Active Directory Architect - Windows AD / IAM / Cloud Security

Active Directory Architecture & Administration

• Design, maintain, and support enterprise Microsoft Active Directory environments.
• Architect secure and scalable Active Directory solutions aligned with enterprise security standards.
• Manage Domain Controllers and Active Directory infrastructure.
• Perform Domain Controller and AD schema upgrades/migrations, including upgrades from Windows Server 2019/2022 to Windows Server 2025.
• Troubleshoot Active Directory replication and authentication issues.
• Manage FSMO (Flexible Single Master Operations) roles.
• Perform AD health checks and proactively identify infrastructure issues.
• Support enterprise AD modernization and security initiatives.

IAM & Security

• Strong experience with Identity and Access Management (IAM).

• Apply security principles related to:

• Confidentiality
• Integrity
• Authorization
• Accountability

Implement and maintain secure identity and access controls.

Support authentication, authorization, and directory security.

Identify and remediate Active Directory security vulnerabilities.

Develop security standards and controls for enterprise identity infrastructure.

Windows Server Security & Vulnerability Management

• Perform Windows Server vulnerability remediation.
• Manage security patching and compliance activities.
• Implement secure configuration standards across Windows Server environments.
• Identify vulnerabilities and coordinate remediation activities.
• Ensure systems meet enterprise security and compliance requirements.

DNS Administration

Strong hands-on experience managing Microsoft DNS, including:

• A records
• AAAA records
• CNAME records
• MX records
• TXT records
• SRV records
• NS records
• SOA records
• PTR records
• Reverse lookup zones
• Create and manage reverse DNS zones.
• Troubleshoot DNS resolution and Active Directory-integrated DNS issues.
• Manage DNS dependencies associated with Active Directory services.

Group Policy

• Design, configure, and manage Group Policy Objects (GPOs).
• Develop and implement enterprise security policies through GPO.
• Troubleshoot GPO application and inheritance issues.
• Manage policies related to authentication, security, system configuration, and compliance.

PKI / Certificates / LDAPS

• Manage enterprise PKI and digital certificates.
• Configure and troubleshoot SSL/TLS certificates.
• Manage SSL cipher suites associated with Active Directory.
• Configure and troubleshoot LDAPS.
• Troubleshoot certificate trust, expiration, authentication, and connectivity issues.
• Ensure certificate infrastructure follows enterprise security standards.

Windows Event Auditing & Centralized Logging

• Configure Windows Event Auditing.
• Monitor security and authentication events.
• Configure forwarding of Windows audit events to centralized logging/SIEM platforms.
• Troubleshoot security and authentication issues using Windows event logs.
• Support security monitoring and compliance requirements.

Networking

Strong understanding of:

• TCP/IP
• TCP / UDP
• DNS
• Network connectivity
• Firewall concepts
• Active Directory network ports and protocols
• Troubleshoot connectivity issues between Domain Controllers, clients, applications, and infrastructure services.
• Understand network dependencies of Microsoft Active Directory services.
• Troubleshoot authentication, LDAP/LDAPS, DNS, and directory connectivity issues.

Cloud Architecture & Security

AWS / Azure / Google Cloud Platform

• Experience supporting Windows and Active Directory environments in cloud platforms.
• Experience with AWS, Azure, and/or Google Cloud Platform.
• Design secure cloud architectures aligned with enterprise security requirements.
• Work with cloud-based virtual machines and Windows workloads.
• Troubleshoot Windows VMs operating within cloud environments.
• Understand cloud networking and security controls.
• Apply IAM and access-control principles to cloud environments.

Cloud Security Architecture

• Create security blueprints and roadmaps for cloud adoption.
• Design secure, scalable, and compliant cloud architectures.

• Establish security policies, standards, and guidelines for:

• Public Cloud
• Private Cloud
• Hybrid Cloud

Assess cloud environments for vulnerabilities and security risks.

Implement technical security controls including:

• Network security
• IAM
• Encryption
• Access controls

Support compliance and risk-management initiatives.

DevSecOps & Collaboration

• Collaborate with IT, infrastructure, security, cloud, and development teams.
• Embed security practices into application and infrastructure development.
• Support DevSecOps initiatives.
• Provide technical guidance on identity, security, and cloud architecture.
• Translate business and security requirements into technical solutions.

• Microsoft Active Directory
• Domain Controllers
• AD replication
• AD schema
• FSMO roles
• Active Directory security
• AD troubleshooting
• AD migrations/upgrades
• Windows Server 2019 / 2022 / 2025

DNS - Must Have

• Microsoft DNS
• A / CNAME / MX / TXT / SRV / NS / SOA records
• PTR records
• Reverse zones
• AD-integrated DNS
• DNS troubleshooting

Security / IAM - Must Have

• IAM
• Identity and access management
• Authentication / Authorization
• Windows Server security
• Vulnerability remediation
• Security patching
• Compliance
• Security auditing

Group Policy - Must Have

• GPO creation and management
• Security policies
• GPO troubleshooting
• Group Policy inheritance

PKI / Certificates - Must Have

• PKI
• Digital certificates
• SSL/TLS
• SSL cipher suites
• LDAPS
• Certificate troubleshooting

Networking - Must Have

• TCP/IP
• TCP / UDP
• Active Directory ports
• DNS networking
• Basic network troubleshooting

Cloud - Required

• AWS / Azure / Google Cloud Platform
• Cloud networking
• IAM
• Virtual Machines
• Windows workloads in cloud environments
• Cloud security

Preferred Qualifications

• Experience designing enterprise-scale AD architecture.
• Experience with Active Directory modernization and migration projects.
• Windows Server 2025 upgrade experience.
• Experience with hybrid Active Directory environments.
• Experience integrating on-premises AD with cloud identity platforms.
• Experience with centralized logging/SIEM solutions.
• Experience with cloud security architecture.
• Experience with DevSecOps.
• Experience working in highly regulated enterprise environments.
• Strong documentation and architecture-design skills.