Alternate Locations: Greensboro, NC (North Carolina); Charlotte, NC (North Carolina); Fort Wayne, IN (Indiana); Radnor, PA (Pennsylvania)
Work Arrangement:Hybrid : Employee will work 3 days a week in a Lincoln office
Relocation assistance: is not available for this opportunity.
Requisition #: 76870
The Role at a GlanceThe position is for a Lead Identity Infrastructure Engineer with experience designing, managing, securing, monitoring and supporting enterprise identity infrastructure, with primary emphasis on Active Directory, Public Key Infrastructure (PKI), Entra ID Application Registrations and related Domain Services technologies.
Responsibilities of this role include Active Directory architecture and lifecycle management; forest, domain and trust management; Certificate Services and Keyfactor integrations; operational monitoring and alerting; resilience, recovery and security hardening; and expert recommendations and guidance for Microsoft Entra ID application registrations and authentication strategies.
This role partners with Security, Enterprise Architecture, infrastructure teams and application owners to deliver compliant authentication and directory solutions. The role also supports, automation, high severity incident resolution, modern authentication patterns such as SAML and OAuth, and secure support for legacy authentication where required.
What you'll be doing- Serve as a technical expert for the architecture, engineering, administration and operational health of enterprise Active Directory and Domain Services.
- Provide subject matter expertise and strategy recommendations for projects involving Active Directory and Microsoft Entra ID application registrations, covering both legacy and modern authentication methods.
- Demonstrate deep technical expertise in Public Key Infrastructure, including Keyfactor PKIaaS, certificate templates, enrollment services, certificate lifecycle processes and Keyfactor integrations.
- Bring an AI agentic mindset to automation, continuous improvement and modernization opportunities that enhance the Domain Services service portfolio.
- Design, manage and secure Active Directory forests, domains, trusts, sites and services, replication, DNS dependencies and domain controller lifecycle activities.
- Build and improve monitoring, alerting, health checks and operational dashboards for Active Directory, authentication services and PKI using tools such as Splunk and enterprise monitoring platforms.
- Contribute to Active Directory security hardening, identity threat detection and response, privileged access controls, disaster recovery planning and recovery exercises.
- Lead troubleshooting and incident resolution for complex, high severity Active Directory, EntraID authentication and PKI incidents, including root cause analysis and corrective actions.
- Working knowledge of PowerShell Desired State Configuration (DSC) and GitLab for infrastructure configuration, source control, and automation.
- Work closely with Security and Enterprise Architecture to design enterprise compliant, resilient and supportable identity solutions.
- Develop and implement PowerShell based automation to improve security, consistency, monitoring and operational efficiency.
- Partner and guide cross functional teams, application owners and Managed Service Providers to integrate and support authentication and directory services.
- Provide advanced support for Microsoft Entra application registrations, enterprise applications, OAuth, OpenID Connect and SAML integrations as needed.
- Create and maintain architecture, operational and recovery documentation and share knowledge with the team.
- Build\Present engineered solutions to Architecture and Peer Review Boards.
What we're looking for- 5+ years of experience managing and supporting enterprise identity services, with deep hands-on experience in Active Directory, PKI, and Entra ID Application Registrations.
- Advanced knowledge of Active Directory architecture, including forests, domains, trusts, organizational units, replication, sites and services, DNS dependencies and Group Policy.
- Advanced experience with enterprise PKI, including Certificate Services, certificate templates, enrollment workflows, certificate lifecycle management and Keyfactor or comparable platforms.
- Deep experience and understanding of Microsoft Entra ID Application Registrations, Enterprise Applications, EntraID Connect and Microsoft Graph APIs.
- Strong troubleshooting skills across Active Directory, LDAP, Kerberos, NTLM, DNS, Windows Server, certificates and authentication related issues.
- Expert knowledge of legacy and modern directory and authentication protocols, including LDAP, Kerberos, NTLM, SAML, OAuth and OpenID Connect.
- Proficiency in scripting and automation using PowerShell and Microsoft Graph.
- Proven experience with Active Directory security hardening, role based access control, privileged access, forest and domain trust management and secure administration practices.
- In depth experience with Active Directory disaster recovery, recovery testing and operational resilience planning.
- Experience designing and operating monitoring, alerting and health validation for directory, authentication and PKI services; Splunk search and dashboard experience is preferred.
- Ability to collaborate with Agile teams and use Jira and Confluence to track engineering work and maintain technical documentation.
- 4 Year/bachelor's degree or equivalent work experience (4 years of experience in lieu of Bachelor's)
Application DeadlineApplications for this position will be accepted through 2/10/2027, subject to earlier closure due to applicant volume
What's in it for you:- Clearly defined career tracks and job levels, along with associated behaviors for each of Lincoln's core values and leadership attributes
- Leadership development and virtual training opportunities
- PTO/parental leave
- Competitive 401K and employee benefits
- Free financial counseling, health coaching and employee assistance program
- Tuition assistance program
- Work arrangements that work for you
- Effective productivity/technology tools and training
The pay range for this position is $106,875 - $171,000 with
anticipated pay for new hires between the minimum and midpoint of the range and could vary above and below the listed range as permitted by applicable law. Pay is based on non-discriminatory factors including but not limited to work experience, education, location, licensure requirements, proficiency and qualifications required for the role. The base pay is just one component of Lincoln's total rewards package for employees. In addition, the role may be eligible for the Annual Incentive Program, which is discretionary and based on the performance of the company, business unit and individual. Other rewards may include long-term incentives, sales incentives and Lincoln's standard benefits package.
