Senior Active Directory Architect

Job Description:

We are seeking a Senior Active Directory Architect to own the design, security and evolution of our identity platform across on-premises Active Directory and Microsoft Entra ID. This person will lead hybrid identity strategy, drive Identity and Access Management (IAM) initiatives, and serve as the senior technical authority for identity across the enterprise.

Key Responsibilities

• Architect, maintain and optimize enterprise Active Directory forests, domains, trusts, sites and replication
• Design and lead hybrid identity integration between on-premises AD and Microsoft Entra ID (Entra Connect / Cloud Sync)
• Define IAM strategy covering authentication, authorization, provisioning and access lifecycle (joiner, mover, leaver)
• Implement and govern Single Sign-On (SSO), Multi-Factor Authentication (MFA) and Conditional Access policies
• Lead Privileged Access Management (PAM), tiered admin models and Entra Privileged Identity Management (PIM)
• Harden AD security against threats such as Kerberoasting, pass-the-hash and privilege escalation
• Manage Group Policy architecture, delegation models and role-based access control (RBAC)
• Lead AD migrations, consolidations and domain restructuring projects
• Partner with Security, Compliance and Infrastructure teams on Zero Trust and audit requirements (SOX, HIPAA, NIST)
• Mentor engineers, create architecture standards and document designs and runbooks

Required Qualifications

• 10+ years in Active Directory engineering, with 3+ years in an architect or lead role
• Deep expertise in AD DS, DNS, DHCP, Group Policy, AD Certificate Services and trust relationships
• Hands-on experience with Microsoft Entra ID, including Entra Connect, Conditional Access, PIM and app registrations
• Strong IAM background: SSO, MFA, SAML, OAuth 2.0, OpenID Connect, Kerberos and LDAP
• Experience with identity governance or PAM platforms such as SailPoint, Okta, CyberArk or BeyondTrust
• Scripting and automation with PowerShell (Microsoft Graph PowerShell preferred)
• Proven record leading large-scale AD migrations or hybrid identity deployments
• Strong communication skills with the ability to present designs to executives and technical teams

Preferred Qualifications

• Microsoft certifications: SC-300 (Identity and Access Administrator), AZ-104 or AZ-305
• Security certifications such as CISSP or CISM
• Experience with Entra ID Governance (access reviews, entitlement management, lifecycle workflows)
• Familiarity with Microsoft Defender for Identity and Microsoft Sentinel
• Experience in regulated industries such as finance, healthcare or government
• Bachelor's degree in Computer Science, Information Systems or equivalent experience