Senior Platform Engineer

Senior Platform Engineer (Hybrid in Burbank, CA or Seattle, WA or Orlando, FL)

Optomi, in partnership with a leading technology firm, is looking for a Senior Platform Engineer (Active Directory & PAM) to join their team in Burbank, Orlando, or Seattle. The Senior Platform Engineer will play a pivotal role in analyzing and modernizing the lifecycle management of identities within Active Directory and Entra. This position involves documenting and guiding the decommissioning of legacy Active Directory instances, evaluating service capabilities, and designing future service offerings. The role requires compliance and remediation activities across AD, Entra, and related platforms, ensuring engineered designs are documented and solutions follow structured methodologies.

What the right candidate will enjoy:

• Leading cutting-edge projects in identity and access management.
• Opportunities to work with advanced technologies like CyberArk and Microsoft Identity Manager.
• Collaborating with a dynamic team across multiple locations.
• Hybrid work environment 4 days onsite and 1 day remote.

What type of experience does the right candidate have:

• Minimum of 8 years in Identity & Access Management.
• Experience with PKI architecture and certificate lifecycle management.
• Experience with Active Directory, Azure Active Directory / Entra ID, Microsoft Identity Manager, Active Directory Federation, and PAM Solutions.
• Experience with Cyber Ark / Idira.
• Engineering, designing, and integrating infrastructure components and logical aspects.
• Experience automating non-human (service) account lifecycle management.
• Experience conducting AD/Entra security baseline assessments.

What the responsibilities are of the right candidate:

• Lead consolidation and decommissioning of the legacy MGMT and iDMZ Active Directory domains and their associated PKI infrastructure.
• Onboard privileged accounts into the PAM platform, vaulting Tier 0/1/2 credentials and enforcing zero standing privileged access across AD domains.
• Implement role-based access controls (RBAC) and privileged identity management (PIM) across Active Directory and Entra ID, replacing legacy, overly broad permissions.
• Automate provisioning and deprovisioning of non-human (service) accounts, including ownership enforcement and lifecycle management.
• Standardize AD architecture and governance across Enterprise Tech and business unit/segment-managed domains, including baseline security assessments.
• Design and pilot cross-tenant Entra ID governance to extend identity controls across business segments and partners.
• Deploy Privileged Access Workstations (PAW) and restrict Tier 0 administrative activity to hardened, isolated devices.
• Remediate high-priority security findings across AD and Entra/M365 tenants to reduce the attack surface ahead of migration.