Senior Identity Security Architect, Active Directory (Remote, Contract)

Stafford Gray • Minneapolis, MN

1d • Remote

About The Position

Stafford Gray is hiring several Senior Identity Security Architects on behalf of a global identity security consultancy. These are long-term, fully remote contract roles for experts who know Active Directory at a deep level and want to solve identity security problems for large enterprises. Occasional travel for client meetings may be required, typically a few times per year. The role focuses on hands-on architecture and remediation, not people management. Compensation is highly competitive and based on experience.

The position involves assessing and hardening enterprise Active Directory environments, securing hybrid identity between Active Directory and Microsoft Entra ID, and implementing protections to reduce privilege, credential theft exposure, and lateral movement risk. It also includes planning and testing forest recovery and ransomware resilience, and securing service accounts and other non-human identities.

Requirements

• Extensive hands-on experience securing Active Directory in large enterprise environments.
• Deep knowledge of ADCS, Kerberos, Tier 0 design, and privileged access.
• Experience with tools such as BloodHound, PingCastle, Purple Knight, Semperis, or Microsoft Defender for Identity.
• Strong experience with Microsoft Entra ID and hybrid identity.
• Ability to explain technical risk clearly to client stakeholders.

Nice To Haves

• Identity governance experience with SailPoint, Saviynt, or Entra ID Governance, including access reviews and joiner, mover, leaver automation.
• Experience with privileged access management tools such as CyberArk or BeyondTrust.
• Experience integrating identity telemetry with XDR or threat hunting.
• Certificate and cryptographic modernization or quantum readiness planning.
• Certifications such as SC-100, SC-300, CRTP, CRTE, OSCP, or CISSP.

Responsibilities

• Assess and harden enterprise Active Directory environments, including forests, trusts, Kerberos, Group Policy, permissions, and delegation.
• Secure Active Directory Certificate Services (ADCS) and remediate certificate-based attack paths.
• Design and implement Tier 0 protection, including administrative tiering, privileged access workstations, and least privilege.
• Identify and remediate attack paths, credential theft exposure, and lateral movement risk.
• Secure hybrid identity between Active Directory and Microsoft Entra ID, including strong authentication and Conditional Access.
• Implement Just-in-Time and Just-Enough Access to reduce standing privilege.
• Plan and test Active Directory forest recovery and ransomware resilience.
• Secure service accounts and other non-human identities.

What This Job Offers

• Career Level: Senior
• Education Level: No Education Listed