Active Directory Expert

Role Overview

We are looking for an experienced and Expert in Active Directory (AD) / Identity & Access Management Engineer responsible for the administration, engineering, security, troubleshooting, and continuous improvement of enterprise Microsoft Active Directory environments.

The ideal candidate will have strong hands-on experience in Active Directory Domain Services (AD DS), Group Policy, DNS, identity and access management, Microsoft Entra ID (Azure AD), authentication, and PowerShell automation.

The role will support both day-to-day operations and complex AD-related incidents, projects, migrations, security improvements, and integrations.

Key Responsibilities

• Administer, maintain, and support enterprise Microsoft Active Directory Domain Services (AD DS) environments.
• Manage users, groups, organizational units (OUs), computer objects, service accounts, and access permissions.
• Design, implement, maintain, and troubleshoot Group Policy Objects (GPOs).
• Manage and troubleshoot domain controllers, replication, trusts, sites and services, FSMO roles, DNS, LDAP, Kerberos, and NTLM authentication.
• Perform Active Directory health checks, performance monitoring, capacity assessment, and preventive maintenance. Investigate and resolve complex authentication, authorization, account lockout, replication, DNS, and access related incidents.
• Support Microsoft Entra ID / Azure Active Directory, including hybrid identity environments.
• Support synchronization technologies such as Microsoft Entra Connect / Azure AD Connect.
• Assist in the implementation and administration of Single Sign-On (SSO), Multi Factor Authentication (MFA), Conditional Access, and Role-Based Access Control (RBAC).
• Implement security hardening and remediation measures based on Microsoft best practices and organizational security policies.
• Review privileged accounts, service accounts, stale accounts, inactive objects, and excessive permissions.
• Support AD-related security assessments, vulnerability remediation, and audit requirements.
• Develop and maintain PowerShell scripts for AD administration, reporting, monitoring, and automation.
• Participate in AD migration, consolidation, upgrade, domain restructuring, and modernization projects.
• Perform backup, recovery, and disaster recovery activities for Active Directory.
• Create and maintain technical documentation, configuration standards, operating procedures, and knowledge-base articles.
• Work closely with Infrastructure, Cloud, Cybersecurity, Service Desk, Application, and Network teams on identity-related requirements.
• Provide technical guidance and escalation support for L2/L3 infrastructure and identity incidents.

Required Qualifications

• Bachelor's degree in Information Technology, Computer Science, Computer Engineering, Electronics Engineering, or a related field.
• At least 5 years of hands-on Active Directory administration/engineering experience, preferably supporting medium to large enterprise environments.

Advanced knowledge of:

• Active Directory Domain Services (AD DS)
• Group Policy
• DNS and DHCP
• LDAP, Kerberos and NTLM
• Active Directory replication and trusts
• Windows Server administration
• Microsoft Entra ID / Azure AD Hybrid identity environments
• PowerShell scripting.
• Strong troubleshooting capability across identity, authentication, Windows Server, and network-related dependencies.
• Good understanding of identity security, least privilege, privileged access management, and access-control principles.
• Experience handling production incidents and performing root-cause analysis.
• Strong documentation, analytical, and communication skills.

Preferred Qualifications

• Experience in any of the following would be an advantage:
• Microsoft Entra ID / Microsoft 365 administration
• Entra Connect / Azure AD Connect
• Active Directory Federation Services (AD FS)
• SAML, OAuth 2.0 and OpenID Connect
• Privileged Access Management (PAM/PIM)
• Microsoft Defender for Identity
• Active Directory Certificate Services (AD CS)
• PKI and certificate management
• Microsoft Intune Identity Governance
• CyberArk, SailPoint, Okta, Ping Identity or similar IAM/PAM solutions
• Active Directory migration and consolidation projects
• Cloud migration and hybrid Azure environments
• ITIL-based incident, problem, and change management
• Microsoft certifications related to Windows Server, Azure, Security, Identity, or Microsoft 365 are preferred but not mandatory.

Technical Competency Expectations

The successful candidate should be capable of independently handling L3-level Active Directory issues, including complex replication failures, authentication issues, GPO problems, domain controller incidents, DNS dependencies, trust relationships, identity synchronization, and security-related AD concerns. The candidate should also be able to assess an existing AD environment, identify technical and security risks, and recommend improvements aligned with Microsoft and enterprise security best practices.

Application Question(s):

• Do you have an expert-level knowledge of Azure AD, Active Directory, and hybrid identity architectures?
• Are you willing to work the night shift and in a hybrid setup in Alabang?
• How much is your expected salary? (Don't leave it blank)

Experience:

• Active Directory administration / engineering: 5 years (Required)
• managing DNS, Domain Controller, FSMO role: 5 years (Required)

Work Location: Hybrid remote in Alabang