Identity Engineer - Active Directory

Accountabilities • Administer and maintain Microsoft Active Directory Certificate Services (AD CS), including root and issuing certificate authorities, certificate templates, and enrollment policies.

• Manage the complete certificate lifecycle, including issuance, renewal, revocation through CRL/OCSP, and expiration monitoring for internal and public-facing systems.

• Maintain enterprise directory services, including Active Directory and LDAP, with responsibility for forest and domain architecture, replication health, Group Policy, organizational units, and schema management.

• Manage hybrid identity synchronization through Azure AD Connect or Microsoft Entra Connect, including synchronization rules, attribute flows, and troubleshooting failures.

• Support Microsoft Entra ID administration related to directory and certificate-based authentication, including certificate-based authentication, Conditional Access, and device trust.

• Configure and manage SSL/TLS certificate deployment for servers, applications, and network devices, ensuring correct certificate chain validation and trust store management.

• Troubleshoot complex directory and certificate connectivity issues involving DNS, Kerberos/NTLM, LDAPS binding, authentication, and certificate chain validation.

• Support authentication and authorization troubleshooting across Active Directory/LDAP, SAML, MFA, and SSO integrations.

• Develop and maintain PowerShell and Python scripts, using REST APIs where appropriate, to automate certificate management, directory reporting, and PKI health monitoring.

• Monitor and analyze directory, AD CS, and network logs, supporting SIEM integration, incident response, and proactive infrastructure monitoring.

• Apply identity and PKI security best practices while supporting compliance with SOX, PCI-DSS, NIST, and ISO 27001 requirements.

• Collaborate with Security, Infrastructure, and Application teams on certificate authority hierarchies, directory architecture changes, and migrations across enterprise and operating company environments.

• Maintain technical documentation, configuration records, and incident reports, while training end users and application teams on certificate requests and directory best practices.

• Plan and execute directory and PKI disaster recovery procedures, including certificate authority backup and restoration and Active Directory forest recovery readiness.

• Promote operational discipline, standardization, ownership, and continuous improvement to make identity management processes scalable, measurable, and repeatable.

Requirements:

• Bachelor's degree recommended; equivalent professional experience will also be considered.

• More than 10 years of experience in cybersecurity, systems administration, or identity and access management, including at least 5 years of hands-on experience administering AD CS and enterprise PKI.

• Strong understanding of PKI architecture, including root and issuing certificate authorities, certificate templates, CRL/OCSP, and cryptographic key management.

• Deep working knowledge of Active Directory and LDAP, including forest and domain design, replication, Group Policy, and schema administration.

• Practical experience with hybrid identity synchronization using Entra Connect or equivalent technologies, and Microsoft Entra ID, including Conditional Access and certificate-based authentication.

• Strong knowledge of DNS, Kerberos/NTLM authentication, and certificate chain troubleshooting across on-premises and cloud environments, including AWS, Azure, and GCP.

• Experience troubleshooting SAML, MFA, and SSO authentication and authorization issues related to directory services and certificate trust.

• Proficiency in PowerShell and Python scripting, with working knowledge of REST APIs and certificate automation tools.

• Experience with log analysis, SIEM integration, incident response, and root cause analysis in directory and PKI environments.

• Knowledge of security and compliance frameworks, including SOX, PCI-DSS, NIST, and ISO 27001, as well as Zero Trust security principles.

• Microsoft Certified: Identity and Access Administrator (SC-300) certification or equivalent preferred; additional cloud or security certifications such as AWS, Azure, GCP, CISSP, CISM, or Security+ are advantageous.

• Strong communication and technical documentation skills, including the ability to explain complex concepts to non-technical stakeholders and train end users and application teams.

• Ability to work effectively across enterprise and operating company environments, balancing global standards with local business requirements and collaborating across time zones and cultures.

• A proactive, collaborative mindset with a strong commitment to continuous improvement, transparency, accountability, and ownership.

Benefits:

• Full-time employment.

• Hybrid working arrangement in India.

• Opportunity to work on enterprise-scale identity, directory, and PKI infrastructure.

• Exposure to modern hybrid identity technologies and cloud environments.

• Collaboration with global Security, Infrastructure, and Application teams.

• Opportunities to contribute to enterprise security, operational improvements, and identity architecture initiatives.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1