Lead Identity Infrastructure Engineer
About The Position
Lincoln Financial is hiring a Lead Identity Infrastructure Engineer to design, manage, secure, monitor, and support enterprise identity infrastructure, with a primary focus on Active Directory, Public Key Infrastructure (PKI), Microsoft Entra ID application registrations, and related Domain Services technologies. The role covers Active Directory architecture and lifecycle management; forest, domain, and trust administration; Certificate Services and Keyfactor integrations; operational monitoring and alerting; resilience, recovery, and security hardening; and guidance on Entra ID application registrations and authentication strategies. The engineer partners with Security, Enterprise Architecture, infrastructure teams, application owners, and Managed Service Providers to deliver compliant, resilient, and supportable authentication and directory solutions. The role also supports automation, high-severity incident resolution, modern authentication patterns such as SAML and OAuth, and secure support for legacy authentication when required. The position is hybrid, with three days per week in a Lincoln office, at one of the listed alternate locations: Greensboro, NC; Charlotte, NC; Fort Wayne, IN; or Radnor, PA. Relocation assistance is not available.
Requirements
- At least 5 years of experience managing and supporting enterprise identity services, with hands-on experience in Active Directory, PKI, and Entra ID application registrations.
- Advanced knowledge of Active Directory architecture, including forests, domains, trusts, organizational units, replication, sites and services, DNS dependencies, and Group Policy.
- Advanced experience with enterprise PKI, including Certificate Services, certificate templates, enrollment workflows, certificate lifecycle management, and Keyfactor or comparable platforms.
- Deep experience and understanding of Microsoft Entra ID application registrations, Enterprise Applications, Entra ID Connect, and Microsoft Graph APIs.
- Strong troubleshooting skills across Active Directory, LDAP, Kerberos, NTLM, DNS, Windows Server, certificates, and authentication-related issues.
- Expert knowledge of legacy and modern directory and authentication protocols, including LDAP, Kerberos, NTLM, SAML, OAuth, and OpenID Connect.
- Proficiency in scripting and automation using PowerShell and Microsoft Graph.
- Proven experience with Active Directory security hardening, role-based access control, privileged access, forest and domain trust management, and secure administration practices.
- In-depth experience with Active Directory disaster recovery, recovery testing, and operational resilience planning.
- Experience designing and operating monitoring, alerting, and health validation for directory, authentication, and PKI services.
- A four-year/bachelor’s degree or equivalent work experience; four years of experience may substitute for a bachelor’s degree.
Nice To Haves
- Splunk search and dashboard experience is preferred.
- Working knowledge of PowerShell Desired State Configuration (DSC) and GitLab for infrastructure configuration, source control, and automation.
- Ability to collaborate with Agile teams and use Jira and Confluence to track engineering work and maintain technical documentation.
Responsibilities
- Serve as a technical expert for the architecture, engineering, administration, and operational health of enterprise Active Directory and Domain Services.
- Provide subject matter expertise and strategic recommendations for projects involving Active Directory and Microsoft Entra ID application registrations, covering legacy and modern authentication methods.
- Manage enterprise PKI, including Keyfactor PKIaaS, certificate templates, enrollment services, certificate lifecycle processes, and Keyfactor integrations.
- Identify automation, continuous improvement, and modernization opportunities to enhance the Domain Services service portfolio.
- Design, manage, and secure Active Directory forests, domains, trusts, sites and services, replication, DNS dependencies, and domain controller lifecycle activities.
- Build and improve monitoring, alerting, health checks, and operational dashboards for Active Directory, authentication services, and PKI, using tools such as Splunk and enterprise monitoring platforms.
- Contribute to Active Directory security hardening, identity threat detection and response, privileged access controls, disaster recovery planning, and recovery exercises.
- Lead troubleshooting and resolution of complex, high-severity Active Directory, Entra ID authentication, and PKI incidents; perform root cause analysis and define corrective actions.
- Use working knowledge of PowerShell Desired State Configuration (DSC) and GitLab for infrastructure configuration, source control, and automation.
- Work with Security and Enterprise Architecture to design compliant, resilient, and supportable identity solutions.
- Develop and implement PowerShell-based automation to improve security, consistency, monitoring, and operational efficiency.
- Partner with and guide cross-functional teams, application owners, and Managed Service Providers to integrate and support authentication and directory services.
- Provide advanced support for Microsoft Entra application registrations, enterprise applications, OAuth, OpenID Connect, and SAML integrations as needed.
- Create and maintain architecture, operational, and recovery documentation, and share knowledge with the team.
- Build and present engineered solutions to Architecture and Peer Review Boards.
Benefits
- PTO and parental leave
- Competitive 401(k) and employee benefits
- Free financial counseling, health coaching, and employee assistance program
- Tuition assistance program
- Leadership development and virtual training opportunities
- Clearly defined career tracks and job levels
- Work arrangements that work for you
- Productivity and technology tools and training
- The role may be eligible for the discretionary Annual Incentive Program; other rewards may include long-term incentives and sales incentives
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
