Senior Active Directory L3 Engineer (Enterprise Identity & AD Engineering)
Visible Stars, Inc.
Turn this role into an interview — a resume and cover letter built around what this employer wants.
Job summary
Visible Stars, Inc. in Riyadh is seeking a Senior Active Directory L3 Engineer to lead architecture, design, and operation of AD forests, domains, and hybrid integrations. The role focuses on AD services, GPO engineering, identity & access management, federation & SSO, and security hardening within a high-availability enterprise environment.
Strong scripting and ownership are essential. Excellent communication with security, IT Ops, and business stakeholders, and experience with Entra
Qualifications
- 8–12+ years of Active Directory engineering and support experience.
- Deep knowledge of AD DS, DNS, replication and FSMO roles.
- Experience with forest migrations or carve-outs and IAM integrations.
Responsibilities
- Design, build, and manage AD forests, domains, and OU structures.
- Design and implement GPOs and security baselines; manage rollback and backups.
- Integrate on-prem AD with hybrid identity (Entra ID) and implement Conditional Access.
Skills
Tools
Job description
Riyadh
- Job Type: full-time
- Category: SYS
- Post Date: 19/05/2026
Key Responsibilities1. AD Architecture & Engineering� Design, build, and manage Active Directory forests, domains, and OU structures� Define and maintain AD Sites, Subnets, and replication topology� Manage domain controllers lifecycle (build, patching, decommissioning)� Lead AD forest carve-out, consolidation, and migration initiatives� Design high availability and disaster recovery strategies2. Core AD Services� Manage and troubleshoot:o AD DS (Domain Services)o DNS (AD-integrated)o DHCP (where applicable)� Handle replication issues, latency optimization, and site link tuning� Maintain FSMO roles and ensure proper role placement3. Group Policy (GPO) Engineering� Design, implement, and optimize Group Policy strategy� Troubleshoot complex GPO inheritance, filtering, and conflicts� Implement security baselines using GPOs� Manage GPO lifecycle (versioning, backup, rollback)4. Identity & Access Management� Manage user and service account lifecycle (JML processes)� Implement RBAC and least privilege models� Integrate AD with enterprise IAM solutions� Support LDAP, Kerberos, NTLM authentication mechanisms5. Federation & SSO� Design and manage Active Directory Federation Services infrastructure� Configure claims-based authentication and trust relationships� Enable SSO across enterprise and third-party applications� Troubleshoot federation, token, and claims issues6. Hybrid Identity & Cloud Integration� Integrate on-prem AD with Microsoft Entra ID� Manage Entra Connect (Azure AD Connect) synchronization� Implement Conditional Access, MFA, and identity protection� Support hybrid identity architecture and cloud authentication models7. Security & Hardening� Implement AD security best practices:o Tiered administration modelo Privileged Access Management (PAM)o AD hardening and attack surface reduction� Monitor and respond to identity-based threats� Support compliance with banking and regulatory standards� Perform periodic AD health checks and security assessments8. Automation & Scripting� Develop automation using PowerShell for AD operations� Automate provisioning, reporting, and monitoring tasks� Maintain scripts for audit, compliance, and operational efficiency9. Monitoring, Audits & Compliance� Monitor AD, ADFS, and Entra ID health and performance� Support internal/external audits and compliance reporting� Maintain detailed documentation (architecture, SOPs, runbooks)10. L3 Support & Incident Management� Act as escalation point for complex AD issues� Perform root cause analysis (RCA) for critical incidents� Ensure SLA adherence in a high-availability banking environment______________Required Skills & Experience� 8�12+ years of experience in Active Directory engineering and support� Strong expertise in AD architecture (multi-domain/forest environments)� Hands-on experience with forest migrations and carve-outs (must-have)� Deep knowledge of:o AD DS, DNS, replication, FSMO roleso GPO design and troubleshootingo Authentication protocols (Kerberos, NTLM, SAML, OAuth, OIDC)� Strong experience with:o Active Directory Federation Serviceso Microsoft Entra ID (Hybrid Identity)� Advanced PowerShell scripting skills� Experience in Windows Server environments (2016/2019/2022)______________Preferred Qualifications� Experience in banking or highly regulated industries� Exposure to Zero Trust and identity security frameworks� Experience with:o Privileged Identity Management (PIM)o Identity Governance tools� Relevant certifications:o Microsoft Certified: Identity and Access Administratoro Microsoft Azure / Entra certifications______________Key Competencies� Strong engineering mindset (not just operations)� Ability to work independently and drive ownership� Strong troubleshooting and RCA skills� Effective communication with technical and business stakeholders
