1. Active Directory Engineering
2. Domain migrations (closer to thousands of tenants)
3. Systems and server engineering experience
Secondary Skills - Nice to Haves
- Python
- Azure
- Security
- Cloud
- Support
Job Description
- Planning, execution, and optimization of Active Directory operations, with a strong emphasis on on-premises domain management, including domain controllers, forests, sites, services, and Group Policy Objects (GPOs).
- Quest migration (will be the only expert on the subject) - need to have strong understanding of the tool
- Oversee ongoing domain migrations, including workstation (35,000+ endpoints), server, and application transitions from legacy domains to a consolidated, modern structure; address stalled initiatives by implementing automation and best practices.
- Manage hybrid AD configurations, ensuring seamless synchronization between on-prem AD and Entra ID using tools like Azure AD Connect; handle identity federation, conditional access policies, and cloud integration for 20% of our cloud-native workloads.
- Troubleshoot and resolve complex AD issues, such as replication failures, schema extensions, security vulnerabilities (e.g., Kerberos, LDAP hardening), and integration with legacy M&A domains.
- Develop and maintain documentation, scripts (PowerShell preferred), and automation for AD health monitoring, backup/recovery, and compliance (e.g., with tools like ADDS, DataDog, or third-party solutions).
- Collaborate with cross-functional teams (security, applications, networking) to assess dependencies, mitigate risks during migrations, and ensure minimal downtime in critical operations.
- Stay ahead of AD best practices, including security enhancements (e.g., Privileged Access Management), and evaluate emerging tools for hybrid environments.
- Contribute to project planning, such as creating roadmaps for domain consolidation and hybrid expansion, while providing regular updates to senior leadership.
Additional Skills & Qualifications
- Bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent experience).
- 7+ years of hands-on experience with on-premises Active Directory, including:
- Deep expertise in AD architecture: Designing, deploying, and managing multi-domain/forest environments, trusts, and schema modifications.
- Proven track record in AD migrations: Using tools like ADMT, Quest Migration Manager, or PowerShell for large-scale user/object migrations, SID history preservation, and domain consolidation.
- Extensive troubleshooting of on-prem AD issues: Replication (DFS-R/SYSVOL), DNS integration, certificate services (AD PKI), and performance optimization in environments with 20+ years of legacy buildup.
- Experience with Group Policy management, including inheritance, filtering, and troubleshooting in complex setups.
- 3+ years of lead or senior engineer experience: Guiding teams on technical projects, mentoring peers, and influencing decisions without direct managerial authority.
- Solid understanding of hybrid AD environments: 2+ years working with Entra ID (Azure AD) for synchronization, single sign-on (SSO), and cloud identity management; familiarity with Azure AD Connect, Pass-through Authentication, and Entra ID governance features.
- Proficiency in scripting and automation: PowerShell for AD administration, querying (e.g., Get-ADUser, Get-ADComputer), and bulk operations.
- Strong knowledge of AD security: Implementing least privilege, auditing, and compliance with standards like NIST or CIS benchmarks.
- Excellent problem-solving skills, with the ability to handle high-pressure situations in large-scale, mission-critical infrastructures.
- Certifications: Microsoft Certified: Identity and Access Administrator Associate, or equivalent (e.g., MCSE: Productivity).
- Experience with related technologies: Windows Server (2016+), Azure infrastructure, Intune for endpoint management, or third-party AD tools (e.g., SolarWinds, ManageEngineer
