Senior Active Directory Engineer - Mergers, Acquisitions & Divestitures

Value Apothecaries; Conshohocken (Montgomery County); On-site; USD 140,000 - 190,000; Full time

Job summary

Cencora seeks a Senior Active Directory Engineer to design and implement the identity workstreams for acquisitions. You will assess new environments, plan consolidation, and execute cross-forest migrations with secure, auditable connections.

You'll collaborate with IT leadership, Security, Legal, and Integration Management Office to deliver Day-1 readiness and long-term identity consolidation under tight timelines.

Qualifications

• 8+ years of experience engineering enterprise Active Directory in multi-domain / multi-forest environments.

Responsibilities

• Plan and execute inter-forest migrations of users, groups, computers, and service accounts.

Skills

Active Directory

M&A experience

AD migration tools

Cross-forest design

PowerShell scripting

DNS/DHCP/ADCS

Security & IAM

Tools

Quest Migration Tools

ADMT

Entra Connect

ShareGate

BitTitan

Semperis

CoreView

Job description

Our team members are at the heart of everything we do. At Cencora, we are united in our responsibility to create healthier futures, and every person here is essential to us being able to deliver on that purpose. If you want to make a difference at the center of health, come join our innovative company and help us improve the lives of people and animals everywhere.

Job Details

About the Role

We are looking for a Senior Active Directory Engineer to design and build the identity workstreams of our acquisition activity. You will assess newly acquired environments, then design and execute the migration, consolidation, and coexistence of directory environments across multiple forests, making sure that every connection between two organizations is secure, auditable, and reversible. Including similar tasks for divestitures.

This is a hands-on role. You will work with IT leadership, Security, Legal, and the Integration Management Office to deliver Day-1 readiness and long-term identity consolidation, often on compressed timelines.

Key Responsibilities

• Acquisition Identity Integration
  • Perform pre-close and post-close discovery and assessment of acquired environments: forest and domain structure, trusts, GPOs, schema state, DNS, PKI, service accounts, privileged access, and technical debt.
  • Design the path to consolidate acquired forests into a target forest, including temporary coexistence (trusts, federation) needed to bridge Day-1 until migration is complete. Flag the exceptions where consolidation is not advisable (e.g., regulatory separation, unsupported legacy apps).
  • Plan and execute inter-forest migrations of users, groups, computers, and service accounts, including SID history, password migration/sync, workstation re-joins and profile migration, and resource access cutover in waves.
  • Remediate and rationalize acquired objects before migration: naming collisions, UPN/email suffix conflicts, stale accounts, duplicate groups, and nested-group sprawl.
  • Migrate or rebuild dependent services: DNS zones, DHCP, file servers/shares and ACLs, ADCS/PKI, application service accounts, and LDAP/Kerberos-dependent apps.
  • Deliver Day-1 capabilities such as cross-company email/calendar visibility, collaboration access, and SSO to shared applications.
  • Run long-term consolidation including forest and domain decommissioning: SID history cleanup, GPO and naming standardization, and removal of legacy trusts, DCs, and stale objects.
  • Handle tenant-to-tenant coordination with the messaging and collaboration teams.
  • Keep a repeatable acquisition integration playbook current and improve it after each deal.
• Divestitures & Separations
  • Support divestitures: dependency mapping, entitlement cleanup, and Transition Service Agreement (TSA) identity support.
  • Decommission shared trusts and sync connections at TSA exit.
• Security & Risk
  • Assess the security posture of acquired environments before any connection is made (AD health, privileged account exposure, legacy protocols, unpatched DCs).
  • Design secure connectivity between companies: selective-authentication trusts, network segmentation, tiered administration, and least-privilege access.
  • Remediate common AD attack paths (Kerberoasting, unconstrained delegation, AdminSDHolder abuse, weak ADCS templates, excessive Domain Admin membership).
  • Partner with Security/SOC on monitoring, logging, and incident response during integration.
  • Support audit, compliance, and regulatory requirements (SOX, HIPAA, PCI, GDPR, as applicable).
• Operations & Documentation
  • Maintain runbooks, cutover plans, rollback plans, and post-migration validation checklists.
  • Provide Tier 3 support for complex AD, DNS, DHCP, GPO, and PKI issues.
  • Mentor junior engineers and contribute to standards and automation.

Required Qualifications

• 8+ years of experience engineering enterprise Active Directory in multi-domain / multi-forest environments.
• Demonstrated M&A experience: at least [2-3] completed acquisitions or mergers where you personally led or executed the identity workstream. Divestiture experience is a plus.
• Hands-on experience with AD migration tools, such as:
  • Quest / Binary Tree On Demand Migration or Migration Manager
  • Microsoft Active Directory Migration Tool (ADMT)
  • Microsoft Entra Connect / Cloud Sync
  • Other third-Party tools (e.g., Quest, ShareGate, BitTitan, Semperis, CoreView, or equivalent)
• Deep knowledge of trust types and cross-forest design, including selective authentication, SID filtering, SID history, and quarantine.
• Proven experience consolidating acquired forests into a single target forest (inter-forest migrations of at least [1,000+] users), including decommissioning the source forest.
• Strong understanding of AD security: tiered administration model, PAM/PAW, LAPS, Kerberos/NTLM hardening, ADCS security, and AD attack and defense techniques.
• Strong working knowledge of DNS, DHCP, GPO, Sites & Services, replication, and PKI/ADCS.
• Advanced PowerShell scripting for automation, reporting, and bulk