Senior Active Directory Engineer

Role: Senior Active Directory Engineer -Infrastructure Engineering and Design

Fulltime

Location: Louisville KY

Position Summary

We are seeking an experienced and motivated Senior Active Directory Engineer to join the Infrastructure Engineering and Design team. This role requires strong expertise in identity and access services, Microsoft Active Directory Domain Services (AD DS), Microsoft Entra ID, federation, directory synchronization, Group Policy, authentication, and related Windows Server technologies. The engineer will translate business, security, and technical requirements into reliable, supportable, and deployable solutions across on-premises and cloud-connected identity environments.

The successful candidate will partner with Infrastructure, Security, Server Engineering, subsidiary technology teams, and other stakeholders. The role may provide technical leadership for focused project efforts and must effectively manage multiple concurrent priorities in a highly matrixed organization.

Primary Responsibilities

Directory Services Engineering and Operations

• Provide enterprise operational and engineering support for Microsoft Active Directory and Microsoft Entra ID environments.
• Design, implement, maintain, and document Active Directory forests, domains, organizational units, sites, subnets, domain controllers, and replication topology.
• Monitor and assess the health, availability, capacity, performance, and configuration of directory servers and supporting services.
• Troubleshoot complex replication, domain controller location, name resolution, federation, authentication, authorization, and directory synchronization issues.
• Monitor and troubleshoot Kerberos authentication, including service principal name, delegation, ticketing, and time-synchronization dependencies.
• Manage non-production and test environments used to validate directory service changes, integrations, and recovery procedures.
• Create and maintain engineering standards, templates, processes, procedures, support documentation, and operational runbooks for Active Directory services.
• Provide technical leadership, knowledge transfer, and mentoring to engineers and operational support teams.

Group Policy, Privileged Access, and Security

• Partner with Server Engineering teams to validate and verify Group Policy settings and their intended outcomes.
• Administer Group Policy lifecycle controls in Advanced Group Policy Management (AGPM), including policy check-in, approval, deployment, and production locking.
• Support group managed service accounts (gMSAs), managed service accounts (MSAs), service identities, and related Active Directory configurations.
• Collaborate extensively with Security Engineering teams to identify and remediate privilege-escalation paths, chainable vulnerabilities, and other directory security risks.
• Apply least-privilege, separation-of-duties, privileged-access, and Tier 0 security principles to the administration of directory services.
• Support access reviews, audit evidence, compliance controls, and security remediation activities associated with identity infrastructure.

Resiliency, Recovery, and Continuous Improvement

• Design, maintain, and execute Active Directory backup, recovery, and disaster recovery procedures.
• Validate directory service resiliency through documented recovery testing and remediation of identified gaps.
• Use monitoring, metrics, event data, and diagnostic tools to identify service degradation and drive preventive improvements.
• Capture and analyze server memory dumps when required to troubleshoot complex Windows Server or directory service issues.
• Automate repeatable administration, validation, reporting, and operational tasks through scripting and available management interfaces.
• Perform other Windows Server, Active Directory, Microsoft Entra ID, AD FS, and identity infrastructure responsibilities as needed.

Microsoft Entra ID, Synchronization, and Federation

• Manage and deliver Microsoft Entra Connect services, including synchronization health, configuration, troubleshooting, and lifecycle maintenance.
• Administer Active Directory Federation Services (AD FS) and Web Application Proxy (WAP) infrastructure.
• Manage AD FS and WAP certificates, including expiration monitoring, renewal coordination, deployment, and validation.
• Partner with application and security teams to implement and maintain relying party trusts, claims, and related federation integrations.
• Work with subsidiary Active Directory teams to consolidate, standardize, and integrate directory environments.

Required Experience and Qualifications

• Degree in Computer Science, Information Technology, or a related field, or equivalent professional experience.
• Experience managing enterprise identity and access management operations.
• Strong knowledge of Microsoft Entra ID tenant environments and traditional on-premises Active Directory configurations.
• Hands-on experience supporting Active Directory Domain Services, Microsoft Entra Connect, AD FS, WAP, Kerberos, Group Policy, and enterprise authentication services.
• Experience troubleshooting complex directory, synchronization, federation, replication, and authentication problems with minimal guidance.
• Knowledge of scripting and data analysis using PowerShell, SQL, Microsoft Access, Microsoft Excel, and data-mapping techniques.
• Experience designing and executing Active Directory backup and recovery processes.
• Experience capturing server memory dumps for advanced troubleshooting.
• Excellent analytical skills, attention to detail, and ability to translate technical findings into clear actions.
• Excellent written, verbal, and presentation skills, including proficiency with Microsoft PowerPoint and Excel.
• Ability to prioritize work independently and provide clear, documented status updates and metrics to management.
• Ability to learn and adapt quickly to new concepts, capabilities, tools, and changing business requirements.
• Ability to pass a federal clearance or background check to support dedicated United States Government environments.

Preferred Qualifications

• Experience with HIPAA compliance, FedRAMP access controls, and e-QIP certification processes.
• Experience with Semperis Active Directory Forest Recovery (ADFR) and Directory Services Protector (DSP).

Education and Experience

Typically requires a university degree or equivalent experience and a minimum of seven years of relevant experience, or an advanced degree and a minimum of five years of relevant experience.