Active Directory Engineer - Tier 3

eClinicalWorks, LLC; Westborough (MA); On-site; USD 100,000 - 130,000; Full time

Job summary

eClinicalWorks, LLC in Westborough, MA, is seeking an experienced Active Directory / Microsoft Entra ID Engineer to support and optimize our global identity infrastructure. You will manage access, security, and hybrid identity for corporate and production healthcare platforms.

The role focuses on AD design, GPOs, Entra ID, MFA, and automation, with on-call incident response and documentation duties.

Qualifications

• 5+ years of enterprise Active Directory administration experience.
• Strong design, troubleshooting, and governance of Group Policy.
• Experience managing large global Active Directory environments.
• Expert knowledge of AD replication, DNS, trusts, and authentication.
• PowerShell scripting and automation skills.
• Experience with identity security, privileged access, and access management.
• Excellent communication and documentation skills.

Responsibilities

• Administer and support large-scale Active Directory and Microsoft Entra ID environments.
• Manage corporate, production, service, and privileged accounts.
• Design, deploy, and maintain enterprise Group Policy Objects (GPOs).
• Support hybrid identity solutions including Microsoft Entra Connect.
• Troubleshoot authentication, replication, DNS, LDAP, Kerberos, and Group Policy issues.
• Manage Active Directory domains, forests, trusts, sites, and services.
• Implement identity security best practices, including MFA and Conditional Access
• Develop PowerShell automation for provisioning, reporting, and administration.
• Participate in major incident response and on-call support.
• Maintain identity standards, documentation, and operational procedures.

Skills

Active Directory

Group Policy

PowerShell

Identity security

Hybrid identity

Troubleshooting

Job description

United States, Massachusetts, Westborough

We are eClinicalWorks. We are a privately held leader in healthcare IT, providing comprehensive, cloud based EHR/PRM solutions to medical professionals worldwide to improve workflows and reduce the risk of physician burnout. We care. We are committed to positive change. And that's where you come in. Do you value creativity and innovation? Great, so do we. At eClinicalWorks, we share a passion for improving healthcare through dedication, education, and teamwork. Everyone has that one thing they're really good at. We value your talent and want you to join our fast-paced, fun, and culturally diverse environment. Ready to make a difference? Apply today.

Position Overview

eClinicalWorks is seeking an experienced Active Directory / Microsoft Entra ID Engineer to support and enhance our global identity infrastructure. This role is responsible for the administration, security, and optimization of enterprise Active Directory and Microsoft Entra ID environments supporting both corporate operations and production healthcare platforms. The engineer will manage user, service, and privileged accounts, Group Policy administration, authentication services, hybrid identity, and access governance across a large-scale infrastructure. The ideal candidate will possess deep expertise in Active Directory architecture, enterprise Group Policy management, Microsoft Entra ID, and
identity security within a highly available production environment.

Key Responsibilities

• Administer and support large-scale Active Directory and Microsoft Entra ID environments.
• Manage corporate, production, service, and privileged administrative accounts.
• Design, deploy, and maintain enterprise Group Policy Objects (GPOs)
• Support hybrid identity solutions including Microsoft Entra Connect.
• Troubleshoot authentication, replication, DNS, LDAP, Kerberos, and Group Policy issues.
• Manage Active Directory domains, forests, trusts, sites, and services.
• Implement identity security best practices, including MFA and Conditional Access
• Develop PowerShell automation for provisioning, reporting, and administration.
• Participate in major incident response and on-call support.
• Maintain identity standards, documentation, and operational procedures.

Required Qualifications

5+ years of experience in the following:

• Enterprise Active Directory administration experience.
• Strong experience with Group Policy design, troubleshooting, and governance.
• Experience managing large global Active Directory environments.
• Expert knowledge of Active Directory replication, DNS, trusts, and authentication.
• Strong PowerShell scripting and automation skills.
• Experience with identity security, privileged access, and access management.
• Strong troubleshooting, communication, and documentation skills.

Preferred Qualifications

• Experience supporting healthcare or regulated environments is highly preferred
• Experience with Microsoft Defender for Identity is highly preferred
• Experience with Conditional Access, Identity Governance, and PAM solutions is highly preferred
• Microsoft identity and Azure certifications.
• Experience supporting cloud and hybrid infrastructure environments is highly preferred

Compensation:

Salary Range - $100,000 - 130,000 USD

This role will receive a competitive salary and benefits. The salary for employees hired into this role will be aligned with the range above, exclusive of potential bonuses. If you are hired, your base salary will be determined based on factors such as professional background, skills, education, and experience.

eClinicalWorks is an Equal Opportunity Employer. We respect and seek to empower each individual and support the diverse cultures, perspectives, skills, and experiences that bring us together and help create a healthy world.

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities

This employer is required to notify all applicants of their rights pursuant to federal employment laws.

For further information, please review the Know Your Rights notice from the Department of Labor.

Helping all candidates find great careers is our goal. The information you provide here is secure and confidential.