for new identity initiatives. **Nice to Have** - Experience integrating identity across Linux, SaaS, and multi-cloud platforms. - Understanding of M365, Microsoft ecosystem, and their dependency on robust identity infrastructure. - Exposure to identity governance, entitlement management, and lifecycle workflows. **Complementary Skills** - Strong collaboration skills across engineering, operations and security domains. - Experien