Security Engineer

Onetowin; Oost-Vlaanderen; Hybride; EUR 70 000 - 110 000; Plein temps

Résumé du poste

Onetowin seeks a Security Engineer with deep AD hardening and PAM expertise to strengthen identity governance. You will assess vulnerabilities, implement secure authentication, and design a structured PAM framework to ensure least privilege and auditable access.

Join a collaborative Security Team and drive governance across AD, PAM, and related tooling. Presence required 3 days on site and 2 days remote as part of the engagement.

Qualifications

• Experience in Active Directory security and hardening.
• Proven experience implementing Privileged Access Management (PAM).
• Strong scripting with PowerShell and familiarity with IAM integration.

Responsabilités

• Lead or participate in the design and governance of AD hardening and PAM.
• Deliver remediation plans, roadmaps, and auditable actions with documentation.
• Collaborate with AD administrators, IAM specialists, and infrastructure engineers.

Connaissances

Active Directory security

PAM

RBAC

PowerShell

PAWs

IAM integration

Service account security

Outils

PingCastle

ADManager

Splunk

Description du poste

Security Engineer

Our client is seeking an Active Directory (AD) and Privileged Access Management (PAM) expert to reinforce the security and governance of its identity infrastructure. The mission focuses on two complementary areas: 1) Improving the security posture of Active Directory by addressing identified vulnerabilities and increasing the PingCastle security score, and 2) Designing and implementing a Privileged Access Management (PAM) framework to ensure least privilege, controlled elevation, and auditable privileged access. The expert will join the Security Team.

Quantitative Data

• The mission covers all Active Directory forests and domains, as well as all processes and tools related to privileged access and identity governance.
• Improve the PingCastle security score.
• Support in selecting and Implementing new PAM Solution

Main purposes

1. Active Directory Hardening

• Assess and enhance the current security posture of Active Directory.
• Identify and remediate key technical weaknesses detected by PingCastle.
• Eliminate legacy components and protocols (e.g., Windows Server 2003/2008, DES-enabled accounts, NTLMv1, LM).
• Implement secure authentication and password policies.
• Review and clean up GPOs, apply least privilege principles, and align configurations with Microsoft security baselines.

2. Privileged Access Management (PAM)

• Implement a structured PAM framework.
• Enforce the Principle of Least Privilege (PoLP) and Role-Based Privilege Assignment. Implement Access Isolation.
• Establish Periodic Access Reviews (e.g., quarterly).
• Define and implement an Authorization Process (standardized, auditable approval workflow).
• Implement Just-in-Time (JIT) Access for temporary privilege elevation.
• Enforce the Four-Eyes Principle for critical privileged actions.

3. Documentation, Reporting, and Governance

• Develop a detailed remediation and implementation roadmap (AD + PAM).
• Document all technical actions (initial state, final configuration, scripts/tools used).
• Deliver regular progress reports (weekly or bi-weekly).
• Produce a final report summarizing actions, residual risks, and recommendations.

Collaboration:

The expert will operate as part of the Security Team, collaborating closely with AD administrators, IAM specialists, and infrastructure engineers. (Presence required 3 days on site and 2 days remote).

Key Performance indicators

• Achievement and improvement of the target PingCastle security score for Active Directory.
• Successful and complete implementation and governance of the PAM framework components (e.g., PoLP, JIT, Four-Eyes Principle).
• On-time delivery of AD/PAM remediation documentation and reports.
• Contribution to the analysis and implementation of the Microsoft Tiering Model.

Skills required

Technical Skills:

• Proven experience in Active Directory architecture, security, and hardening.
• Strong expertise in Privileged Access Management (PAM) and Microsoft Tiering Model.
• Proficiency with PowerShell, PingCastle, ADManager, and Splunk.
• Familiarity with Privileged Access Workstations (PAWs), RBAC, and IAM integration.
• Solid understanding of service account security and least privilege enforcement.

Soft Skills:

• Strong collaboration skills within multidisciplinary teams.
• High documentation standards and structured working approach.
• Analytical mindset, attention to detail, and communication clarity.
• Ability to lead or participate in workshops (RBAC, PAM, governance design).