Active Directory / Identity Engineer (Senior)

Computer World Services•North Chicago, IL

2d•$135,000 - $175,000•Remote

About The Position

Computer World Services, Corp. (CWS) seeks a Senior Active Directory / Identity Engineer to own and sustain the Microsoft Active Directory Domain Services (AD DS) environment supporting the USMEPCOM ENLIST program. The role manages AD objects, organizational units, Group Policy Objects (GPOs), trusts, replication, schema governance, delegated permissions, domain services, and recovery capabilities. The engineer evaluates and tests approved Identity, Credential, and Access Management (ICAM) capabilities, including potential Okta integrations. Modernization work complements rather than replaces hands-on AD DS engineering. The engineer works closely with cybersecurity, Service Desk, systems, cloud, network, application, COOP, and Government identity stakeholders. This is a remote position, with Chicago-area candidates preferred. Occasional after-hours maintenance, COOP exercises, disaster-recovery testing, incident response, on-site support, or travel may be required. The contract period of performance is March 1, 2027, through February 28, 2033, with a contract start date of March 1, 2027. Applicants acknowledge that their resume may be included in an active competitive Government contract bid.

Requirements

Bachelor’s degree in Information Technology, Information Systems, or a related field, or equivalent professional experience where permitted by the labor category.
At least eight years of relevant experience in Active Directory engineering, identity engineering, Windows infrastructure, systems engineering, or a related discipline.
Direct, hands-on experience engineering and administering Microsoft AD DS in an enterprise environment, including objects, OUs, GPOs, trusts, replication, schema, delegated permissions, and directory recovery.
Experience troubleshooting complex authentication, authorization, Group Policy, replication, and trust issues, and planning or supporting AD backup, restoration, and forest recovery.
Experience testing identity integrations or supporting identity-modernization activities, with an understanding of the distinction between core AD DS and external ICAM, federation, or cloud-identity services.
Strong written, verbal, analytical, and technical problem-solving skills.
Active Secret clearance or higher.

Nice To Haves

Experience integrating AD with Okta, Microsoft Entra ID, or hybrid identity.
Experience supporting federal or DoD ICAM initiatives, including CAC, PIV, certificate-based authentication, and PKI.
Experience with SAML, OIDC, OAuth, SCIM, LDAP, Kerberos, NTLM, AD FS, or comparable federation technologies.
Experience with PowerShell for AD administration and automation.
Experience applying DISA STIGs to AD and Windows infrastructure and supporting RMF authorization activities.
Familiarity with Zero Trust identity principles and privileged-access, identity-governance, or audit tools.
Microsoft identity, Windows Server, or Azure certification; Okta Certified Administrator, Okta Certified Consultant, or comparable certification; CompTIA Security+, CISSP, or another security certification; or ITIL 4 Foundation.

Responsibilities

Serve as senior technical owner for the USMEPCOM AD DS environment; maintain domain, OU, site, trust, and Group Policy plans and related architecture documentation.
Install, configure, maintain, troubleshoot, and recover AD DS; create, modify, disable, and delete authorized directory objects, including users, computers, groups, and service accounts.
Design and maintain the OU structure, manage OU permissions and delegated administration according to least-privilege principles, and correct excessive or conflicting access.
Develop, test, deploy, and troubleshoot GPOs, including links, inheritance, precedence, security filtering, WMI filters, backups, and recovery; assess security and customer impact before production changes.
Configure, validate, and troubleshoot domain and forest trusts, including direction, transitivity, authentication scope, and name-suffix routing.
Maintain AD sites, subnets, site links, replication topology, domain-controller health, SYSVOL, DFSR, time synchronization, AD-integrated DNS, and FSMO roles; troubleshoot replication failures, latency, and lingering objects.
Plan and execute domain-controller installation, upgrade, demotion, and retirement, transitions to supported AD versions, and controlled schema extensions.
Process escalated account, group, and permission changes; troubleshoot authentication, authorization, policy, trust, and replication issues; improve identity-related Service Desk routing and knowledge content.
Provide advanced support during identity and authentication incidents; escalate widespread failures through incident-response procedures and support root-cause analysis and corrective actions.
Develop, maintain, and test AD backup, authoritative and non-authoritative restoration, deleted-object recovery, and forest-recovery procedures; support COOP and disaster-recovery exercises.
Support integration testing between AD and Okta or other approved identity platforms, validating synchronization, authentication flows, attribute and group mappings, provisioning, and SAML, OIDC, OAuth, SCIM, or LDAP protocols; document test results.
Automate approved directory administration, health validation, and reporting; review audit information; apply DISA STIGs and security baselines; and support RMF controls, POA&M activities, and remediation.
Maintain SOPs, recovery plans, configuration baselines, and directory diagrams; provide directory-service health, risk, and modernization information for program reporting.