Senior Security Identity Engineer - (MS AD/EntraID)

Our client is seeking an experienced Security Identity Engineer to identify, prioritise and remediate security vulnerabilities and control weaknesses across Microsoft Active Directory (AD) and Microsoft Entra ID. The engineer will use recognised identity-security assessment tools, including Purple Knight, PingCastle, Forest Druid and Microsoft Defender for Identity recommendations, to assess the current security posture, validate findings and deliver remediation across the hybrid identity estate. The role will focus on reducing identity-related risk, strengthening security controls and providing clear evidence that remediation has been completed or that residual risks have been formally recorded and accepted.

Key responsibilities

Identity-security assessment and vulnerability discovery

Conduct regular security assessments of Active Directory and Microsoft Entra ID. Run, interpret and report on findings from: Purple Knight. PingCastle. Forest Druid. Microsoft Defender for Identity recommendations. Microsoft Entra recommendations and Secure Score. Vulnerability scanners and other approved security-assessment tools. Validate assessment findings and remove false positives. Correlate findings across tools to identify common root causes and attack paths. Assess the security posture of: AD domains, forests and trusts. Domain controllers and member servers. Privileged and administrative accounts. Service accounts and managed service accounts. Group Policy and delegated permissions. Microsoft Entra roles, applications and service principals. Hybrid identity synchronisation components. Produce a prioritised identity-vulnerability and remediation register. Map findings to agreed security standards, control objectives and risk categories. Provide clear reporting to technical teams, project governance and risk owners.

Active Directory remediation

Remediate security weaknesses identified through Purple Knight, PingCastle, Forest Druid, Defender for Identity and other approved assessments. Review and improve: Privileged-group membership. Domain and enterprise administrator access. Administrative delegation. Group Policy configuration. Service accounts and managed service accounts. Kerberos security settings. LDAP signing and channel binding. NTLM usage. Unconstrained and constrained delegation. Kerberoasting and credential-exposure risks. Stale, inactive and unmanaged accounts. Domain-controller security configuration. Replication and trust relationships. Administrative tiering and privileged-access boundaries. Investigate and remediate identity attack paths identified through assessment tooling. Support hardening of domain controllers and associated infrastructure. Validate that changes have removed or reduced the relevant security finding. Record exceptions where remediation cannot be completed and ensure they are risk-assessed.

Microsoft Entra ID remediation

Review and remediate Microsoft Entra ID security recommendations and configuration weaknesses. Improve controls relating to: Privileged roles and role assignments. Privileged Identity Management. Conditional Access. Multi-factor authentication. Risk-based sign-in and user-risk policies. Legacy authentication. Guest and external-user access. Application registrations and consent. Enterprise applications and service principals. Managed identities. Authentication methods. Emergency-access or break-glass accounts. Access reviews and entitlement governance. Secure administrative access. Review and reduce excessive permissions granted to applications and service principals. Identify and remediate stale certificates, secrets and credentials. Review Microsoft Graph permissions and administrative consent. Implement or improve monitoring for suspicious authentication and privilege activity. Validate remediation against Microsoft Entra recommendations, Secure Score and agreed security standards.

Tooling and assessment responsibilities The engineer will be expected to:

Install, configure or execute Purple Knight assessments in accordance with approved security and access requirements. Run PingCastle health checks and security assessments across relevant AD environments. Use Forest Druid to assess forest configuration, trust relationships, attack paths and identity-security risks. Review and action Microsoft Defender for Identity recommendations, exposure findings, identity alerts and secure-score improvements. Maintain controlled and repeatable assessment procedures. Protect assessment outputs, which may contain sensitive identity and infrastructure information. Compare results over time to demonstrate improvements in the security posture. Ensure tools are used in accordance with licensing, security, privacy and change-management requirements. Document tool versions, assessment dates, scope, assumptions and limitations. Avoid treating automated tool output as evidence of a vulnerability without appropriate technical validation.

Vulnerability remediation delivery

Prioritise remediation according to severity, exploitability, exposure, business criticality and programme objectives. Develop technical remediation plans, implementation procedures and rollback plans. Coordinate testing with infrastructure, application, endpoint, cloud and service owners. Implement changes through approved change-management processes. Validate remediation through repeat assessments and technical testing. Maintain evidence of: The original finding. The agreed remediation. Testing and approvals. The implemented change. Post-remediation validation. Track residual risks, accepted exceptions and dependencies. Escalate risks that cannot be remediated within agreed timescales.

