Active Directory / Identity Specialist

Role: Active Directory / Identity Specialist

Location: San Jose, CA (Onsite)

JD:

Key Responsibilities

Active Directory & Hybrid Identity

Design, deploy, and maintain AD DS forests, domains, trusts, sites, and replication topologies

Administer Group Policy, DNS, DHCP, DFS, and AD Certificate Services (PKI)

Implement and support Microsoft Entra ID, Entra Connect / Cloud Sync, and hybrid join

Lead AD consolidation, domain migrations, and cloud identity modernization projects

Identity & Access Management

Configure SSO, federation (ADFS, SAML, OIDC, OAuth 2.0), and MFA across enterprise applications

Implement Conditional Access, Privileged Identity Management (PIM), and least-privilege role models

Automate joiner / mover / leaver lifecycle processes and access reviews

Integrate identity platforms (Okta, Ping, SailPoint, CyberArk) with HR and ITSM systems

Security & Compliance

Harden AD against attack paths (tiered administration, LAPS, Kerberos, NTLM reduction)

Monitor and remediate identity threats using Defender for Identity, Entra ID Protection, and SIEM tooling

Support audit and compliance requirements (SOX, SOC 2, NIST, ISO 27001)

Perform health checks, risk assessments, and remediation planning

Operations & Delivery

Troubleshoot complex authentication, replication, and directory issues (Tier 3 escalation)

Automate administration with PowerShell and infrastructure-as-code

Produce architecture diagrams, runbooks, and knowledge transfer for client teams

Partner with clients, security, and application teams on requirements and delivery

Required Qualifications

5+ years of hands-on experience administering Active Directory in enterprise environments

Strong knowledge of AD DS, DNS, Group Policy, Kerberos, LDAP, and PKI

Experience with Microsoft Entra ID and hybrid identity (Entra Connect, SSO, MFA, Conditional Access)

Proficiency in PowerShell scripting and automation

Working knowledge of identity security concepts: least privilege, RBAC, privileged access, and zero trust

Experience with Windows Server 2016/2019/2022 and supporting large, multi-site environments

Ability to troubleshoot replication, authentication, and directory performance issues

Bachelor's degree in Computer Science, Information Technology, or equivalent practical experience

Preferred Qualifications and Certifications

Experience leading AD migrations, forest/domain restructures, or M&A identity integrations

Exposure to IGA / PAM platforms such as SailPoint, CyberArk, BeyondTrust, or Saviynt

Familiarity with Okta, Ping Identity, or other third-party IdPs

Experience with Microsoft Defender for Identity, Sentinel, or Splunk for identity monitoring

Knowledge of Azure / AWS identity services and infrastructure-as-code (Terraform, Bicep)

Prior consulting or client-facing delivery experience

Certification

Priority

Microsoft Identity and Access Administrator (SC-300)

Preferred

Microsoft Azure Administrator (AZ-104)

Preferred

Microsoft Certified: Cybersecurity Architect Expert (SC-100)

Nice to have

CISSP or Security+

Nice to have

Okta Certified Professional / Administrator

Nice to have

Core Competencies

Clear written and verbal communication with technical and executive audiences

Structured problem solving under pressure, especially during outages and incidents

Ownership mindset and the ability to work independently across multiple client engagements

Strong documentation habits and a commitment to knowledge transfer

Security-first judgment and attention to detail when changing production identity systems