Active Directory / Identity Engineer (Journeyman)

DecisionPoint | Cortek•Chicago, IL

10h•Remote

About The Position

DecisionPoint seeks an Active Directory / Identity Engineer to administer, sustain, secure, and recover the Microsoft Active Directory Domain Services environment supporting the USMEPCOM ENLIST program. The role manages AD objects, organizational units, Group Policy Objects, trusts, replication, schema changes, delegated permissions, domain services, and recovery capabilities. It provides hands-on AD DS support while assisting with approved Identity, Credential, and Access Management initiatives and testing potential Okta integrations and other identity-modernization technologies. The engineer works closely with the Senior AD/Identity Engineer, cybersecurity personnel, Service Desk, systems administrators, cloud and application teams, COOP personnel, and Government identity stakeholders. The position supports routine directory administration, complex troubleshooting, modernization testing, disaster recovery, and critical incident response. It is remote, with Chicago-area candidates preferred. Occasional after-hours maintenance, COOP exercises, incident response, on-site support, or travel may be required. By applying, candidates acknowledge and consent to having their resume included in an active competitive government contract bid.

Requirements

Active Secret clearance or higher.
Bachelor’s degree in information technology, information systems, or a related field, or equivalent professional experience where permitted by the applicable labor category.
Minimum of six years of relevant experience in Active Directory administration, identity engineering, Windows infrastructure, systems engineering, or a related technical discipline.
Direct, hands-on experience administering Microsoft Active Directory Domain Services in an enterprise environment.
Experience managing AD objects, organizational units, Group Policy Objects, trusts, replication, schemas, delegated permissions, and directory recovery.
Experience troubleshooting authentication, authorization, Group Policy, replication, trust, and directory-services issues.
Experience supporting Active Directory backup, restoration, disaster recovery, or deleted-object recovery.
Experience testing identity integrations or supporting enterprise identity-modernization activities.
Understanding of the distinction between core AD DS responsibilities and external ICAM, federation, or cloud-identity services.
Knowledge of enterprise identity security, least privilege, delegated administration, account management, and access-control principles.
Ability to maintain architecture diagrams, domain and OU documentation, Group Policy records, recovery procedures, and technical standards.
Ability to support after-hours maintenance, COOP exercises, disaster-recovery testing, and critical incidents when required.
Strong written, verbal, analytical, and technical problem-solving skills.

Nice To Haves

Experience integrating Active Directory with Okta.
Experience with Microsoft Entra ID or hybrid identity.
Experience supporting federal or Department of Defense identity environments.
Experience with SAML, OpenID Connect, OAuth, SCIM, LDAP, Kerberos, NTLM, or federation technologies.
Experience with Active Directory Federation Services or comparable identity-provider technology.
Experience using PowerShell for Active Directory administration, reporting, or automation.
Microsoft identity, Windows Server, Azure, or security certification.
Okta Certified Administrator or comparable Okta certification.
CompTIA Security+ or another relevant security certification.
Experience with CAC, PIV, certificate-based authentication, public key infrastructure, or DoD enterprise authentication.
Experience applying DISA Security Technical Implementation Guides to Active Directory or Windows infrastructure.
Experience supporting Risk Management Framework controls and authorization activities.
Familiarity with Zero Trust identity principles.
Experience using Active Directory monitoring, privileged-access, identity-governance, or audit tools.
ITIL v4 Foundation certification.

Responsibilities

Administer, maintain, update, troubleshoot, and recover Microsoft Active Directory Domain Services, including authorized directory objects, users, computers, groups, service accounts, organizational units, and shared resources.
Maintain domain, organizational-unit, site, trust, Group Policy, administrative-design, architecture, replication, and object-management documentation.
Implement approved OU structures, manage OU-level permissions and delegated administrative access using least-privilege principles, and review delegated permissions for excessive, obsolete, inherited, or conflicting access.
Develop, test, deploy, maintain, and troubleshoot Group Policy Objects; manage links, inheritance, precedence, security and WMI filtering, backups, and recovery; and assess proposed changes before production deployment.
Maintain trusted relationships with enterprise and authorized external AD structures; configure, validate, monitor, and troubleshoot domain and forest trusts and related settings.
Maintain AD sites, subnets, site links, replication schedules, and topology; monitor and troubleshoot replication failures, latency, lingering objects, directory inconsistencies, and topology problems.
Support domain-controller health and availability, directory databases, SYSVOL, DFS Replication, time synchronization, AD-integrated DNS dependencies, and Flexible Single Master Operations roles.
Support domain-controller installation, configuration, replacement, upgrade, demotion, and retirement, as well as transitions to supported Active Directory versions.
Support controlled AD schema updates and approved extensions, assessing compatibility, replication impact, operational risk, and recovery requirements.
Process or support approved account, group, permission, and OU changes escalated through Service Desk and access-management processes.
Troubleshoot authentication, authorization, account, group-membership, policy, trust, replication, and directory-permission issues; coordinate with Service Desk to improve troubleshooting, ticket routing, escalation, and knowledge content.
Provide advanced support during identity, authentication, domain, and access-management incidents; recognize widespread authentication failures, escalate potential outages, collect evidence for root-cause analysis, and implement approved corrective and preventive actions.
Maintain and execute AD backup and restoration procedures, including testing system-state backups, deleted-object recovery, authoritative and non-authoritative restoration, and forest-recovery procedures.
Support COOP exercises, disaster-recovery tests, recovery validation, and continuity events; document results, deficiencies, corrective actions, and lessons learned.
Support approved ICAM and identity-modernization testing, including AD integration with Okta or other Government-approved platforms; validate synchronization, authentication flows, mappings, account linking, provisioning, access controls, and error handling.
Support testing of approved federation and modern authentication protocols, develop test cases and rollback and validation procedures, document findings, and coordinate with cybersecurity, application, cloud, network, and Government identity stakeholders.
Evaluate identity-modernization capabilities while preserving required AD DS authentication, authorization, Group Policy, trust, recovery, and administrative functions.
Automate approved AD administration, health validation, reporting, and audit activities where appropriate; review directory audit information and report activity outside approved baselines.
Apply approved AD security baselines and DISA Security Technical Implementation Guides; support vulnerability remediation, Risk Management Framework controls, evidence collection, assessments, and corrective actions.
Follow approved incident, problem, change, configuration, access, release, security, and quality-management processes.
Maintain standard operating procedures, recovery plans, test results, change records, configuration baselines, and technical documentation, and provide directory-service health, risk, issue, recovery, and modernization information for program reporting.