Job Title- Senior Windows Systems Administrator – Active Directory / PowerShell

Position Overview

This role is focused on hands-on enterprise Windows administration with an emphasis on Active Directory, Group Policy, PowerShell automation, Windows Server lifecycle management, and CIS hardening. You’ll work through an established operational backlog, implement AD/GPO changes and security baselines, automate repetitive administrative tasks, and maintain the scripts and documentation needed to make these processes repeatable and supportable.

The role works closely with the Senior Server Administrator and Server Operations Team Manager, with a strong focus on implementation, automation, documentation, and measurable backlog reduction.

What You'll Do

• Execute the Active Directory, Group Policy, and permissions work backlog, including GPO creation, modification, testing, retirement, delegation, and access changes.
• Implement CIS baselines through GPO and scripted remediation, working from the Senior Server Administrator's analysis and direction.
• Design, write, and maintain PowerShell for administration, automation, auditing, remediation, and reporting across endpoints and Active Directory.
• Identify repetitive operational tasks and automate them, replacing manual procedures with tested and documented scripts.
• Manage the Windows Server lifecycle at enterprise scale, including build, configuration, patching, upgrading, troubleshooting, and decommissioning.
• Receive and complete work assigned and prioritized by the Server Operations Team Manager, including work routed through the Senior Server Administrator or Server Administrator under the Manager's oversight.
• Log, update, and track work items in Azure DevOps.
• Work service requests and change controls through the Service Management tool while following the team's change process.
• Store work products and documentation in Azure DevOps as work is performed, including scripts, code, GPO documentation, runbooks, and SOPs.
• Cross-skill with the Senior Server Administrator so AD/GPO and CIS knowledge is shared across the team.
• Take on additional on-premises duties as team responsibilities are realigned, as directed by the Manager.

Required Qualifications

• 10+ years of experience with Active Directory, including domain services, replication, delegation, permissions, and domain controller troubleshooting.
• 8+ years of experience with Group Policy, including design, scoping, filtering, troubleshooting, and change control in a large environment.
• 8+ years of experience with PowerShell, including modules, error handling, remote execution, scheduled and unattended scripts, and AD/GPO automation.
• 5+ years of experience implementing CIS benchmarks or equivalent hardening baselines on Windows endpoints through GPO and scripting.
• 8+ years of experience with Windows Server administration and lifecycle management across a large server estate, including build, patching, upgrading, and decommissioning.
• Experience documenting work as it is performed, including maintaining current SOPs, runbooks, and change records without relying on after-the-fact documentation.
• Experience working from a tracked work queue, such as Azure DevOps boards, and within formal service request and change-control processes.

Preferred Qualifications

• Experience with task automation and orchestration beyond PowerShell, such as scheduled workflows and automation platforms.
• Endpoint patch management experience, including third-party application and Windows OS patching.
• Third-party application packaging and deployment automation, including application bundles such as PDQ.
• PKI and Active Directory Certificate Services operations.

Success in This Role

Success is assessed against metrics established with the Manager and tracked in Azure DevOps. Key outcomes include:

• Reduction and tracking of the AD/GPO backlog in Azure DevOps.
• Implementation of CIS items according to the Senior Server Administrator's direction, with before-and-after states recorded.
• Core administrative and remediation tasks covered by tested and documented PowerShell, including a baseline script library in Azure DevOps.
• All work products, including scripts, code, and documentation, stored in Azure DevOps as property of the branch, with no work held locally or in personal storage.
• Tested coverage of AD/GPO and PowerShell-based processes so that more than one person can run and support them.
• SOPs for recurring AD/GPO and hardening tasks written and reviewed by the Senior Server Administrator.