Engineering and automation

Develop PowerShell scripts and automation to support identity assessment, remediation and reporting. Use Microsoft Graph and approved APIs to assess and manage Entra ID configuration. Automate checks for privileged access, stale accounts, risky configurations and policy compliance where appropriate. Create repeatable reporting from Purple Knight, PingCastle, Forest Druid and Defender for Identity outputs. Ensure scripts and automation are tested, documented, access-controlled and reviewed before production use.

Operational transition

Produce technical documentation, configuration records and operational runbooks. Provide knowledge transfer to internal identity and infrastructure teams. Define repeatable assessment schedules and ownership for ongoing reviews. Establish processes for reviewing Purple Knight, PingCastle, Forest Druid and Defender for Identity results. Support transition of remediation controls into business-as-usual operations. Contribute to post-remediation reporting, lessons learned and continuous improvement.

Essential experience and skills

Strong hands-on experience securing Microsoft Active Directory. Strong hands-on experience securing Microsoft Entra ID. Demonstrable experience delivering identity vulnerability-remediation programmes. Practical experience using: Purple Knight. PingCastle. Forest Druid. Microsoft Defender for Identity. Ability to interpret and remediate findings from these tools rather than simply producing assessment reports. Deep understanding of: AD domains, forests, trusts and replication. Group Policy. Kerberos and NTLM. LDAP. Privileged access management. Service accounts and managed service accounts. Delegation and access control lists. Microsoft Entra roles and permissions., Expected deliverables The engineer will be expected to contribute to or own:

Purple Knight assessment reports and remediation plans. PingCastle assessment reports and remediation plans. Forest Druid assessment outputs and remediation actions. Microsoft Defender for Identity recommendation reviews and remediation evidence. Microsoft Entra ID security-recommendation reviews. Validated identity-vulnerability and control-gap registers. Prioritised remediation plans. Active Directory hardening and privileged-access improvements. Entra ID configuration and access-control remediation. PowerShell and Microsoft Graph automation. Test and validation evidence. Exception and residual-risk records. Security and audit evidence. Operational runbooks and configuration documentation. Knowledge-transfer materials. Post-remediation reports demonstrating measurable improvement.

Measures of success Success will be measured by:

Reduction in validated high- and critical-risk findings from Purple Knight, PingCastle, Forest Druid and Defender for Identity. Reduction in Microsoft Entra ID security recommendations and material Secure Score gaps. Reduction in excessive privilege and unmanaged administrative access. Improved protection of privileged and emergency-access accounts. Reduction in legacy authentication and insecure protocols. Improved control of service principals, application permissions, credentials and secrets. Timely completion of agreed remediation milestones. Successful validation of remediation through repeat assessments. Quality and completeness of evidence supporting closure. Effective transition of ongoing assessment and remediation activities into business-as-usual operations.

Important control requirements The successful candidate must:

Follow approved access-control, security and change-management procedures. Use appropriately controlled administrative accounts. Treat Purple Knight, PingCastle, Forest Druid and Defender for Identity outputs as sensitive security information. Avoid making unapproved changes to production identity services. Ensure remediation activity is tested, peer-reviewed and appropriately approved. Maintain accurate implementation and validation evidence. Record residual risks where remediation is not technically or operationally possible. Support independent review, audit and assurance activities where required. Handle employee, identity and infrastructure information in accordance with applicable data-protection and confidentiality requirements.

Microsoft Graph permissions. Hybrid identity and directory synchronisation. Strong PowerShell capability. Experience with Microsoft Graph or equivalent identity APIs. Experience implementing secure changes in production environments. Understanding of change management, risk management and security assurance. Strong documentation and stakeholder-management skills.

Desirable experience

Experience in financial services or another regulated industry. Experience with Microsoft Entra Connect or Microsoft Cloud Sync. Experience with privileged-access workstations and administrative tiering. Experience with identity governance, access reviews and entitlement management. Familiarity with zero-trust principles. Experience integrating identity-security findings with SIEM, SOAR, vulnerability-management or service-management platforms. Knowledge of Microsoft Defender XDR and related security recommendations. Experience with infrastructure-as-code or configuration-management tools. Relevant Microsoft, identity or cyber-security certifications.