Senior Active Directory / Identity Engineer

This is a fully remote position, open to applicants in Illinois.

📋 Description

• Act as the senior technical lead for the USMEPCOM AD DS environment, overseeing domain, Organizational Unit (OU), site, trust, and Group Policy plans and architectural documentation.

• Install, configure, maintain, troubleshoot, and recover Active Directory Domain Services (AD DS); manage users, computers, groups, service accounts, and directory objects.

• Design and sustain OU structures; handle permissions and delegated administration with a focus on least-privilege principles.

• Create, test, implement, and troubleshoot Group Policy Objects (GPOs), including links, inheritance, precedence, security filtering, WMI filters, backups, and recovery processes.

• Configure, validate, and resolve issues related to domain and forest trusts.

• Oversee the maintenance of AD sites, subnets, site links, replication topology, domain-controller health, SYSVOL, DFSR, time synchronization, AD-integrated DNS, and FSMO roles.

• Plan and execute the installation, upgrade, demotion, and retirement of domain controllers, as well as manage transitions between supported AD versions; coordinate schema extensions.

• Address escalated changes to accounts, groups, and permissions; diagnose issues related to authentication, authorization, policy, trust, and replication.

• Provide advanced support during identity and authentication incidents; assist with root-cause analysis and corrective measures.

• Develop, maintain, and test procedures for AD backup, restoration, deleted-object recovery, and forest recovery; support Continuity of Operations (COOP) and disaster recovery exercises.

• Assist with AD integration testing alongside Okta or other approved identity platforms, covering synchronization, authentication flows, mappings, provisioning, and protocols such as SAML, OIDC, OAuth, SCIM, or LDAP.

• Automate directory administration, health validation, and reporting; review audit information; implement DISA STIGs and security baselines; support RMF controls, POA&M activities, and remediation efforts.

• Maintain Standard Operating Procedures (SOPs), recovery plans, configuration baselines, and directory diagrams; provide information on directory-service health, risk, and modernization for program reporting.

• Collaborate closely with cybersecurity, Service Desk, systems, cloud, network, application, COOP, and Government identity stakeholders.

⛳️ Requirements

• Bachelor’s degree in Information Technology, Information Systems, or a related field, or equivalent professional experience as permitted by the labor category.

• A minimum of eight (8) years of relevant experience in Active Directory engineering, identity engineering, Windows infrastructure, systems engineering, or a related field.

• Direct, hands-on experience in engineering and administering Microsoft AD DS within an enterprise setting, including objects, OUs, GPOs, trusts, replication, schema, delegated permissions, and directory recovery.

• Demonstrated experience troubleshooting complex issues related to authentication, authorization, Group Policy, replication, and trust, as well as planning or supporting AD backup, restoration, and forest recovery.

• Experience in testing identity integrations or supporting identity modernization efforts, with a clear understanding of the differences between core AD DS and external ICAM, federation, or cloud-identity services.

• Strong written, verbal, analytical, and technical problem-solving abilities.

• An active Secret clearance or higher is mandatory.

• Candidates from the Chicago, IL area are preferred.

• Occasional after-hours maintenance, COOP exercises, disaster recovery testing, incident response, on-site support, or travel may be necessary.

🏝️ Benefits

• Reasonable accommodations for individuals with disabilities during the application, interview, job performance, and employment benefits processes.

• Remote work arrangement available.

• Occasional after-hours maintenance, COOP exercises, disaster recovery testing, incident response, on-site support, or travel opportunities/requirements.