Senior Active Directory Engineer – Mergers, Acquisitions & Divestitures

Cencora•Carrollton, TX

About The Position

The Senior Active Directory Engineer designs and builds identity workstreams for acquisitions and divestitures. The role assesses acquired environments and designs and executes directory migration, consolidation, and coexistence across multiple forests, ensuring connections between organizations are secure, auditable, and reversible. It is a hands-on position that works with IT leadership, Security, Legal, and the Integration Management Office to deliver Day-1 readiness and long-term identity consolidation, often on compressed timelines. The engineer supports acquisition integration, divestiture separation, security and risk assessment, and operational documentation. Work includes discovering and assessing directory environments; planning forest consolidation and inter-forest migrations; rationalizing identity objects; migrating or rebuilding dependent services; enabling Day-1 collaboration and application access; and decommissioning legacy forests and trusts. The role also supports TSA identity needs, security remediation, audit and compliance requirements, Tier 3 support, mentoring, and automation and standards.

Requirements

At least 8 years of experience engineering enterprise Active Directory in multi-domain or multi-forest environments.
Demonstrated M&A experience, including at least 2–3 completed acquisitions or mergers in which the candidate personally led or executed the identity workstream.
Hands-on experience with AD migration tools such as Quest/Binary Tree On Demand Migration or Migration Manager, Microsoft ADMT, Microsoft Entra Connect or Cloud Sync, or equivalent third-party tools.
Deep knowledge of trust types and cross-forest design, including selective authentication, SID filtering, SID history, and quarantine.
Proven experience consolidating acquired forests into a single target forest, including inter-forest migrations of at least 1,000 users and decommissioning the source forest.
Strong understanding of AD security, including tiered administration, PAM/PAW, LAPS, Kerberos/NTLM hardening, ADCS security, and AD attack and defense techniques.
Strong working knowledge of DNS, DHCP, GPO, Sites & Services, replication, and PKI/ADCS.
Advanced PowerShell scripting skills for automation, reporting, and bulk operations.
Experience with hybrid identity, including Microsoft Entra ID, Entra Connect, tenant-to-tenant migration, and Conditional Access.
Excellent communication skills and ability to explain risks and tradeoffs to executives, legal, and non-technical stakeholders.
Bachelor's degree in IT or Computer Science, or equivalent experience.

Nice To Haves

Divestiture experience.
Experience with tenant-to-tenant migrations in Microsoft 365, including Exchange, Teams, and SharePoint/OneDrive.
Familiarity with identity security tools such as Microsoft Defender for Identity, Semperis DSP, Tenable AD, PingCastle, and BloodHound for defensive use.
Experience with federation and SSO between organizations, including AD FS, SAML, OIDC, Ping, or Okta.
Experience with Day-1/Day-100 integration planning and working alongside an IMO; exposure to TSAs.
Exposure to PAM tools such as CyberArk, BeyondTrust, or Delinea and IGA tools such as SailPoint or Saviynt.
Experience with ITIL or change management in regulated environments.
Relevant certifications such as Microsoft AZ-500, SC-300, MS-102, CISSP, GIAC GCWN or GPPA, or similar.

Responsibilities

Perform pre-close and post-close discovery and assessment of acquired environments, including forest and domain structure, trusts, GPOs, schema, DNS, PKI, service accounts, privileged access, and technical debt.
Design forest-consolidation paths and temporary coexistence arrangements, and identify cases where consolidation is not advisable.
Plan and execute inter-forest migrations of users, groups, computers, and service accounts, including SID history, password migration or synchronization, workstation re-joins, profile migration, and phased resource-access cutover.
Remediate and rationalize acquired directory objects, including naming collisions, UPN or email suffix conflicts, stale accounts, duplicate groups, and nested-group sprawl.
Migrate or rebuild dependent services, including DNS zones, DHCP, file servers and shares and ACLs, ADCS/PKI, application service accounts, and LDAP- or Kerberos-dependent applications.
Deliver Day-1 capabilities such as cross-company email and calendar visibility, collaboration access, and SSO to shared applications.
Perform long-term forest and domain consolidation and decommissioning, including SID history cleanup, GPO and naming standardization, and removal of legacy trusts, domain controllers, and stale objects.
Coordinate tenant-to-tenant work with messaging and collaboration teams.
Maintain and improve a repeatable acquisition integration playbook.
Support divestitures through dependency mapping, entitlement cleanup, and identity support for Transition Service Agreements.
Decommission shared trusts and synchronization connections when TSAs end.
Assess acquired-environment security before establishing connections, including AD health, privileged-account exposure, legacy protocols, and unpatched domain controllers.
Design secure inter-company connectivity using selective-authentication trusts, network segmentation, tiered administration, and least-privilege access.
Remediate common Active Directory attack paths, including Kerberoasting, unconstrained delegation, AdminSDHolder abuse, weak ADCS templates, and excessive Domain Admin membership.
Partner with Security and the SOC on integration monitoring, logging, and incident response.
Support applicable audit, compliance, and regulatory requirements, including SOX, HIPAA, PCI, and GDPR.
Maintain runbooks, cutover and rollback plans, and post-migration validation checklists.
Provide Tier 3 support for complex AD, DNS, DHCP, GPO, and PKI issues.
Mentor junior engineers and contribute to standards and automation.