Active Directory / Identity Engineer (Senior)

DecisionPoint | Cortek•Chicago, IL

10h•Remote

About The Position

DecisionPoint seeks a senior Active Directory / Identity Engineer to own and sustain the Microsoft Active Directory Domain Services (AD DS) environment supporting the USMEPCOM ENLIST program. The role covers AD objects, organizational units, Group Policy Objects, trusts, replication, schema governance, delegated permissions, domain services, and recovery capabilities. The engineer ensures directory services remain secure, available, recoverable, and aligned with operational and cybersecurity requirements. The position provides direct, hands-on AD DS engineering, including domain and forest planning, account and group administration, site replication, trust relationships, Group Policy, domain-controller lifecycle activities, backup, restoration, and modernization. It also evaluates and tests approved Identity, Credential, and Access Management (ICAM) capabilities, including potential Okta integrations and other identity-modernization technologies, while retaining core AD DS expertise. The engineer works closely with cybersecurity, Service Desk, systems, cloud, network, application, COOP, and Government identity stakeholders. The position is remote, with Chicago-area candidates preferred. Occasional after-hours maintenance, incident response, COOP exercises, on-site support, or travel may be required. Applicants acknowledge and consent to having their resumes included in an active competitive government contract bid.

Requirements

Active Secret clearance or higher.
Bachelor’s degree in information technology, information systems, or a related field, or equivalent professional experience where permitted by the applicable labor category.
At least eight years of relevant experience in Active Directory engineering, identity engineering, Windows infrastructure, systems engineering, or a related technical discipline.
Direct, hands-on experience engineering and administering Microsoft Active Directory Domain Services in an enterprise environment.
Experience managing AD objects, organizational units, Group Policy Objects, trusts, replication, schemas, delegated permissions, and directory recovery.
Experience troubleshooting complex authentication, authorization, Group Policy, replication, trust, and directory-services issues.
Experience planning or supporting Active Directory backup, restoration, disaster recovery, or forest recovery.
Experience testing identity integrations or evaluating enterprise identity-modernization technologies.
Understanding of the distinction between core AD DS administration and external ICAM, federation, or cloud-identity services.
Knowledge of enterprise identity security, least privilege, delegated administration, account management, and access-control principles.
Ability to develop and maintain architecture diagrams, domain plans, OU plans, Group Policy documentation, trust diagrams, recovery procedures, and technical standards.
Ability to support after-hours maintenance, COOP exercises, disaster-recovery testing, and critical incident response when required.
Strong written, verbal, analytical, and technical problem-solving skills.
Enterprise Active Directory engineering and administration skills, including OU and Group Policy design, trust, replication, schema, and permissions management.
Directory backup, restoration, and forest-recovery capabilities.
Identity integration and modernization testing, and authentication and authorization troubleshooting skills.
Security-baseline and least-privilege implementation skills.
PowerShell and directory-administration automation skills.
COOP and disaster-recovery support, architecture and technical-documentation development, and cross-functional identity and infrastructure coordination skills.
Strong configuration discipline, attention to detail, and ability to retain deep AD DS expertise while evaluating modern ICAM capabilities.

Nice To Haves

Experience integrating Active Directory with Okta.
Experience with Microsoft Entra ID or hybrid identity.
Experience supporting federal or Department of Defense ICAM initiatives.
Experience with SAML, OpenID Connect, OAuth, SCIM, LDAP, Kerberos, NTLM, and federation technologies.
Experience with Active Directory Federation Services or comparable identity-provider technologies.
Experience with PowerShell scripting and directory-administration automation.
Microsoft identity, Windows Server, Azure, or security certification.
Okta Certified Administrator, Okta Certified Consultant, or comparable Okta certification.
CompTIA Security+, CISSP, or another relevant security certification.
Experience with CAC, PIV, certificate-based authentication, public key infrastructure, or DoD enterprise authentication.
Experience applying DISA Security Technical Implementation Guides to Active Directory and Windows infrastructure.
Experience supporting DoD Risk Management Framework controls and authorization activities.
Experience designing or testing identity capabilities aligned with Zero Trust principles.
Experience with Active Directory monitoring, privileged-access management, identity governance, or audit tools.
ITIL v4 Foundation certification.

