Active Directory / Identity Engineer (Senior)

Computer World Services; Oregon; Hybrid; USD 120,000 - 180,000; Full time

Job summary

Computer World Services, Corp. (CWS) is seeking a Senior Active Directory / Identity Engineer to own and sustain the Microsoft Active Directory Domain Services environment supporting the USMEPCOM ENLIST program.

The role encompasses domain, OU, GPOs, trusts, replication, schema governance, delegated permissions, domain services, and recovery capabilities with a modern ICAM focus including potential Okta integrations.

Qualifications

• Experience managing and maintaining Microsoft Active Directory Domain Services (AD DS) environments.
• Familiarity with identity and access management (ICAM) concepts and related tooling.

Responsibilities

• Serve as senior technical owner for the USMEPCOM AD DS environment, maintaining domain, OU, site, trust, and Group Policy plans and related architecture documentation.
• Install, configure, maintain, troubleshoot, and recover AD DS objects including users, computers, groups, and service accounts.
• Design and maintain OU structure and delegated administration using least-privilege principles.
• Develop, test, deploy, and troubleshoot GPOs, including links, inheritance, security filtering, backups, and recovery.
• Configure, validate, and troubleshoot domain and forest trusts and replication topology.
• Plan and execute domain-controller installation, upgrade, demotion, retirement, and coordinated schema extensions.
• Process escalated account, group, and permission changes; troubleshoot authentication and replication issues.
• Provide advanced support during identity and authentication incidents, escalate as needed.

Job description

Computer World Services, Corp. (CWS) seeks a Senior Active Directory / Identity Engineer to own and sustain the Microsoft Active Directory Domain Services (AD DS) environment supporting the USMEPCOM ENLIST program. This senior engineering position manages AD objects, organizational units, Group Policy Objects (GPOs), trusts, replication, schema governance, delegated permissions, domain services, and recovery capabilities.The engineer also evaluates and tests approved Identity, Credential, and Access Management (ICAM) capabilities, including potential Okta integrations. These modernization activities complement, not replace, the need for direct, hands‑on AD DS engineering expertise. The engineer works closely with cybersecurity, Service Desk, systems, cloud, network, application, COOP, and Government identity stakeholders.

Key Tasks & Responsibilities

• Serve as senior technical owner for the USMEPCOM AD DS environment, maintaining the domain, OU, site, trust, and Group Policy plans and related architecture documentation.
• Install, configure, maintain, troubleshoot, and recover AD DS, and create, modify, disable, and delete authorized users, computers, groups, service accounts, and other directory objects.
• Design and maintain the OU structure, and manage OU permissions and delegated administration using least-privilege principles, correcting excessive or conflicting access.
• Develop, test, deploy, and troubleshoot GPOs, including links, inheritance, precedence, security filtering, WMI filters, backups, and recovery; assess changes for security and customer impact before production.
• Configure, validate, and troubleshoot domain and forest trusts, reviewing direction, transitivity, authentication scope, and name‑suffix routing.
• Maintain AD sites, subnets, site links, and replication topology; troubleshoot replication failures, latency, and lingering objects; and maintain domain‑controller health, SYSVOL, DFSR, time sync, AD‑integrated DNS, and FSMO roles.
• Plan and execute domain‑controller installation, upgrade, demotion, and retirement and transitions to supported AD versions; govern and coordinate controlled schema extensions.
• Process escalated account, group, and permission changes; troubleshoot authentication, authorization, policy, trust, and replication issues; and improve identity‑related Service Desk routing and knowledge content.
• Provide advanced support during identity and authentication incidents, **escalate**