Active Directory / Identity Engineer (Senior)

DecisionPoint seeks an Active Directory / Identity Engineer to own and sustain the Microsoft Active Directory Domain Services environment supporting the USMEPCOM ENLIST program. This senior engineering position manages AD objects, organizational units, Group Policy Objects, trusts, replication, schema governance, delegated permissions, domain services, and recovery capabilities. 

The Active Directory / Identity Engineer ensures that directory services remain secure, available, recoverable, and aligned with USMEPCOM operational and cybersecurity requirements. The engineer supports domain and forest planning, account and group administration, site replication, trust relationships, Group Policy, domain-controller lifecycle activities, backup, restoration, and modernization. 

The position also evaluates and tests approved Identity, Credential, and Access Management capabilities, including potential Okta integrations and other identity-modernization technologies. These modernization activities complement—not replace—the position’s requirement for direct, hands-on AD DS engineering expertise. 

The engineer works closely with cybersecurity, Service Desk, systems, cloud, network, application, COOP, and Government identity stakeholders. This position is remote, with Chicago-area candidates preferred. Occasional after-hours maintenance, incident response, COOP exercises, on-site support, or travel may be required. 

Note: By applying to this position, you acknowledge and consent to having your resume included in an active competitive government contract bid.

The Active Directory / Identity Engineer will: 

• Serve as the senior technical owner for the USMEPCOM Active Directory Domain Services environment. 
• Install, configure, maintain, update, troubleshoot, and recover Active Directory services and supporting components. 
• Create, modify, disable, delete, and manage authorized AD objects in accordance with approved processes. 
• Manage organizational units, users, computers, groups, service accounts, shared resources, and other directory objects. 
• Maintain the domain plan, organizational-unit plan, site plan, trust plan, Group Policy design, and related architecture documentation. 
• Design and maintain an organizational-unit structure that supports administration, policy application, security boundaries, and delegated management. 
• Manage organizational-unit permissions and administrative delegation using least-privilege principles. 
• Review delegated access and correct excessive, obsolete, inherited, or conflicting permissions. 
• Develop, test, implement, maintain, and troubleshoot Group Policy Objects. 
• Manage GPO links, inheritance, precedence, security filtering, loopback processing, WMI filters, backups, version history, and recovery. 
• Evaluate proposed GPO changes for security, operational, and customer impact before production implementation. 
• Identify and resolve conflicting, obsolete, duplicative, or ineffective Group Policy settings. 
• Manage trust relationships with enterprise and external AD structures. 
• Configure, validate, monitor, and troubleshoot domain and forest trusts within approved security boundaries. 
• Review trust direction, transitivity, authentication scope, name-suffix routing, and related security settings. 
• Manage AD sites, subnets, site links, replication schedules, bridgehead behavior, and replication topology. 
• Monitor and troubleshoot replication latency, failures, lingering objects, directory inconsistencies, and site-topology problems. 
• Maintain the health of domain controllers, directory databases, SYSVOL, DFS Replication, time synchronization, and AD-integrated DNS dependencies. 
• Monitor Flexible Single Master Operations roles and support approved role transfer or seizure when necessary. 
• Plan and execute domain-controller installation, replacement, upgrade, demotion, and retirement activities. 
• Develop and implement approved plans to transition Active Directory to supported versions. 
• Manage AD schema governance and coordinate tightly controlled schema extensions. 
• Evaluate schema-change requests for compatibility, replication impact, operational risk, recovery requirements, and required approvals. 
• Maintain current directory schematics, architecture diagrams, object models, administrative boundaries, trust diagrams, and replication diagrams. 
• Administer account and group changes escalated from approved Service Desk and access-management processes. 
• Support troubleshooting of authentication, authorization, account, group-membership, policy, trust, replication, and directory-permission issues. 
• Coordinate with the Service Desk to improve identity-related ticket routing, troubleshooting, escalation, and knowledge content. 
• Provide advanced engineering support during identity, authentication, domain, and access-management incidents. 
• Identify widespread authentication failures or other outage signals and escalate them through approved incident-response procedures. 
• Support root-cause analysis and corrective-action development for recurring directory and identity incidents. 
• Develop and maintain Active Directory backup, restoration, and forest-recovery procedures. 
• Test system-state backups, directory restoration, authoritative and non-authoritative recovery, deleted-object recovery, and forest-recovery procedures. 
• Support COOP exercises, disaster-recovery testing, recovery validation, and actual continuity events. 
• Document recovery results, deficiencies, corrective actions, and lessons learned. 
• Evaluate and test approved ICAM and identity-modernization technologies. 
• Support integration testing between Active Directory and Okta or other Government-approved identity platforms. 
• Validate identity synchronization, account linking, authentication flows, group or attribute mappings, provisioning behavior, access controls, and failure handling. 
• Support testing of approved federation and modern authentication protocols such as SAML, OpenID Connect, OAuth, SCIM, LDAP, or comparable technologies. 
• Coordinate identity-integration activities with cybersecurity, application owners, cloud teams, network teams, and Government identity authorities. 
• Develop test plans, test cases, expected results, rollback procedures, and validation evidence for identity integrations. 
• Evaluate modernization options while preserving required AD DS authentication, authorization, Group Policy, trust, recovery, and administrative capabilities. 
• Assess modernization proposals for interoperability, security, operational support, lifecycle, resiliency, and mission impact. 
• Automate approved directory administration, health validation, reporting, audit, and configuration activities where appropriate. 
• Review directory audit information and report activity outside approved baselines. 
• Support enforcement of DISA Security Technical Implementation Guides and approved security baselines. 
• Monitor and remediate applicable directory-service vulnerabilities, configuration findings, and policy deficiencies. 
• Support Risk Management Framework controls, assessment evidence, Plan of Action and Milestones activities, and authorization documentation. 
• Follow approved incident, problem, change, configuration, access, release, security, and quality-management processes. 
• Maintain standard operating procedures, recovery plans, configuration baselines, change records, test results, and technical documentation. 
• Provide directory-service health, availability, capacity, risk, issue, modernization, and recovery information for program reporting.