Responsibilities

Serve as the senior technical owner for the USMEPCOM Active Directory Domain Services environment.
Install, configure, maintain, update, troubleshoot, and recover Active Directory services and supporting components.
Create, modify, disable, delete, and manage authorized AD objects, including organizational units, users, computers, groups, service accounts, shared resources, and other directory objects.
Maintain domain, OU, site, trust, and Group Policy plans and related architecture documentation.
Design and maintain OU structures and delegated permissions that support administration, policy application, security boundaries, and least-privilege management.
Review delegated access and correct excessive, obsolete, inherited, or conflicting permissions.
Develop, test, implement, maintain, and troubleshoot Group Policy Objects, including links, inheritance, precedence, security filtering, loopback processing, WMI filters, backups, version history, and recovery.
Evaluate proposed GPO changes for security, operational, and customer impact; identify and resolve conflicting, obsolete, duplicative, or ineffective settings.
Manage, configure, validate, monitor, and troubleshoot enterprise and external domain and forest trust relationships and their security settings.
Manage AD sites, subnets, site links, replication schedules, bridgehead behavior, and replication topology; troubleshoot replication failures, latency, lingering objects, inconsistencies, and topology problems.
Maintain domain-controller, directory database, SYSVOL, DFS Replication, time-synchronization, and AD-integrated DNS health; monitor FSMO roles and support approved transfer or seizure when necessary.
Plan and execute domain-controller installation, replacement, upgrade, demotion, and retirement; develop approved plans to transition Active Directory to supported versions.
Manage AD schema governance and evaluate tightly controlled schema extensions for compatibility, replication impact, risk, recovery requirements, and approvals.
Maintain directory schematics, architecture diagrams, object models, administrative boundaries, trust diagrams, and replication diagrams.
Administer account and group changes escalated through approved Service Desk and access-management processes; troubleshoot authentication, authorization, account, group-membership, policy, trust, replication, and directory-permission issues.
Coordinate with the Service Desk to improve identity-related ticket routing, troubleshooting, escalation, and knowledge content.
Provide advanced engineering support for identity, authentication, domain, and access-management incidents; identify widespread authentication failures and escalate them through approved procedures.
Support root-cause analysis and corrective-action development for recurring directory and identity incidents.
Develop, maintain, and test Active Directory backup, restoration, authoritative and non-authoritative recovery, deleted-object recovery, and forest-recovery procedures.
Support COOP exercises, disaster-recovery testing, recovery validation, and continuity events; document results, deficiencies, corrective actions, and lessons learned.
Evaluate and test approved ICAM and identity-modernization technologies, including integration testing between Active Directory and Okta or other Government-approved platforms.
Validate identity synchronization, account linking, authentication flows, group or attribute mappings, provisioning, access controls, and failure handling.
Support testing of approved federation and modern authentication protocols, including SAML, OpenID Connect, OAuth, SCIM, and LDAP or comparable technologies.
Coordinate identity-integration activities with cybersecurity, application owners, cloud and network teams, and Government identity authorities.
Develop test plans, test cases, expected results, rollback procedures, and validation evidence for identity integrations.
Assess modernization options and proposals for interoperability, security, operational support, lifecycle, resiliency, and mission impact while preserving required AD DS capabilities.
Automate approved directory administration, health validation, reporting, audit, and configuration activities where appropriate.
Review directory audit information and report activity outside approved baselines.
Support DISA Security Technical Implementation Guides, approved security baselines, vulnerability remediation, configuration findings, and policy-deficiency remediation.
Support Risk Management Framework controls, assessment evidence, Plan of Action and Milestones activities, and authorization documentation.
Follow approved incident, problem, change, configuration, access, release, security, and quality-management processes.
Maintain standard operating procedures, recovery plans, configuration baselines, change records, test results, and technical documentation.
Provide directory-service health, availability, capacity, risk, issue, modernization, and recovery information for program reporting.