Consultant, IT Infrastructure

Travel + Leisure Co.; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Travel + Leisure Co. seeks a Systems Infrastructure Engineer to lead enterprise Active Directory, DDI, and PKI engineering. You will design, secure, and automate critical identity and infrastructure services across the global enterprise.

You will mentor engineers, define standards, and handle complex incidents while aligning with SOX/PCI/PII controls. Some travel may be required.

Qualifications

• Bachelor's degree in IT or related field preferred.
• Expert-level AD, DNS/DHCP/IPAM and PKI experience.
• Proven automation and scripting for enterprise infrastructure.
• Certifications in Windows Server, PKI, and IT security preferred.
• Experience with SOX, PCI, and PII compliance obligations.

Responsibilities

• Own AD engineering, multi-forest/domain design, and GPO management.
• Own DDI engineering: DNS/DHCP/IPAM design and automation.
• Own PKI engineering: CA hierarchy, templates, lifecycle management.
• Mentor engineers, lead root cause analyses, and on-call escalation.
• Drive standardization, security hardening, and automation initiatives.

Skills

Active Directory

DDI

PKI

Automation

Scripting

PowerShell

Python

Troubleshooting

Security & Compliance

Education

Bachelor's degree in IT or related field

Microsoft Windows Server Hybrid Administrator Associate

Identity and Access Administrator Associate

VCP-DCV or equivalent

ITIL 4 Foundation or higher

Tools

Infoblox

BlueCat

IPAM tooling (MS IPAM)

SCCM

PowerShell

Ansible

REST APIs

Job description

We Put the World on Vacation

Travel + Leisure Co. is the world’s leading vacation ownership and travel membership company, with a dynamic and growing portfolio of resort, travel club, and lifestyle travel brands. Our dedicated associates help the company achieve its mission to put the world on vacation. Innovation and growth keep our work interesting and fun. Every day is a chance to learn something new and turn vacation inspiration into exceptional experiences for millions of travelers worldwide.

The Systems Infrastructure Engineer, Consulting Engineer (Active Directory, DDI & PKI) is the subject matter expert (SME) for enterprise Active Directory, DDI (DNS, DHCP, and IP Address Management), and Certificate Services (PKI) infrastructure. The incumbent carries deep, expert-level expertise across these domains, from multi-forest and multi-domain Active Directory design to DNS, DHCP, and IPAM administration to certificate authority and certificate lifecycle management, and is the hands-on technical authority the Technical Architect and Sr. Manager rely on for that expertise.

This position partners with the Technical Architect, Infrastructure, Security, Network, Application, and Project Management teams to engineer and operate an Active Directory, DDI, and Certificate Services environment that is secure, highly available, and aligned with enterprise architecture and standards. This role also drives automation of Active Directory, DDI, and PKI operations to reduce manual effort and improve consistency across the environment. The role may also be assigned other WINTEL infrastructure work, such as Windows Server, virtualization, storage, or endpoint platform support, on an as-needed basis outside of its core Active Directory, DDI, and PKI focus.

This role does not carry direct people management responsibility but is expected to set technical direction, define standards, mentor engineers, and serve as the final internal escalation point for complex Active Directory, DDI, and Certificate Services issues.

How You’ll Shine:

• AD Engineering: Own day-to-day engineering, administration, and support of the enterprise Active Directory environment, including multi-forest and multi-domain topology, trust relationships, Group Policy, and directory security. Drive innovation and automation of routine Active Directory administration, such as account and group lifecycle management, Group Policy deployment, and health checks, to reduce manual effort and improve consistency. Serve as the hands-on technical advisor the Technical Architect and Sr. Manager rely on for Active Directory, providing expert input on domain controller placement, replication, authentication, and access control. Lead the planning and technical execution of Active Directory projects, including domain upgrades, migrations, and consolidations.
• DDI Engineering: Own day-to-day engineering, administration, and support of the enterprise DNS, DHCP, and IP address management (IPAM) environment. Drive innovation and automation for DNS record management, DHCP scope provisioning, and IPAM workflows using scripting, APIs, or orchestration tools to reduce manual effort, improve accuracy, and speed up delivery of DDI changes. Serve as the hands-on technical advisor the Technical Architect and Sr. Manager rely on for DDI, providing expert input on zone design, scope management, and address allocation. Lead the planning and technical execution of DDI projects, including DNS/DHCP/IPAM modernization initiatives.
• PKI Engineering: Own day-to-day engineering, administration, and support of the enterprise Public Key Infrastructure (PKI), including certificate authority (CA) hierarchy, certificate templates, and certificate lifecycle management. Drive innovation and automation of certificate issuance, renewal, and expiration monitoring to reduce manual effort and prevent outages caused by expired certificates. Serve as the hands-on technical advisor the Technical Architect and Sr. Manager rely on for Certificate Services, providing expert input on certificate issuance, renewal, and revocation standards. Lead the planning and technical execution of PKI projects, including certificate authority upgrades and cipher/algorithm modernization initiatives.
• Technical Escalation and Mentoring: Serve as the senior-most technical escalation point for complex Active Directory, DDI, and Certificate Services incidents. Lead root cause analysis for critical or recurring issues, drive remediation to closure, and build automated diagnostics and health checks that speed up detection and resolution. Participate in the on-call rotation for business-critical incidents. Mentor engineers through design discussions, troubleshooting, peer reviews, and knowledge-sharing sessions, and support security posture, access governance, and compliance and audit activities such as SOX, PCI, and PII.
• Other Duties as Assigned: Provide support across the broader WINTEL environment as assigned, including Windows Server, VMware ESXi/vSphere virtualization, storage, and endpoint management (SCCM), including automation where applicable. This work is secondary to the role’s core Active Directory, DDI, and Certificate Services focus.

