Senior Active Directory Engineer – Mergers, Acquisitions & Divestitures

Cencora • Carrollton, PA

9d

About The Position

Cencora is seeking a Senior Active Directory Engineer to design and deliver identity workstreams for acquisitions and divestitures. The role assesses newly acquired environments and plans and executes the migration, consolidation, and coexistence of directory environments across multiple forests. It ensures connections between organizations are secure, auditable, and reversible, and delivers Day-1 readiness and longer-term identity consolidation in coordination with IT leadership, Security, Legal, and the Integration Management Office. The position also supports separations, including dependency mapping, entitlement cleanup, and identity support during Transition Service Agreements (TSAs).

This is a hands-on engineering role involving Active Directory discovery, security assessment, cross-forest design, migration execution, dependent-service migration or rebuild, and eventual forest and domain decommissioning. The engineer maintains integration runbooks and cutover documentation, provides Tier 3 support, partners with Security/SOC on monitoring and incident response, and mentors junior engineers. Occasional travel to acquired sites and on-call and weekend cutover work are expected during migrations.

Requirements

• At least 8 years of experience engineering enterprise Active Directory in multi-domain or multi-forest environments.
• Demonstrated M&A experience, including at least 2–3 completed acquisitions or mergers in which the candidate personally led or executed the identity workstream.
• Hands-on experience with AD migration tools such as Quest/Binary Tree On Demand Migration or Migration Manager, Microsoft ADMT, Microsoft Entra Connect/Cloud Sync, or equivalent third-party tools.
• Deep knowledge of trust types and cross-forest design, including selective authentication, SID filtering, SID history, and quarantine.
• Experience consolidating acquired forests into a single target forest, including inter-forest migrations of at least 1,000 users and source-forest decommissioning.
• Strong understanding of AD security, including tiered administration, PAM/PAW, LAPS, Kerberos/NTLM hardening, ADCS security, and AD attack and defense techniques.
• Strong working knowledge of DNS, DHCP, GPO, Sites & Services, replication, and PKI/ADCS.
• Advanced PowerShell scripting skills for automation, reporting, and bulk operations.
• Experience with hybrid identity, including Microsoft Entra ID, Entra Connect, tenant-to-tenant migration, and Conditional Access.
• Excellent communication skills, including the ability to explain risks and tradeoffs to executives, legal professionals, and non-technical stakeholders.
• On-call and weekend cutover work during migrations is expected.

Nice To Haves

• Divestiture experience.
• Experience with Microsoft 365 tenant-to-tenant migrations involving Exchange, Teams, and SharePoint/OneDrive.
• Familiarity with identity security tools such as Microsoft Defender for Identity, Semperis DSP, Tenable AD, PingCastle, or defensive use of BloodHound.
• Experience with federation and SSO, including AD FS, SAML, OIDC, Ping, or Okta, between organizations.
• Experience with Day-1/Day-100 integration planning and working alongside an IMO; exposure to TSAs.
• Exposure to PAM tools such as CyberArk, BeyondTrust, or Delinea and IGA tools such as SailPoint or Saviynt.
• Experience with ITIL or change management in regulated environments.
• Relevant certifications such as Microsoft AZ-500, SC-300, MS-102, CISSP, GIAC GCWN/GPPA, or similar.
• Bachelor's degree in IT or Computer Science, or equivalent experience.

Responsibilities

• Perform pre-close and post-close discovery and assessment of acquired environments, including forest and domain structure, trusts, GPOs, schema, DNS, PKI, service accounts, privileged access, and technical debt.
• Design acquired-forest consolidation paths, including temporary coexistence and trusts or federation for Day-1 needs; identify cases where consolidation is inadvisable.
• Plan and execute inter-forest migrations of users, groups, computers, and service accounts, including SID history, password migration or synchronization, workstation re-joins, profile migration, and phased resource-access cutover.
• Remediate and rationalize directory objects before migration, addressing naming collisions, UPN and email suffix conflicts, stale accounts, duplicate groups, and nested-group sprawl.
• Migrate or rebuild dependent services, including DNS zones, DHCP, file servers and shares, ACLs, ADCS/PKI, application service accounts, and LDAP/Kerberos-dependent applications.
• Deliver Day-1 capabilities such as cross-company email and calendar visibility, collaboration access, and SSO to shared applications.
• Execute long-term forest and domain consolidation and decommissioning, including SID history cleanup, GPO and naming standardization, and removal of legacy trusts, domain controllers, and stale objects.
• Coordinate tenant-to-tenant work with messaging and collaboration teams.
• Maintain and improve a repeatable acquisition integration playbook.
• Support divestitures through dependency mapping, entitlement cleanup, and TSA identity support; decommission shared trusts and synchronization connections at TSA exit.
• Assess acquired-environment security before connecting it, including AD health, privileged-account exposure, legacy protocols, and unpatched domain controllers.
• Design secure intercompany connectivity using selective-authentication trusts, network segmentation, tiered administration, and least-privilege access.
• Remediate common AD attack paths, including Kerberoasting, unconstrained delegation, AdminSDHolder abuse, weak ADCS templates, and excessive Domain Admin membership.
• Partner with Security/SOC on integration monitoring, logging, and incident response.
• Support applicable audit, compliance, and regulatory requirements, including SOX, HIPAA, PCI, and GDPR.
• Maintain runbooks, cutover and rollback plans, and post-migration validation checklists.
• Provide Tier 3 support for complex AD, DNS, DHCP, GPO, and PKI issues.
• Mentor junior engineers and contribute to standards and automation.

Benefits

• Medical, dental, and vision care.
• Benefits supporting working families, which may include backup dependent care, adoption assistance, infertility coverage, family-building support, behavioral health solutions, paid parental leave, and paid caregiver leave.
• Training programs and professional development resources.
• Mentorship programs, employee resource groups, and volunteer activities.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed