Identity Engineer - Active Directory

Job description

**This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Identity Engineer - Active Directory based in India.** This is an exciting opportunity for a highly experienced identity and security professional to manage and strengthen enterprise directory services and Public Key Infrastructure (PKI) environments. You will take ownership of Microsoft Active Directory Certificate Services (AD CS), certificate lifecycle management, and hybrid identity architecture spanning on-premises Active Directory and Microsoft Entra ID. Your work will help maintain secure, reliable authentication, encryption, and trust across enterprise systems and applications. Combining hands-on platform administration with advanced troubleshooting, you will resolve complex directory, certificate, and authentication issues across cloud and hybrid environments. Working closely with Security, Infrastructure, and Application teams, you will support critical identity services, incident response, and infrastructure improvements. This role also emphasizes automation, operational discipline, documentation, and continuous improvement across a diverse, global enterprise environment. ### Accountabilities - Administer and maintain Microsoft Active Directory Certificate Services (AD CS), including root and issuing certificate authorities, certificate templates, and enrollment policies. - Manage the complete certificate lifecycle, including issuance, renewal, revocation through CRL/OCSP, and expiration monitoring for internal and public-facing systems. - Maintain enterprise directory services, including Active Directory and LDAP, with responsibility for forest and domain architecture, replication health, Group Policy, organizational units, and schema management. - Manage hybrid identity synchronization through Azure AD Connect or Microsoft Entra Connect, including synchronization rules, attribute flows, and troubleshooting failures. - Support Microsoft Entra ID administration related to directory and certificate-based authentication, including certificate-based authentication, Conditional Access, and device trust. - Configure and manage SSL/TLS certificate deployment for servers, applications, and network devices, ensuring correct certificate chain validation and trust store management. - Troubleshoot complex directory and certificate connectivity issues involving DNS, Kerberos/NTLM, LDAPS binding, authentication, and certificate chain validation. - Support authentication and authorization troubleshooting across Active Directory/LDAP, SAML, MFA, and SSO integrations. - Develop and maintain PowerShell and Python scripts, using REST APIs where appropriate, to automate certificate management, directory reporting, and PKI health monitoring. - Monitor and analyze directory, AD CS, and network logs, supporting SIEM integration, incident response, and proactive infrastructure monitoring. - Apply identity and PKI security best practices while supporting compliance with SOX, PCI-DSS, NIST, and ISO 27001 requirements. - Collaborate with Security, Infrastructure, and Application teams on certificate authority hierarchies, directory architecture changes, and migrations across enterprise and operating company environments. - Maintain technical documentation, configuration records, and incident reports, while training end users and application teams on certificate requests and directory best practices. - Plan and execute directory and PKI disaster recovery procedures, including certificate authority backup and restoration and Active Directory forest recovery readiness. - Promote operational discipline, standardization, ownership, and continuous improvement to make identity management processes scalable, measurable, and repeatable. ### Requirements: - Bachelor's degree recommended; equivalent professional experience will also be considered. - More than 10 years of experience in cybersecurity, systems administration, or identity and access management, including at least 5 years of hands-on experience administering AD CS and enterprise PKI. - Strong understanding of PKI architecture, including root and issuing certificate authorities, certificate templates, CRL/OCSP, and cryptographic key management. - Deep working knowledge of Active Directory and LDAP, including forest and domain design, replication, Group Policy, and schema administration. - Practical experience with hybrid identity synchronization using Entra Connect or equivalent technologies, and Microsoft Entra ID, including Conditional Access and certificate-based authentication. - Strong knowledge of DNS, Kerberos/NTLM authentication, and certificate chain troubleshooting across on-premises and cloud environments, including AWS, Azure, and GCP. - Experience troubleshooting SAML, MFA, and SSO authentication and authorization issues related to directory services and certificate trust. - Proficiency in PowerShell and Python scripting, with working knowledge of REST APIs and certificate automation tools. - Experience with log analysis, SIEM integration, incident response, and root cause analysis in directory and PKI environments. - Knowledge of security and compliance frameworks, including SOX, PCI-DSS, NIST, and ISO 27001, as well as Zero Trust security principles. - Microsoft Certified: Identity and Access Administrator (SC-300) certification or equivalent preferred; additional cloud or security certifications such as AWS, Azure, GCP, CISSP, CISM, or Security+ are advantageous. - Strong communication and technical documentation skills, including the ability to explain complex concepts to non-technical stakeholders and train end users and application teams. - Ability to work effectively across enterprise and operating company environments, balancing global standards with local business requirements and collaborating across time zones and cultures. - A proactive, collaborative mindset with a strong commitment to continuous improvement, transparency, accountability, and ownership. ### Benefits: - Full-time employment. - Hybrid working arrangement in India. - Opportunity to work on enterprise-scale identity, directory, and PKI infrastructure. - Exposure to modern hybrid identity technologies and cloud environments. - Collaboration with global Security, Infrastructure, and Application teams. - Opportunities to contribute to enterprise security, operational improvements, and identity architecture initiatives.