Role: Active Directory / Identity Specialist
Location: San Jose, CA (Onsite)
JD:
Key Responsibilities
Active Directory & Hybrid Identity
Design, deploy, and maintain AD DS forests, domains, trusts, sites, and replication topologies
Administer Group Policy, DNS, DHCP, DFS, and AD Certificate Services (PKI)
Implement and support Microsoft Entra ID, Entra Connect / Cloud Sync, and hybrid join
Lead AD consolidation, domain migrations, and cloud identity modernization projects
Identity & Access Management
Configure SSO, federation (ADFS, SAML, OIDC, OAuth 2.0), and MFA across enterprise applications
Implement Conditional Access, Privileged Identity Management (PIM), and least-privilege role models
Automate joiner / mover / leaver lifecycle processes and access reviews
Integrate identity platforms (Okta, Ping, SailPoint, CyberArk) with HR and ITSM systems
Security & Compliance
Harden AD against attack paths (tiered administration, LAPS, Kerberos, NTLM reduction)
Monitor and remediate identity threats using Defender for Identity, Entra ID Protection, and SIEM tooling
Support audit and compliance requirements (SOX, SOC 2, NIST, ISO 27001)
Perform health checks, risk assessments, and remediation planning
Operations & Delivery
Troubleshoot complex authentication, replication, and directory issues (Tier 3 escalation)
Automate administration with PowerShell and infrastructure-as-code
Produce architecture diagrams, runbooks, and knowledge transfer for client teams
Partner with clients, security, and application teams on requirements and delivery
Required Qualifications
5+ years of hands-on experience administering Active Directory in enterprise environments
Strong knowledge of AD DS, DNS, Group Policy, Kerberos, LDAP, and PKI
Experience with Microsoft Entra ID and hybrid identity (Entra Connect, SSO, MFA, Conditional Access)
Proficiency in PowerShell scripting and automation
Working knowledge of identity security concepts: least privilege, RBAC, privileged access, and zero trust
Experience with Windows Server 2016/2019/2022 and supporting large, multi-site environments
Ability to troubleshoot replication, authentication, and directory performance issues
Bachelor's degree in Computer Science, Information Technology, or equivalent practical experience
Preferred Qualifications and Certifications
Experience leading AD migrations, forest/domain restructures, or M&A identity integrations
Exposure to IGA / PAM platforms such as SailPoint, CyberArk, BeyondTrust, or Saviynt
Familiarity with Okta, Ping Identity, or other third-party IdPs
Experience with Microsoft Defender for Identity, Sentinel, or Splunk for identity monitoring
Knowledge of Azure / AWS identity services and infrastructure-as-code (Terraform, Bicep)
Prior consulting or client-facing delivery experience
| Certification | Priority |
| Microsoft Identity and Access Administrator (SC-300) | Preferred |
| Microsoft Azure Administrator (AZ-104) | Preferred |
| Microsoft Certified: Cybersecurity Architect Expert (SC-100) | Nice to have |
| CISSP or Security+ | Nice to have |
| Okta Certified Professional / Administrator | Nice to have |
Core Competencies
Clear written and verbal communication with technical and executive audiences
Structured problem solving under pressure, especially during outages and incidents
Ownership mindset and the ability to work independently across multiple client engagements
Strong documentation habits and a commitment to knowledge transfer
Security-first judgment and attention to detail when changing production identity systems
