Active Directory / Identity Engineer (Journeyman)

DecisionPoint | Cortek; United States; Remote; USD 120,000 - 160,000; Full time

Job summary

DecisionPoint seeks an Active Directory / Identity Engineer to administer, sustain, secure, and recover the Microsoft AD DS environment supporting the USMEPCOM ENLIST program. This role manages AD objects, organizational units, Group Policy Objects, trusts, replication, schema changes, delegated permissions, domain services, and recovery capabilities.

The Active Directory / Identity Engineer provides direct, hands-on AD DS support while assisting with approved Identity, Credential, and Access

Qualifications

• Experience administering Microsoft Active Directory Domain Services.
• Proficiency in creating and managing OUs, GPOs, and trusts.
• Ability to test identity-management integrations and changes.
• Strong troubleshooting and incident response skills.
• Familiarity with disaster recovery and backup testing.

Responsibilities

• Administer, maintain, and recover AD DS and related directory objects.
• Manage OUs, users, groups, and service accounts with least-privilege access.
• Develop and test Group Policy Objects and links for environments.
• Monitor replication, trusts, and AD health; respond to incidents.
• Collaborate with cybersecurity, Service Desk, and cloud teams.
• Support identity modernization initiatives while preserving AD reliability.

Skills

AD DS administration

Group Policy

Identity & Access

Troubleshooting

Disaster recovery

Collaboration

Tools

Active Directory

AD FS / ADFS

Okta (Identity)**

Job description

Overview

DecisionPoint seeks an Active Directory / Identity Engineer to administer, sustain, secure, and recover the Microsoft Active Directory Domain Services environment supporting the USMEPCOM ENLIST program. This position manages AD objects, organizational units, Group Policy Objects, trusts, replication, schema changes, delegated permissions, domain services, and recovery capabilities.

The Active Directory / Identity Engineer provides direct, hands-on AD DS support while assisting with approved Identity, Credential, and Access Management initiatives. The engineer helps test potential Okta integrations and other identity-modernization technologies without reducing the program's need for strong traditional Active Directory engineering and operational expertise.

The engineer works closely with the Senior AD/Identity Engineer, cybersecurity personnel, Service Desk, systems administrators, cloud and application teams, COOP personnel, and Government identity stakeholders. The position supports routine directory administration, complex troubleshooting, modernization testing, disaster recovery, and critical incident response.

This position is remote, with Chicago-area candidates preferred. Occasional after-hours maintenance, COOP exercises, incident response, on-site support, or travel may be required.

Note: By applying to this position, you acknowledge and consent to having your resume included in an active competitive government contract bid.

Duties & Responsibilities

The Active Directory / Identity Engineer will:

Administer, maintain, update, troubleshoot, and recover Microsoft Active Directory Domain Services.

Create, modify, disable, delete, and maintain authorized AD objects in accordance with approved procedures.

Manage users, computers, groups, service accounts, organizational units, shared resources, and related directory objects.

Maintain domain, organizational-unit, site, trust, Group Policy, and administrative-design documentation.

Implement and maintain approved organizational-unit structures.

Manage OU-level permissions and delegated administrative access using least-privilege principles.

Review delegated permissions and identify excessive, obsolete, inherited, or conflicting access.

Develop, test, deploy, maintain, and troubleshoot Group Policy Objects.

Manage GPO links, inheritance, precedence, security filtering, WMI filters, backups, and recovery.

Assess proposed Group Policy changes for technical, security, and customer impact before production deployment.

Identify and correct conflicting, obsolete, duplicative, or ineffective Group Policy settings.

Maintain trusted relationships with enterprise and authorized external Active Directory structures.

Configure, validate, monitor, and troubleshoot approved domain and forest trusts.

Review trust direction, transitivity, authentication scope, name-suffix routing, and related settings.

Maintain AD sites, subnets, site links, replication schedules, and replication topology.

Monitor and troubleshoot replication failures, latency, lingering objects, directory inconsistencies, and topology problems.

Support the health and availability of domain controllers, directory databases, SYSVOL, DFS Replication, time synchronization, and AD-integrated DNS dependencies.

Monitor Flexible Single Master Operations roles and support approved role-transfer or recovery activities.

Support domain-controller installation, configuration, replacement, upgrade, demotion, and retirement.

Assist with planning and executing transitions to supported versions of Active Directory.

Support controlled AD schema updates and approved schema extensions.

Assess proposed schema changes for compatibility, replication impact, operational risk, and recovery requirements.

Maintain current directory schematics, architecture diagrams, trust diagrams, replication diagrams, and object-management documentation.

Process or support approved account, group, permission, and organizational-unit changes escalated through Service Desk and access-management processes.

Troubleshoot authentication, authorization, account, group-membership, policy, trust, replication, and directory-permission issues.

Coordinate with Service Desk personnel to improve identity-related troubleshooting, ticket routing, escalation, and knowledge content.

Provide advanced support during identity, authentication, domain, and access-management incidents.

Recognize widespread authentication failures and elevate potential outages through approved incident-response procedures.

Collect directory logs, replication information, policy results, configuration data, and other evidence needed for root-cause analysis.

Implement approved corrective and preventive actions resulting from incidents and problem reviews.

Maintain and execute Active Directory backup and restoration procedures.

Test system-state backups, deleted-object recovery, authoritative and non-authoritative restoration, and forest-recov