Senior Active Directory Engineer

We are seeking an experienced Senior Active Directory Engineer to take ownership of our enterprise Directory Services infrastructure. In this role, you will be in charge across a complex, multi-domain, multi-forest environment. You will be responsible for ensuring the high availability, security posture, compliance, and seamless operational performance of active directory instances, identity sync pipelines, and directory-integrated services.

Key Responsibilities

• Architecture & Operations
• Design, implement, and maintain multi-forest and multi-domain Active Directory Domain Services (AD DS) architectures, including trust relationships, sites, subnets, and replication topologies.
• Act as an operational tier-3 escalation point for all identity, authentication, and directory services issues across global infrastructure.
• Manage and maintain Active Directory (AD), Active Directory Certificate Services (AD CS), and Domain Name System (DNS) integrated with AD.
• Architect, test, and manage Group Policy Objects (GPOs) to enforce security baselines, standard configurations, and user environments across server and endpoint fleets.
• Security & Privileged Access
• Serve as a primary custodian of Tier-0 privileged accounts (Enterprise Admin, Domain Admin, Schema Admin).
• Enforce Least Privilege Access models and Tiered Administration (Tier 0, Tier 1, Tier 2 architecture) to eliminate cross-tier compromise vectors.
• Perform hardening against directory attack vectors (e.g., Kerberoasting, AS-REP Roasting, DCSync, Pass-the-Hash) using security frameworks
• Monitor directory change auditing tools and integrate logs with Enterprise SIEM for real-time threat detection and remediation.
• Hybrid Identity & Integration
• Manage hybrid identity integration, including Microsoft Entra Connect (Azure AD Connect), password hash synchronization (PHS), pass-through authentication (PTA), or ADFS.
• Oversee identity lifecycle management and cross-domain migration/consolidation projects (mergers, acquisitions, or enterprise restructurings).
• Disaster Recovery & Maintenance
• Design, document, and regularly test forest-level and domain-level Disaster Recovery (DR) plans using native tools and third-party recovery software.
• Perform routine health checks, schema extensions, functional level upgrades, and Domain Controller patching/lifecycle management.

Qualifications & Requirements

• Experience: 6+ years of hands-on experience designing, managing, and securing enterprise Active Directory infrastructure in environments with objects/users across multiple domains/forests.
• Privileged Access Management : Proven experience safely managing Tier-0 assets and handling Enterprise Admin-level privileges with extreme operational rigor.
• Scripting & Automation: Advanced proficiency in PowerShell for administrative task automation, bulk object management, reporting, and policy enforcement.
• Core Protocols: In-depth knowledge of core authentication protocols (Kerberos, NTLM, LDAP/LDAPS, SAML, OAuth) and DNS design.
• Disaster Recovery: Demonstrated experience executing forest recovery procedures and domain-level backup/restore strategies.
• Effective communication: Ability to communicate effectively and technically in English.

Preferred Skills (Plus)

• Industry certifications such as MCSE / MCSA (Legacy), Microsoft Certified: Identity and Access Administrator Associate (SC-300), Microsoft Certified: Cybersecurity Architect Expert (SC-100), or CISSP.
• Experience with Privileged Access Management (PAM) / Privileged Identity Management (PIM) tools (e.g., CyberArk, BeyondTrust, Entra PIM).
• Familiarity with third-party Active Directory security auditing tools (e.g., BloodHound, PingCastle, Semperis, Purple Knight).