AD, Azure AD and PKI Architect

We are seeking a skilled Active Directory (AD), Microsoft Entra ID (formerly Azure Active Directory), and Public Key Infrastructure (PKI) Architect to design, implement, operate, secure, and continuously improve our enterprise identity and certificate services. This role will own engineering activities across on-premises and cloud identity platforms, with a strong focus on availability, security, automation, governance, and a seamless user experience. The ideal candidate brings deep hands-on expertise in Windows Active Directory, Entra ID, hybrid identity, authentication and authorization protocols, certificate lifecycle management, and identity-related incident resolution. They will partner with infrastructure, security, application, endpoint, and service-management teams to deliver resilient, scalable identity services.

Responsibilities

Design, deploy, configure, and maintain enterprise Active Directory Domain Services, including forests, domains, sites, organizational units, trusts, DNS integration, Group Policy, replication, and domain controller lifecycle management; Engineer and support hybrid identity integration between on-premises AD and Microsoft Entra ID, including Microsoft Entra Connect Sync or Cloud Sync, password hash synchronization, pass-through authentication, federation where applicable, and seamless single sign-on; Administer and engineer Microsoft Entra ID capabilities, including users, groups, administrative roles, enterprise applications, app registrations, service principals, managed identities, and directory settings; Design and operate identity access patterns for cloud and hybrid applications using SSO, SAML, OAuth 2.0, OpenID Connect, SCIM provisioning, and modern authentication; Implement and maintain Conditional Access policies, multifactor authentication, passwordless authentication, authentication methods, self-service password reset, Identity Protection, and risk-based access controls; Support privileged identity management processes, role activation, access reviews, entitlement management, and least-privilege access models; Design, deploy, administer, and support enterprise PKI services, including Microsoft Active Directory Certificate Services (AD CS), certification authorities, certificate templates, enrollment policies, CRL and AIA distribution points, OCSP, and key archival/recovery where required; Manage the complete certificate lifecycle for internal and public certificates: request, issuance, renewal, revocation, discovery, inventory, monitoring, and retirement; Build and maintain automation using PowerShell, Microsoft Graph API, REST APIs, and other appropriate tooling for administration, reporting, provisioning, compliance checks, and operational tasks; Produce and maintain high-quality architecture diagrams, technical standards, runbooks, knowledge articles, implementation plans, and recovery procedures; Participate in on-call support, major incident response, change management, problem management, and post-incident reviews as required.

Requirements

Active Directory (AD DS): Multi-forest/multi-domain topologies, Group Policy Architecture, Trust relationships, Sites & Services, Kerberos/NTLM authentication flows, AD security hardening (Tiered Administration model); Microsoft Entra ID (Azure AD): Advanced Conditional Access, Entra Connect/Cloud Sync, Entra ID Protection, PIM, Workload Identities, B2B/B2C, Microsoft Graph; Keyfactor Ecosystem: Deep hands-on experience with Keyfactor Command, Orchestrators, Certificate Managers, Keyfactor API integration; PKI & Cryptography: Deep understanding of PKI principles, X.509 certificates, CRL/OCSP validation, CA hierarchy design, SSH key governance, HSM management; Automation & Scripting: Expert level in PowerShell, Python, or Bash, RESTful API integration for identity and PKI orchestration; Protocol Mastery: Deep knowledge of SAML, OAuth, OIDC, Kerberos, LDAP, SCEP, EST, ACME, TLS/SSL; Experience: 10+ years in Enterprise IAM/Infrastructure Engineering, at least 5+ years in dedicated Lead or Solution Architect capacity; Communication: Ability to articulate complex cryptographic and identity concepts to C-level executives, security teams, and application developers; Strategic Problem Solving: Proven track record of executing large-scale PKI transitions and AD/Entra ID modernizations in complex, global environments.

Nice to have

Keyfactor Certified Professional / Engineer; Microsoft Certified: Identity and Access Administrator Associate (SC-300); Microsoft Certified: Cybersecurity Architect Expert (SC-100); Azure Solutions Architect Expert (AZ-305); CISSP; CISM; Certified PKI Professional (CPKIP)

Benefits

Flexible Work (hybrid schedule); Freedom to create a flexible schedule; Opportunity to come together in offices for important moments