AD / Entra Engineer Sr Tier 3

The AD / Entra Engineer Sr Tier 3 designs, implements, and sustains a resilient enterprise identity platform spanning on-premises Active Directory, Active Directory Federation Services (AD FS), and Microsoft Entra ID. The role architects secure hybrid identity services that provide reliable, highly available authentication and authorization for enterprise applications and mission-critical systems.

Serving as the Tier 3 escalation authority, this position resolves complex directory replication, authentication, federation, trust, and synchronization incidents. The engineer partners with identity, security operations, infrastructure, and application teams to harden directory services, strengthen Zero Trust-aligned access controls, and improve operational stability in a regulated federal IT environment.

Key Responsibilities

• Design, implement, and maintain Active Directory infrastructure, including forests, domains, organizational unit structures, domain-controller placement, AD sites, DNS dependencies, replication topology, and trust relationships.
• Architect and support hybrid identity solutions integrating on-premises Active Directory with Microsoft Entra ID, including Entra Connect or cloud synchronization, password hash synchronization, pass-through authentication, federation, and synchronization failover considerations.
• Configure, administer, and troubleshoot enterprise authentication and directory services, including Kerberos, LDAP, NTLM, DNS service records, AD FS, certificate-dependent authentication services, and Active Directory trust relationships.
• Design and maintain secure Group Policy architectures, including GPO inheritance, security filtering, baseline configuration, domain-controller hardening, and resolution of policy-processing failures.
• Provide Tier 3 incident response and root-cause analysis for complex replication failures, lingering objects, authentication issues, broken trusts, directory synchronization errors, federation failures, and privileged-access problems.
• Implement and maintain directory security controls, including least-privilege delegated administration, privileged-access boundaries, tiered administrative models, LDAP signing, legacy-protocol reduction, and audit-ready identity configurations.
• Configure and support Microsoft Entra ID capabilities, including Conditional Access, multifactor authentication, single sign-on, application registrations, service principals, Identity Protection, and Privileged Identity Management.
• Develop and maintain PowerShell automation for directory health checks, account and group lifecycle operations, synchronization diagnostics, configuration validation, reporting, and repeatable remediation activities.
• Produce and maintain technical architectures, operational runbooks, recovery procedures, standards, change documentation, and knowledge articles supporting enterprise identity operations.

Required Qualifications

• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, Engineering, or a related discipline, or equivalent relevant experience.
• At least 7 years of hands-on information technology experience.
• At least 3 years of experience engineering, administering, and supporting Active Directory and enterprise directory services.
• Demonstrated experience designing and supporting Active Directory forests, domains, domain controllers, sites, DNS integration, replication topology, Group Policy, and trust relationships.
• Demonstrated experience supporting hybrid identity services integrating Active Directory, AD FS, and Microsoft Entra ID.
• Advanced PowerShell scripting skills, including automation of administrative activities, health checks, reporting, diagnostics, and remediation processes.
• U.S. citizenship and the ability to obtain and maintain a Public Trust background investigation.

Preferred Qualifications

• Microsoft Certified: Identity and Access Administrator Associate (SC-300).
• Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ-800 and AZ-801).
• Experience implementing Conditional Access, multifactor authentication, single sign-on, Privileged Identity Management, and Identity Protection capabilities in Microsoft Entra ID.
• Experience supporting identity and access management services in a Public Trust or similarly regulated federal environment.