Active Directory Engineer

Key ResponsibilitiesAdminister and maintain Active Directory Domain Services across forests, domains, and sites.Design and maintain forest and domain architecture, domain controllers, Group Policy, and AD replication.Manage DNS integration with AD, sites and services, trusts, and multi-forest environments.Perform AD security assessments and implement hardening measures.Implement and enforce Tier 0 and privileged access models.Configure and monitor Kerberos and NTLM authentication, LDAP signing, and channel binding.Deploy and manage LAPS and gMSA accounts.Review and manage delegation and ACLs to enforce least privilege.Identify and remediate attack paths and privilege escalation risks.Administer AD CS and PKI services.Plan and execute forest recovery and disaster recovery procedures.Manage Microsoft Entra ID, Entra Connect, and hybrid identity synchronization.Implement and maintain Conditional Access, MFA, and PIM policies.Automate administrative tasks and reporting using PowerShell.Partner with security, infrastructure, and operations teams on identity-related incidents and audits.Document standards, procedures, and architecture diagrams.Required QualificationsProven experience administering Active Directory in an enterprise environment.Hands-on experience with Active Directory / AD DS and Forest / Domain Architecture.Experience with Domain Controllers, Group Policy / GPO, and AD Replication.Experience with DNS / Sites and Services and Trusts / Multi-Forest environments.Strong PowerShell scripting skills.Experience with AD Security Assessment / Hardening.Working knowledge of Tier 0 / Privileged Access models.Understanding of Kerberos / NTLM authentication.Experience with LDAP Signing / Channel Binding.Experience with LAPS / gMSA.Experience with Delegation / ACLs.Experience with Authentication Hardening.Knowledge of Attack Paths / Privilege Escalation and how to mitigate them.Experience with AD CS / PKI.Experience with Forest Recovery / Disaster Recovery.Experience with Microsoft Entra ID, Entra Connect, and Hybrid Identity.Experience with Conditional Access, MFA, and PIM.Preferred QualificationsRelevant certifications such as Microsoft Certified: Identity and Access Administrator Associate, Microsoft Certified: Security Operations Analyst Associate, or Microsoft Certified: Azure Security Engineer Associate.Experience with identity threat detection tools and security monitoring.Experience in regulated industries with strict access control requirements.