Senior Identity Security Architect, Active Directory

This is a fully remote position, open to applicants in Minnesota.

📋 Description

• Evaluate and enhance enterprise Active Directory environments, encompassing forests, trusts, Kerberos, Group Policy, permissions, and delegation.

• Secure Active Directory Certificate Services (ADCS) and address certificate-based attack vectors.

• Design and implement Tier 0 protection strategies, which include administrative tiering, privileged access workstations, and the principle of least privilege.

• Identify and mitigate attack pathways, exposure to credential theft, and risks associated with lateral movement.

• Safeguard hybrid identity between Active Directory and Microsoft Entra ID by employing robust authentication methods and Conditional Access.

• Execute Just-in-Time and Just-Enough Access strategies to minimize standing privileges.

• Develop and conduct tests for Active Directory forest recovery and ransomware resilience plans.

• Protect service accounts and other non-human identities.

• Engage in hands-on architecture and remediation tasks for large enterprises.

• Clearly communicate technical risks to client stakeholders.

⛳️ Requirements

• Extensive practical experience in securing Active Directory within large enterprise settings.

• Profound understanding of ADCS, Kerberos, Tier 0 architecture, and privileged access management.

• Familiarity with tools such as BloodHound, PingCastle, Purple Knight, Semperis, or Microsoft Defender for Identity.

• Strong background in Microsoft Entra ID and hybrid identity solutions.

• Capability to articulate technical risks effectively to client stakeholders.

• Knowledge in identity governance (SailPoint, Saviynt, or Entra ID Governance), including access reviews and automation for joiners, movers, and leavers.

• Experience with privileged access management tools like CyberArk or BeyondTrust.

• Background in integrating identity telemetry with XDR or threat hunting practices.

• Experience in certificate and cryptographic modernization or planning for quantum readiness.

• Relevant certifications such as SC-100, SC-300, CRTP, CRTE, OSCP, or CISSP.

• Contract position, available as W2 or 1099.

• Fully remote opportunity, based in the US.

• Long-term engagement expected.

🏝️ Benefits

• Occasional travel for client meetings may be necessary, typically limited to a few times per year.