Active Directory Architect

12+ months contract W2 role
100% remote opportunity

Active Directory Architect

Seeking an experienced and motivated individual to join the Infrastructure Engineering and Design team as an Active Directory Architect. This position will require a strong understanding of technologies, processes, architecture, and data management in Identity & Access services. This position will be responsible for defining business requirements, data analysis, data validation, architectural designs, and technical specifications covering both on-premise Active Directory and Azure Active Directory. This resource will build strong partnerships within our business between Infrastructure and Security organizations to drive requirements and translate functional or technical specifications into secure, scalable, and deployable architecture solutions. At times, this resource will technically lead architecture initiatives and project efforts in their specific technology area. The ability to work in a highly matrixed organization delivering customer outcomes will be critical, as this resource will often simultaneously work across more than one project delivery effort at a time.

Key Client Focus – Active Directory Architect

• Strong Active Directory architecture & engineering experience in large enterprise environments, including AD, Azure AD/Entra ID, Group Policy, AD replication, authentication and domain services.

• Hands-on ADFS & Identity/IAM architecture: ADFS, Federation, WAP, certificates, Kerberos, claims, relying-party trusts, AAD/Entra Connect, and service accounts (GMSA/MSA).

• Large-scale AD infrastructure & security architecture: AD consolidation, fileserver/Windows Server integration, privilege-path remediation, vulnerability mitigation, backup/recovery and environment health.

• Strong troubleshooting & architectural engineering mindset: PowerShell/scripting, data analysis/mapping, complex AD issues, and ability to independently lead AD/IAM architecture initiatives and projects.

Primary Responsibilities:

• Design architecture templates and validate processes and procedures in AD

• Ability to pass federal clearance/background check to support dedicated US Government environments

• Provide architectural guidance and engineering support for end users across the enterprise for both AAD and AD environments

• Lead the design and troubleshooting of Replication / DC Location / Federation / Authentication solutions

• Design and troubleshoot AAD Connect services and synchronization architecture

• Assess general health of the servers and services and recommend architectural improvements

• Ensure Kerberos authentication architecture is working properly

• Define ADFS certificate management standards and monitor expiration and updates

• Define and oversee WAP server certificate configurations for ADFS servers

• Architect and support GMSA / MSA / Service IDs used within AD

• Define and oversee test environments for Active Directory architecture changes

• Work with other teams on the design and integration of new/updated relying-party trusts

• Work with other teams on the design and integration of new/updated claims

• Lead Active Directory architecture initiatives to consolidate environments

• Work with Server Engineering teams to define, validate, and verify Group Policy settings

• Design and implement policy management controls using AGPM

• Work extensively with Security Engineering teams to remediate privilege elevation paths and chainable vulnerabilities

• Design, manage, and deliver Entra ID Connect services

• Work with subsidiary AD teams to consolidate and standardize environments

• Lead other Windows Server, Active Directory, and ADFS-related architecture initiatives as needed

Experience/Qualifications:

• Degree in Computer Science / IT or equivalent experience

• Experience in designing and managing IAM architecture and operations

• Knowledge in scripting (PowerShell, SQL, Access, Excel) and data mapping

• Solid understanding of AAD tenant environments and traditional Active Directory configurations

• Good understanding of IAM principles and enterprise identity architecture.

• Excellent communication skills, verbal and written, and presentation skills required.

• Experience with PowerPoint and other Microsoft products such as Excel required.

• Ability to prioritize work without management direction and provide clear and documented status updates/metrics to management.

• Must have the ability to quickly learn and adapt to new concepts, capabilities, or tools based on the needs.

• Ability to troubleshoot complex problems with minimal guidance and provide architectural recommendations.

• Excellent analytical skills and attention to detail.

• Experience with capturing server memory dumps

• Experience designing and executing Active Directory backup and recovery strategies

• Experience with HIPAA compliance, FedRAMP access controls, and EQIP certification is a plus

• Preference for experience with Semperis ADFR and DSP

Education:

Typically requires a University Degree or equivalent experience and a minimum 7 years of experience, or an Advanced Degree and a minimum 5 years of experience.