Identity Infrastructure Engineer

We are seeking an experienced Senior Identity Infrastructure Engineer to support the platforms underpinning enterprise Identity and Access Management (IDAM) services.

You will administer, maintain and improve Active Directory, PKI, DNS, Group Policy and authentication infrastructure, providing L2/L3 operational support. Working with security, infrastructure and IDAM teams, you will help ensure critical identity services remain available, resilient and secure.

Key responsibilities

Active Directory

• Administer enterprise forests, domains, domain controllers, Sites and Services, replication and trusts.

• Manage AD-integrated DNS and Group Policy design, implementation and troubleshooting.

• Monitor platform health, performance, security and replication.

• Support AD backup, recovery, disaster recovery, upgrades, migrations and consolidation.

• Implement security hardening and privileged access controls.

Public Key Infrastructure

• Administer Microsoft Active Directory Certificate Services (AD CS), including Offline Root and Issuing CAs.

• Manage certificate authorities, templates, enrolment and certificate lifecycle processes.

• Maintain Certificate Revocation Lists (CRL), Authority Information Access (AIA) and certificate distribution services.

• Monitor certificate compliance, renewals, revocations and expiry.

• Maintain PKI documentation, recovery procedures and security standards.

• Troubleshoot cryptographic and certificate-related issues.

Identity and operational support

• Support Microsoft Entra Connect and hybrid identity infrastructure.

• Maintain LDAP, LDAPS, Kerberos and NTLM authentication services.

• Support AD integrations with Microsoft Identity Manager (MIM), Entra ID, Okta and BeyondTrust.

• Provide L2/L3 support for incidents and requests, including provisioning, synchronisation and authentication issues.

• Investigate root causes with IDAM engineers and implement lasting solutions.

• Support wider identity operations during periods of increased demand.

Automation and improvement

• Develop PowerShell automation for identity infrastructure administration.

• Improve platform performance, operational efficiency and service delivery.

• Contribute to vulnerability remediation, security improvements and infrastructure modernisation.

• Maintain technical documentation, operational procedures and support runbooks.

Essential skills and experience

Active Directory

• Extensive hands-on enterprise AD administration.

• Strong knowledge of AD DS, Sites and Services, forests/domains, DNS, Group Policy, trusts, replication, LDAP/LDAPS and Kerberos.

• Experience with AD backup/recovery and complex directory or authentication troubleshooting.

PKI

• Strong hands-on experience administering enterprise Microsoft AD CS.

• Experience managing certificate authorities, templates, CRL/AIA infrastructure, certificate lifecycle and enrolment services.

• Knowledge of key recovery and archival.

Infrastructure

• Windows Server 2016/2019/2022 administration.

• PowerShell scripting and automation.

• Security hardening and privileged administration.

• High availability, disaster recovery, infrastructure monitoring and operational support.

Identity technologies

• Working knowledge of Entra ID, Entra Connect/Cloud Sync, MIM, Okta and BeyondTrust.

• Understanding of IAM, Joiner/Mover/Leaver processes, identity lifecycle management, authentication, authorisation, access governance and role-based access control (RBAC).

Desirable experience

• Hands-on MIM support, hybrid identity architectures and Okta administration/integration.

• BeyondTrust Privileged Access Management (PAM) or Endpoint Privilege Management.

• Tier 0 administration and privileged access models.

• CrowdStrike, Zscaler and security platform integrations.

• Highly regulated or secure environments.

• ITIL operational support and large-scale enterprise identity programmes.

Security clearance

Appointment requires Security Check (SC) clearance. For this vacancy, applicants must have resided continuously in the UK for the last five years and meet the other applicable clearance requirements.