IAM Active Directory Consultant

We are seeking an experienced Active Directory (AD) and Tier-0 (T0) Infrastructure Automation Engineer to design, secure, automate, and modernize enterprise authentication platforms. This role will focus on Tier-0 security hardening, identity infrastructure resilience, and building automation + AI-assisted operations to improve reliability, reduce manual effort, and accelerate incident responsewhile maintaining strict security boundaries for privileged environments.

Key Responsibilities:

Active Directory & Tier-0 Engineering:

• Own and improve Tier-0 identity infrastructure: AD DS forests/domains, domain controllers, DNS, PKI dependencies, ADFS (if applicable), and privileged access pathways.
• Implement and maintain Tier-0 hardening controls: secure admin tiers, PAW/SAW strategies, GPO baselines, authentication policies, and privileged group governance.
• Design and execute AD modernization initiatives: domain restructuring, consolidation/separation, trust management, and authentication redesign.
• Ensure business continuity for identity platforms: backup/restore drills, authoritative restores, DC recovery, tombstone/lingering object prevention, and disaster recovery readiness.
• Perform risk assessments and remediation for Tier-0 exposures: delegation risks, unconstrained delegation, weak ACLs, stale privileged accounts, and legacy auth protocols.

Automation (IaC / Self-Healing / Runbooks)

Build automation for AD operations using PowerShell / Python, including:

• User/Group/OU lifecycle workflows
• GPO deployment validation
• DC health monitoring & auto-remediation
• DNS and replication check

AD object hygiene and privileged group reviews

• Implement Infrastructure-as-Code patterns where applicable (e.g., automation pipelines, configuration baselines, golden templates).
• Develop self-service enablement with guardrails (approval workflows, audit trails, rollback).

AI Integrations (Operations & Security Use Cases)

Integrate AI-assisted workflows into identity operations (within compliance boundaries), such as:

• Incident triage copilots: summarize logs/events and suggest next steps
• Root cause assistance: pattern recognition across DC logs, replication events, authentication failures
• Runbook recommendation: map incidents to approved remediation playbooks
• Knowledge mining: convert tribal knowledge into searchable internal guidance (KB automation)

Create safe AI guardrails for Tier-0 environments:

• Ensure data classification and redaction policies are enforced
• Prevent privileged secrets leakage (tokens, passwords, keys)
• Maintain auditability and approval gates for all actions suggested/executed

Monitoring, Logging & Compliance

• Own logging pipelines for identity platforms using tools like Microsoft Sentinel / Splunk / ELK / Log Analytics.
• Create dashboards and alerts for AD health, authentication anomalies, replication issues, privileged access abuse signals.
• Support audits (SOX/ISO/IEC/industry compliance): evidence collection, control mapping, and remediation tracking.

Collaboration & Stakeholder Management

• Work closely with cybersecurity, IAM, networking, endpoint engineering, and GRC teams.
• Provide clear technical documentation, runbooks, architecture diagrams, and executive summaries.
• Participate in on-call/major incident bridge support for Tier-0 services (as needed).

Required Qualifications:

• 5+ years experience in Active Directory engineering/operations in large enterprise environments.
• Strong hands-on expertise in:
• AD DS, Domain Controllers, Sites & Services, DNS, Kerberos/NTLM, trusts
• Tier-0 security concepts, privileged admin models, GPO security baselines
• Troubleshooting AD replication, authentication failures, and DC recovery

Proven automation skills:

• PowerShell (advanced), scripting standards, modules, CI/CD integration
• Familiarity with Python is a plus
• Experience with security monitoring/identity analytics and log analysis.

Key Skills:

AD DS | Tier-0 Security | PowerShell Automation | GPO | DNS | Kerberos | DR/BCP | Monitoring & SIEM | PAM | Hybrid Identity | AI-assisted Ops | Runbooks