Travel Requirements:

• Occasional travel may be required to support datacenter activities, vendor engagements, or enterprise infrastructure projects. Expected travel: 0% to 15%.

What You’ll Bring:

• Bachelor’s degree in Computer Science, Information Technology, Information Systems, Engineering, or a related technical field preferred.
• Equivalent professional experience may be accepted in lieu of the education requirement.
• At least one current or previously held certification, formal training credential, or equivalent demonstrated expert-level experience in Active Directory, DNS/DHCP/IPAM (DDI), enterprise PKI/certificate services, or enterprise IT infrastructure engineering.
• Microsoft Certified: Windows Server Hybrid Administrator Associate or equivalent Windows Server / Active Directory credential preferred
• Microsoft Certified: Identity and Access Administrator Associate preferred
• Vendor certification in DDI/IPAM platforms (e.g., Infoblox, BlueCat, or Microsoft IPAM) preferred
• Training or formal certification in enterprise PKI / certificate lifecycle management preferred
• ITIL 4 Foundation or higher ITIL certification preferred
• Microsoft Certified: Azure Administrator Associate a plus
• VMware Certified Professional - Data Center Virtualization (VCP-DCV) a plus
• Certification or formal training in scripting or automation tooling (e.g., PowerShell, Python, or Ansible) a plus
• Active Directory and Identity Infrastructure Expertise
  • Expert-level knowledge of Active Directory architecture, including multi-forest and multi-domain design, trust relationships, replication topology, and Group Policy.
  • Ability to design, harden, and troubleshoot enterprise-scale directory environments and diagnose complex, cross-domain issues.
  • Ability to automate routine Active Directory administration, such as account and group lifecycle management, Group Policy deployment, and health checks.
• DDI (DNS, DHCP, IPAM) Expertise
  • Expert-level knowledge of enterprise DNS and DHCP design, zone and scope management, and IP address management (IPAM) practices.
  • Ability to design, secure, and troubleshoot DDI services at enterprise scale, and to connect DDI design decisions to identity, network, and application dependencies.
  • Ability to automate DNS record management, DHCP scope provisioning, and IPAM workflows using scripting, APIs, or orchestration tools to reduce manual effort and improve accuracy.
• Certificate Services (PKI) Expertise
  • Expert-level knowledge of enterprise PKI design, certificate authority hierarchy, certificate templates, and certificate lifecycle management.
  • Ability to design, secure, and troubleshoot certificate services at enterprise scale, and to connect PKI design decisions to identity, network, and application dependencies.
  • Ability to automate certificate issuance, renewal, and expiration monitoring to reduce manual effort and prevent outages caused by expired certificates.
• Automation and Process Improvement
  • Ability to identify manual, repetitive, or error-prone Active Directory, DDI, and PKI processes and design automation that improves speed, consistency, and accuracy.
  • Working proficiency with scripting and automation tooling (such as PowerShell, Python, or Ansible) sufficient to build and maintain production automation.
• Problem Solving and Technical Judgment
  • Demonstrated ability to troubleshoot in a crisis and lead technical resolution of complex, business-critical incidents.
  • Ability to anticipate and identify potential problems before they occur and implement solutions, including automated checks, that minimize impact on projects and users.
• Standards, Security, and Technical Quality
  • Ability to define and enforce infrastructure engineering standards, security hardening practices, and documentation for Active Directory, DDI, and Certificate Services, including SOX, PCI, and PII requirements.
  • Focus on high availability concepts, proactive monitoring and alerting, automation, and long-term platform health.
• Mentoring and Knowledge Sharing
  • Ability to mentor engineers through design discussions, troubleshooting, peer reviews, and documentation.
  • Ability to raise the team’s overall technical maturity, consistency, and adoption of automation across Active Directory, DDI, and Certificate Services.
• Communication and Collaboration
  • Excellent written and verbal communication skills.
  • Ability to work with cross-functional teams, outsourced vendors, and business stakeholders for project planning and issue resolution.
• Core Domain Expertise: Active Directory
  • Active Directory (multi-forest, multi-domain)
  • Group Policy
• Core Domain Expertise: DDI
  • DNS
  • DHCP
  • IP Address Management (IPAM)
• Core Domain Expertise: Certificate Services (PKI)
  • Certificate authority (CA) hierarchy and management
  • Certificate lifecycle management (issuance, renewal, revocation)
  • Certificate templates and auto-enrollment
• Automation and Scripting Tools
  • PowerShell
  • Python
  • Ansible
  • REST APIs / DDI platform automation interfaces
  • GitHub
• Additional WINTEL Platforms (Supported as Assigned)
  • Windows Server infrastructure
  • VMware ESXi / vSphere
  • Dell EMC storage platforms
  • SCCM