Senior Active Directory Engineer – Identity Security (L3)

About the role

We are looking for a Senior Active Directory L3 Support Engineer to lead the modernization and security hardening of our enterprise AD environment. The role combines deep AD administration expertise with a focus on identity protection, Zero Trust architecture, and automation.

Key responsibilities

• Deploy and configure additional Domain Controllers in production and disaster‑recovery sites, replacing legacy Windows Server 2016 controllers.
• Maintain AD health, including replication, DNS integration, authentication services, and Group Policy processing.
• Implement security controls such as Extended Protection for Authentication, SSL/TLS enforcement, SMB signing, LDAP signing, LDAPS, and Kerberos hardening.
• Remediate privileged‑access findings, enforce protected‑users enrollment, and tighten password policies.
• Harden Group Policy configurations, enable PowerShell logging, and apply advanced audit policies.
• Collaborate with Infrastructure, Security, and Application teams on remediation projects, change‑management activities, and domain‑controller migrations.
• Automate routine administrative tasks using PowerShell scripting.

Required profile

• Extensive experience administering Active Directory Domain Services in large, enterprise environments.
• Strong knowledge of AD administration, replication, DNS, Group Policy, authentication protocols, and disaster‑recovery processes.
• Hands‑on experience implementing EPA, LDAP signing, LDAPS, Kerberos hardening, and SMB signing.
• Proven ability to work cross‑functionally on security remediation and infrastructure upgrade projects.
• Excellent documentation skills for audit‑compliant standards and procedures.

Required skills

• Active Directory Domain Services (AD DS)
• Domain Controllers deployment and migration
• Active Directory replication and DNS
• Group Policy (GPO) management
• Extended Protection for Authentication (EPA)
• LDAP signing, LDAPS, Kerberos hardening
• SMB signing
• PowerShell scripting and automation