Senior Active Directory & Identity Engineer - Remote

DecisionPoint | Cortek; United States; Remote; USD 120,000 - 170,000; Full time

Job summary

DecisionPoint | Cortek seeks an experienced Active Directory / Identity Engineer to own the Microsoft AD DS environment supporting the USMEPCOM ENLIST program. This senior role manages AD objects, OUs, GPOs, trusts, replication, and recovery.

You will ensure that directory services remain secure, available, recoverable, and aligned with cybersecurity requirements, supporting domain planning, account administration, site replication, and password policy.

Responsibilities

• Serve as the senior technical owner for the USMEPCOM Active Directory Domain Services environment.
• Install, configure, maintain, update, troubleshoot, and recover Active Directory services and supporting components.
• Create, modify, disable, delete, and manage authorized AD objects in accordance with approved processes.
• Manage organizational units, users, computers, groups, service accounts, shared resources, and other directory objects.
• Maintain the domain plan, organizational-unit plan, site plan, trust plan, Group Policy design, and related architecture documentation.
• Design and maintain an organizational-unit structure that supports administration, policy application, security boundaries, and delegated management.
• Manage organizational-unit permissions and administrative delegation using least-privilege principles.
• Review delegated access and correct excessive, obsolete, inherited, or conflicting permissions.
• Develop, test, implement, maintain, and troubleshoot Group Policy Objects.
• Manage GPO links, inheritance, precedence, security filtering, loopback processing, WMI filters, backups, version history, and recovery.
• Evaluate proposed GPO changes for security, operational, and customer impact before production implementation.
• Identify and resolve conflicting, obsolete, duplicative, or ineffective Group Policy settings.
• Manage trust relationships with enterprise and external AD structures.
• Configure, validate, monitor, and troubleshoot domain and forest trusts within approved security boundaries.
• Review trust direction, transitivity, authentication scope, name-suffix routing, and related security settings.
• Manage AD sites, subnets, site links, replication schedules, bridgehead behavior, and replication topology.
• Monitor and troubleshoot replication latency, failures, lingering objects, directory inconsistencies, and site-topology problems.
• Maintain the health of domain controllers, directory databases, SYSVOL, DFS Replication, time synchronization, and AD-integrated DNS dependencies.
• Monitor Flexible Single Master Operations roles and support approved role transfer or seizure when necessary.
• Plan and execute domain-controller installation, replacement, upgrade, demotion, and retirement activities.
• Develop and implement approved plans to transition Active Directory to supported versions.
• Manage AD schema governance and coordinate tightly controlled schema extensions.
• Evaluate schema-change requests for compatibility, replication impact, operational risk, recovery requirements, and required approvals.
• Maintain current directory schematics, architecture diagrams, object models, administrative boundaries, trust diagrams, and replication diagrams.
• Administer account and group changes escalated from approved Service Desk and access-management processes.
• Support troubleshooting of authentication, authorization, account, group-membership, policy, trust, replication, and directory-permission issues.
• Coordinate with the Service Desk to improve identity-related ticket routing, troubleshooting, escalation, and knowledge content.
• Provide advanced engineering support during identity, authentication, domain, and access-management incidents.
• Identify widespread authentication failures or other outage signals and elevate them through approved incident-response proce

Job description

DecisionPoint | Cortek seeks an experienced Active Directory / Identity Engineer to own the Microsoft AD DS environment supporting the USMEPCOM ENLIST program. This senior role manages AD objects, OUs, GPOs, trusts, replication, and recovery.

You will ensure that directory services remain secure, available, recoverable, and aligned with cybersecurity requirements, supporting domain planning, account administration, site replication, and password policy.