Senior Active Directory / Identity Engineer

This is a fully remote position, open to applicants in Illinois.

📋 Description

• Act as the senior technical authority for the USMEPCOM Active Directory Domain Services environment.

• Install, configure, maintain, update, troubleshoot, and recover Active Directory services and their associated components.

• Oversee AD objects, organizational units, users, computers, groups, service accounts, shared resources, and directory permissions.

• Keep documentation for domain, organizational unit, site, trust, Group Policy, and related architecture up to date.

• Design, test, implement, maintain, and troubleshoot Group Policy Objects and related configurations.

• Manage trust relationships, Active Directory sites, subnets, site links, replication schedules, and replication topology.

• Ensure the health of domain controllers, directory databases, SYSVOL, DFS Replication, time synchronization, and AD-integrated DNS.

• Plan and carry out installations, replacements, upgrades, demotions, and retirements of domain controllers.

• Oversee AD schema governance and assess requests for schema changes.

• Administer escalated account and group modifications and resolve issues related to authentication, authorization, policy, trust, replication, and directory permissions.

• Provide advanced engineering support during incidents involving identity, authentication, domain, and access management.

• Create, test, and maintain procedures for backing up, restoring, and recovering Active Directory forests.

• Assist with COOP exercises, disaster recovery testing, recovery validation, and continuity events.

• Assess and test approved ICAM and identity modernization technologies, including integrations with Okta or other sanctioned platforms.

• Validate identity synchronization, account linking, authentication flows, mappings, provisioning, access controls, and failure handling.

• Support the testing of SAML, OpenID Connect, OAuth, SCIM, LDAP, or similar technologies.

• Automate directory administration, health validation, reporting, auditing, and configuration tasks as approved.

• Comply with DISA STIGs, RMF controls, assessment evidence, POA&M activities, and authorization documentation.

• Maintain standard operating procedures, recovery plans, configuration baselines, change records, test results, and technical documentation.

• Provide information on directory service health, availability, capacity, risk, modernization, and recovery for program reporting.

⛳️ Requirements

• Active Secret clearance or higher.

• Bachelor’s degree in information technology, information systems, or a related field, or equivalent professional experience as allowed by the applicable labor category.

• At least eight years of relevant experience in Active Directory engineering, identity engineering, Windows infrastructure, systems engineering, or a related technical field.

• Direct, hands-on experience in engineering and administering Microsoft Active Directory Domain Services within an enterprise setting.

• Experience in managing AD objects, organizational units, Group Policy Objects, trusts, replication, schemas, delegated permissions, and directory recovery.

• Proven experience in troubleshooting complex authentication, authorization, Group Policy, replication, trust, and directory service issues.

• Experience with planning or supporting Active Directory backup, restoration, disaster recovery, or forest recovery.

• Familiarity with testing identity integrations or evaluating enterprise identity modernization technologies.

• Understanding the difference between core AD DS administration and external ICAM, federation, or cloud identity services.

• Knowledge of enterprise identity security, least privilege, delegated administration, account management, and access control principles.

• Ability to create and maintain architecture diagrams, domain plans, OU plans, Group Policy documentation, trust diagrams, recovery procedures, and technical standards.

• Willingness to support after-hours maintenance, COOP exercises, disaster recovery testing, and critical incident response when necessary.

• Strong written, verbal, analytical, and technical problem-solving capabilities.

🏝️ Benefits

• Regular full-time employment.

• Option for remote work.

• Preference for candidates located in the Chicago area.

• Occasional after-hours maintenance, incident response, COOP exercises, on-site support, or travel may be required.