Senior Windows Platform Engineer - Cloud & Automation

Tech Holding; Los Angeles (CA); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

Tech Holding is seeking a Senior Windows Engineer for a hands-on, project-based assignment to harden a Windows platform across AD, DNS, Kerberos, automation, and cloud infrastructure. This role emphasizes platform engineering over traditional administration, with a strong focus on security and reliability.

You will develop and maintain image pipelines, PowerShell automation, and IaC, leveraging OpenTofu, Chef, Ansible, and Systems Manager to support resilient, compliant Windows environments

Qualifications

• Expert-level experience with Active Directory and DNS resilience, including replication topology and health.
• Expert-level knowledge of Kerberos authentication, including SPNs, duplicate-SPN failure modes, constrained delegation, AES/RC4 encryption, managed service accounts, group managed service accounts, and reverse DNS dependencies.
• Strong experience with identity integration across Windows and non-Windows environments, including LDAP and single sign-on.
• Expert-level experience with golden image and patch pipelines, including image bake automation, CI-scheduled builds, promotion, deprecation, deregistration, and CVE-driven rebuilds.
• Strong Windows observability and PowerShell experience.
• Strong experience with Infrastructure as Code and configuration management, including OpenTofu and tools such as Chef, Ansible, and Systems Manager.
• Strong understanding of cloud infrastructure, security, data-protection controls, and infrastructure automation.
• Strong experience with PKI and certificate services.
• Strong experience with disaster recovery design, including RTO/RPO, recovery strategies, failover testing, and Windows file services.

Responsibilities

• Improve Active Directory and DNS resilience, including replication topology and health, FSMO roles, DFS-R, NTDS, AD-integrated DNS, and domain controllers.
• Support the estate's migration from NTLM to Kerberos, ensuring both protocols can operate without an outage during the transition.
• Work with service principal names and duplicate-SPN failure modes, constrained delegation, AES over RC4 through the supported-encryption-types attribute, managed and group managed service accounts, and reverse DNS.
• Support identity integration across the estate, including LDAP for non-Windows hosts, desktop single sign-on via Kerberos passthrough with constrained delegation, cloud single sign-on, and brokered application identity.
• Support and improve the golden image and patch pipeline, including image bake automation, CI-scheduled builds, promotion, deprecation, deregistration, and CVE-driven rebuilds.
• Improve Windows observability, including infrastructure agents, Windows service and event-channel collection, script-derived metrics, domain controller service health, replication status, and operational log-channel forwarding.
• Develop and maintain PowerShell automation supporting Windows platform operations and resiliency.
• Support Infrastructure as Code and configuration management, including Chef, Ansible, Systems Manager, guardrail policies, pipeline pre-deploy validation, and OpenTofu.
• Support multi-account rebuild, guardrail policies, and module compliance.
• Strengthen security and data-protection controls, including encryption by default on block storage, key management, web-tier protection, and instance metadata hardening.
• Improve PKI and certificate services resilience, including certificate authority recovery posture.
• Support disaster recovery design, cloud platform, and file services, including recovery tiering with defined RTO and RPO, pilot light versus active-passive trade-offs, non-disruptive failover testing, and divisional cloud accounts.
• Support file-services resilience and legacy distributed file system decommissioning targeting zero RPO and sub-five-minute RTO.

Skills

Active Directory

DNS

Kerberos authentication

PowerShell

Automation

Infrastructure as Code

Cloud familiarity

Security controls

Tools

OpenTofu

Chef

Ansible

Systems Manager

Job description

Tech Holding is seeking a Senior Windows Engineer for a hands-on, project-based assignment to harden a Windows platform across AD, DNS, Kerberos, automation, and cloud infrastructure. This role emphasizes platform engineering over traditional administration, with a strong focus on security and reliability.

You will develop and maintain image pipelines, PowerShell automation, and IaC, leveraging OpenTofu, Chef, Ansible, and Systems Manager to support resilient, compliant Windows environments