Principal Security Architect, Active Directory & Entra ID Backup and Recovery

AvePoint•Jersey City, NJ

2d•$180,000 - $270,000

About The Position

The Principal Architect for Active Directory & Entra ID Backup and Recovery will be the foundational technical leader for AvePoint’s hybrid identity resilience strategy. This hands-on, deeply technical architecture role defines backup, restore, rollback, and disaster recovery capabilities for Active Directory (AD), Microsoft Entra ID, and hybrid AD/Entra environments. It covers how identity state is captured and protected, how objects and attributes are restored, how hybrid source-of-authority rules are handled, and how the product supports complex enterprise directory topologies. The position is centered on backup and recovery architecture rather than primary ownership of AD/Entra threat detection, alert rules, SIEM content, or incident response strategy. The architect will partner with a separate security-focused role while guiding product and engineering teams, prototyping high-risk technical areas, validating designs with customers and partners, and mentoring engineers and architects. The role calls for someone who can combine deep knowledge of AD recovery with the product engineering tradeoffs involved in delivering a scalable SaaS backup and recovery platform. AvePoint describes itself as a global data security, governance, and resilience company serving more than 25,000 customers worldwide, with a global channel partner program of approximately 5,000 organizations and solutions available in more than 100 cloud marketplaces. The stated base salary range is $180,000–$270,000; the posting notes that final offers depend on location, experience, skills, and qualifications. Total rewards include medical, dental, and vision benefits, a 401(k) with match, unlimited PTO, and, depending on the role, bonuses, commissions, or equity (RSUs).

Requirements

Bachelor’s degree in Computer Science, Engineering, Information Systems, or a related technical field; equivalent practical experience is strongly considered.
12+ years of hands-on technical experience in identity infrastructure, directory services, infrastructure recovery, or enterprise systems engineering.
8+ years of deep Active Directory architecture experience, including design, operations, troubleshooting, migration, or recovery of enterprise AD environments.
Direct experience with Active Directory backup, restore, object rollback, domain controller recovery, forest recovery, or directory-service disaster recovery.
Strong understanding of AD internals, including domain controllers, NTDS.dit, System State, VSS, FSMO roles, RID pools, DSRM, AD-integrated DNS, SYSVOL/DFSR, Group Policy, tombstone/deleted-object lifecycle, Global Catalog, sites/services, replication, and trusts.
Hands-on experience with complex AD topologies, such as multi-domain forests, multiple forests, forest trusts, account/resource forest models, mergers and acquisitions, or regulated/segmented directory environments.
Deep working knowledge of Microsoft Entra ID and hybrid identity, including Entra Connect/Cloud Sync, sourceAnchor/ImmutableID, hard-match/soft-match behavior, Microsoft Graph, administrative units, Conditional Access dependencies, and cloud-only versus synced object behavior.
Experience designing or operating backup and recovery workflows with RPO/RTO considerations, recovery point selection, validation, restore ordering, auditability, and customer-facing operational simplicity.
Ability to translate low-level directory behavior into product architecture that distributed engineering teams can implement and that product, support, sales engineering, and executive stakeholders can understand.
Strong scripting and automation experience, especially with PowerShell, LDAP tooling, Microsoft Graph, Windows Server administration, and lab automation.
Demonstrated track record of designing and shipping deeply technical infrastructure, identity, or data protection products at scale.
Outstanding written and verbal communication skills, including the ability to explain AD and hybrid identity recovery tradeoffs to technical teams, executives, and customers.

Nice To Haves

Experience at an AD/Entra backup or recovery vendor is strongly preferred.
Direct experience at, or deep familiarity with, vendors such as Quest, Semperis, Cayosoft, Netwrix, Commvault, Rubrik, Druva, Veeam, Microsoft, or similar identity/data protection vendors.
Experience with AD migrations, tenant-to-tenant migrations, Entra ID backup/recovery, Okta/AD integration, or hybrid identity modernization.
Microsoft MVP recognition, Microsoft identity certifications, or public technical speaking/writing history in AD, Entra ID, or directory services.

Responsibilities

Own the end-to-end technical architecture for Active Directory and Microsoft Entra ID backup, restore, rollback, and disaster recovery capabilities.
Define protection architecture for AD objects, attributes, group memberships, OUs, GPOs, DNS-related state, SYSVOL, domain controllers, forest metadata, trust relationships, and other recovery-critical directory components.
Design object-, attribute-, group membership-, OU-, GPO-, domain controller-, and forest-level restore workflows, including sequencing, validation, retry, and rollback behavior.
Architect product support for enterprise AD topologies, including single- and multi-domain forests, multiple forests, account/resource forests, forest trusts, and hybrid AD-to-Entra scenarios.
Design AD collection and backup models, including full-state snapshots, incremental change capture, LDAP/DirSync or equivalent mechanisms, event correlation where useful, system state/VSS considerations, and recovery metadata.
Define source-of-authority behavior for AD-synced and cloud-only objects, including Entra Connect/Cloud Sync, sourceAnchor/ImmutableID mapping, hard-match and soft-match considerations, and recovery sequencing when AD is authoritative.
Extend AvePoint’s Entra ID protection strategy into a coherent hybrid recovery architecture that determines which objects and settings should be restored in AD first, Entra first, or only in the cloud.
Partner with Product Management to define MVP scope, phased delivery, technical tradeoffs, topology coverage, and acceptance criteria for AD and hybrid identity recovery.
Partner with Engineering to develop architecture documents, data models, sequence diagrams, technical specifications, API expectations, lab plans, validation criteria, and reference implementations.
Prototype high-risk technical areas, such as AD state capture, object/attribute rollback, source-of-authority resolution, Entra Connect re-link validation, and forest recovery orchestration.
Define lab environments and test scenarios reflecting customer complexity, including multi-domain forests, multi-forest trusts, hybrid Entra Connect environments, deleted-object recovery, and recovery after failed or partial restores.
Guide engineering decisions on backup consistency, restore ordering, data retention, metadata, recovery point selection, validation checks, and operational reliability.
Collaborate with an AD/Entra security architect on privileged access, secure credential handling, identity attack scenarios, and ITDR signal integration while keeping this role focused on recovery architecture.
Serve as senior technical reviewer for AD and hybrid identity design decisions, ensuring the product is technically correct, scalable, supportable, and aligned with enterprise environments.
Work with customers, partners, field engineers, and support teams to validate architecture against real-world AD and hybrid identity deployments.
Mentor engineers and architects on AD recovery, hybrid identity behavior, and enterprise directory services operations.