Active Directory Architect / Engineer

Leidos is seeking a highly skilled Active Directory Architect / Engineer to review and re‑architect ATR’s Microsoft Active Directory and hybrid identity environments. The candidate will be responsible for overseeing the implementation, optimization, and ongoing management of the updated architecture and will play a key role in maintaining the integrity, availability, and security of the identity and access management systems that support the entire ATR organization. This position focuses on both the on‑premises Active Directory Domain Services (AD DS) and integration with Microsoft Entra ID (formerly Azure AD). This work is located onsite in the DC area. Key Responsibilities Design, deploy, upgrade, and administer Active Directory Domain Services, including domain controllers, forests, domains, trusts, and replication topologies. Manage and optimize Group Policy Objects (GPOs), OU structures, and security baselines. Perform bulk operations and automation for object management. Troubleshoot and resolve complex AD‑related issues such as authentication failures, replication problems, DNS issues, and Kerberos/NTLM problems. Plan and execute Active Directory migrations, consolidations, and upgrades of both underlying server infrastructure and overall forest/domain functional levels. Develop and maintain disaster recovery, backup, and restore procedures for AD environments, including AD Recycle Bin and authoritative restores. Monitor AD health and performance using tools such as Microsoft System Center, Azure Monitor, or third‑party solutions. Implement and maintain Advanced Microsoft Entra ID (Azure AD), Okta, hybrid identity models, Privileged Access Management (PAM), and Public Key Infrastructure services in compliance with federal standards such as NIST and DISA STIG. Engineer and implement security best practices, including PAM, Just‑In‑Time (JIT) access, tiered administration, least privilege principles, Zero Trust network access (ZTNA), secure enclave integration, and defense‑in‑depth methodologies. Ensure compliance with security standards, regulatory requirements (SOC 2, ISO 27001, HIPAA, CMMC, etc.), and internal policies. Collaborate with Security, Endpoint, Cloud, and Application teams on identity‑related projects and incident response. Automate repetitive tasks using PowerShell, Microsoft Graph, Python, and Infrastructure as Code tools such as Ansible. Required Qualifications Bachelor’s degree in Computer Science, Information Technology, Engineering, or a related field and 12+ years of relevant experience OR a master’s degree with 10+ years of relevant experience. Additional years of experience will be considered in lieu of a degree. 12+ years of hands‑on experience as an Active Directory Architect, Engineer, or Senior Administrator in complex enterprise environments. Deep expertise in designing, deploying, upgrading, and administering Microsoft Active Directory Domain Services (AD DS), including domain controllers and multi‑domain/forest architectures, trusts, replication topologies, GPOs, OU design, and security baselines. Strong experience with hybrid identity solutions and synchronization between on‑premises AD DS and Microsoft Entra ID. Proven track record in troubleshooting and resolving complex AD issues such as authentication failures, replication, DNS, Kerberos/NTLM, etc. Experience with AD migrations, consolidations, forest/domain functional level upgrades, and infrastructure modernization. Solid understanding of disaster recovery, backup/restore procedures for AD, including AD Recycle Bin and authoritative restores. Experience implementing and managing Privileged Access Management (PAM), Just‑In‑Time (JIT) access, tiered administration models, and least privilege principles. Working knowledge of Public Key Infrastructure (PKI), Zero Trust Network Access (ZTNA), secure enclaves, and defense‑in‑depth security strategies. Familiarity with compliance frameworks and federal standards such as NIST, DISA STIGs, SOC 2, ISO 27001, HIPAA, and CMMC. Proficiency in automation and scripting using PowerShell, Microsoft Graph, Python, and Infrastructure as Code tools (e.g., Ansible). Experience collaborating with Security, Cloud, Endpoint, and Application teams on identity‑related initiatives and incident response. Strong communication skills and the ability to work independently as a contractor in a dynamic environment. U.S. Citizenship required. Ability to obtain and maintain a Public Trust security clearance. Preferred Qualifications Experience with Okta for identity management and federation. Background supporting federal or regulated industries with strict compliance requirements. Experience using monitoring tools such as Microsoft System Center, Azure Monitor, or third‑party AD health solutions. Knowledge of modern identity security practices and integration with cloud platforms. Desired Certifications Microsoft Certified: Identity and Access Administrator Associate (SC‑300). Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ‑800 + AZ‑801). Microsoft Certified: Azure Administrator Associate (AZ‑104). Microsoft Certified: Azure Security Engineer Associate (AZ‑500).li> CISSP (Certified Information Systems Security Professional). CISM (Certified Information Security Manager). Okta Certified Professional or Okta Certified Administrator. Pay Range $131,300.00 – $237,350.00 (range provided for this job level). Additional factors considered in extending an offer include responsibilities of the job, education, experience, knowledge, skills, and abilities, internal equity, market data, applicable bargaining agreements, and law. Commitment to Non‑Discrimination All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws. #J-18808-Ljbffr Leidos