Required Qualifications 

Candidates must meet all of the following requirements: 

• Active Secret clearance or higher. 
• Bachelor’s degree in information technology, information systems, or a related field, or equivalent professional experience where permitted by the applicable labor category. 
• Minimum of eight years of relevant experience in Active Directory engineering, identity engineering, Windows infrastructure, systems engineering, or a related technical discipline. 
• Direct, hands-on experience engineering and administering Microsoft Active Directory Domain Services in an enterprise environment. 
• Experience managing AD objects, organizational units, Group Policy Objects, trusts, replication, schemas, delegated permissions, and directory recovery. 
• Experience troubleshooting complex authentication, authorization, Group Policy, replication, trust, and directory-services issues. 
• Experience planning or supporting Active Directory backup, restoration, disaster recovery, or forest recovery. 
• Experience testing identity integrations or evaluating enterprise identity-modernization technologies. 
• Understanding of the distinction between core AD DS administration and external ICAM, federation, or cloud-identity services. 
• Knowledge of enterprise identity security, least privilege, delegated administration, account management, and access-control principles. 
• Ability to develop and maintain architecture diagrams, domain plans, OU plans, Group Policy documentation, trust diagrams, recovery procedures, and technical standards. 
• Ability to support after-hours maintenance, COOP exercises, disaster-recovery testing, and critical incident response when required. 
• Strong written, verbal, analytical, and technical problem-solving skills. 

Preferred Qualifications 

The following qualifications are preferred but are not required: 

• Experience integrating Active Directory with Okta. 
• Experience with Microsoft Entra ID or hybrid identity. 
• Experience supporting federal or Department of Defense ICAM initiatives. 
• Experience with SAML, OpenID Connect, OAuth, SCIM, LDAP, Kerberos, NTLM, and federation technologies. 
• Experience with Active Directory Federation Services or comparable identity-provider technologies. 
• Experience with PowerShell scripting and directory-administration automation. 
• Microsoft identity, Windows Server, Azure, or security certification. 
• Okta Certified Administrator, Okta Certified Consultant, or comparable Okta certification. 
• CompTIA Security+, CISSP, or another relevant security certification. 
• Experience with CAC, PIV, certificate-based authentication, public key infrastructure, or DoD enterprise authentication. 
• Experience applying DISA Security Technical Implementation Guides to Active Directory and Windows infrastructure. 
• Experience supporting DoD Risk Management Framework controls and authorization activities. 
• Experience designing or testing identity capabilities aligned with Zero Trust principles. 
• Experience with Active Directory monitoring, privileged-access management, identity governance, or audit tools. 
• ITIL v4 Foundation certification. 

Skills and Competencies 

• Enterprise Active Directory engineering and administration. 
• Organizational-unit and Group Policy design. 
• Trust, replication, schema, and permissions management. 
• Directory backup, restoration, and forest recovery. 
• Identity integration and modernization testing. 
• Authentication and authorization troubleshooting. 
• Security baseline and least-privilege implementation. 
• PowerShell and directory-administration automation. 
• COOP and disaster-recovery support. 
• Architecture and technical-documentation development. 
• Cross-functional identity and infrastructure coordination. 
• Strong configuration discipline and attention to detail. 
• Ability to retain deep AD DS expertise while evaluating modern ICAM capabilities.

• EEO and Affirmative Action Policy: DecisionPoint Corporation is an Equal Employment Opportunity and Affirmative Action employer. It is the policy of DecisionPoint Corporation to provide equal employment opportunity in accordance with all applicable Equal Employment Opportunity/Affirmative Action laws, directives and regulations to all employees and qualified applicants without regard to race, ethnicity, color, religion, national origin, sex, age, disability status, pregnancy, sexual orientation, gender identity, genetic information, protected veteran status, or any other protected status under Federal, State or Local laws.
• Pay Transparency Policy: In accordance with Presidential Executive Order 13665, DecisionPoint Corporation will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor's legal duty to furnish information.
• Authorization to Share Resume and Personal Information: By expressing your interest and submitting your resume for this position, you authorize DecisionPoint Corporation to share your resume, as well as personal information included on the resume, with its subsidiaries, affiliates and teaming partners for the purpose of considering you for this position and other available positions requiring comparable skills, education and experience. Should DecisionPoint Corporation. or its affiliates and teaming partners wish to initiate pre-employment discussions, you will be asked to complete an employment application and related employment documents.