Job qualifications:
Key Responsibilities1. AD Architecture & Engineering� Design, build, and manage Active Directory forests, domains, and OU structures� Define and maintain AD Sites, Subnets, and replication topology� Manage domain controllers lifecycle (build, patching, decommissioning)� Lead AD forest carve-out, consolidation, and migration initiatives� Design high availability and disaster recovery strategies2. Core AD Services� Manage and troubleshoot:o AD DS (Domain Services)o DNS (AD-integrated)o DHCP (where applicable)� Handle replication issues, latency optimization, and site link tuning� Maintain FSMO roles and ensure proper role placement3. Group Policy (GPO) Engineering� Design, implement, and optimize Group Policy strategy� Troubleshoot complex GPO inheritance, filtering, and conflicts� Implement security baselines using GPOs� Manage GPO lifecycle (versioning, backup, rollback)4. Identity & Access Management� Manage user and service account lifecycle (JML processes)� Implement RBAC and least privilege models� Integrate AD with enterprise IAM solutions� Support LDAP, Kerberos, NTLM authentication mechanisms5. Federation & SSO� Design and manage Active Directory Federation Services infrastructure� Configure claims-based authentication and trust relationships� Enable SSO across enterprise and third-party applications� Troubleshoot federation, token, and claims issues6. Hybrid Identity & Cloud Integration� Integrate on-prem AD with Microsoft Entra ID� Manage Entra Connect (Azure AD Connect) synchronization� Implement Conditional Access, MFA, and identity protection� Support hybrid identity architecture and cloud authentication models7. Security & Hardening� Implement AD security best practices:o Tiered administration modelo Privileged Access Management (PIM)o AD hardening and attack surface reduction� Monitor and respond to identity-based threats� Support compliance with banking and regulatory standards� Perform periodic AD health checks and security assessments8. Automation & Scripting� Develop automation using PowerShell for AD operations� Automate provisioning, reporting, and monitoring tasks� Maintain scripts for audit, compliance, and operational efficiency9. Monitoring, Audits & Compliance� Monitor AD, ADFS, and Entra ID health and performance� Support internal/external audits and compliance reporting� Maintain detailed documentation (architecture, SOPs, runbooks)10. L3 Support & Incident Management� Act as escalation point for complex AD issues� Perform root cause analysis (RCA) for critical incidents� Ensure SLA adherence in a high-availability banking environment______________Required Skills & Experience� 8�12+ years of experience in Active Directory engineering and support� Strong expertise in AD architecture (multi-domain/forest environments)� Hands-on experience with forest migrations and carve-outs (must-have)� Deep knowledge of:o AD DS, DNS, replication, FSMO roleso GPO design and troubleshootingo Authentication protocols (Kerberos, NTLM, SAML, OAuth, OIDC)� Strong experience with:o Active Directory Federation Serviceso Microsoft Entra ID (Hybrid Identity)� Advanced PowerShell scripting skills� Experience in Windows Server environments (2016/2019/2022)______________Preferred Qualifications� Experience in banking or highly regulated industries� Exposure to Zero Trust and identity security frameworks� Experience with:o Privileged Identity Management (PIM)o Identity Governance tools� Relevant certifications:o Microsoft Certified: Identity and Access Administratoro Microsoft Azure / Entra certifications______________Key Competencies� Strong engineering mindset (not just operations)� Ability to work independently and drive ownership� Strong troubleshooting and RCA skills� Effective communication with technical and business stakeholders
Job qualifications:
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
