> Markdown version of [/jobs/ext/3760555-senior-identity-security-architect-active-directory-remote-contract](https://www.wearedevelopers.com/jobs/ext/3760555-senior-identity-security-architect-active-directory-remote-contract). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Identity Security Architect, Active Directory (Remote, Contract)

- **Company:** The Stafford
- **Location:** Minneapolis, MN, United States (Remote available)
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Active Directory, Identity and Access Management, Kerberos (Protocol), Azure Active Directory, Cyberark, Cybercrime, SailPoint
- **Published:** October 15, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=2278317b2c1b7a0b

## About the Role

* Extensive hands-on experience securing Active Directory in large enterprise environments
 * Deep knowledge of ADCS, Kerberos, Tier 0 design, and privileged access
 * Experience with tools such as BloodHound, PingCastle, Purple Knight, Semperis, or Microsoft Defender for Identity
 * Strong experience with Microsoft Entra ID and hybrid identity
 * Ability to explain technical risk clearly to client stakeholders

Requirements

Nice to Have

 * Identity governance (SailPoint, Saviynt, or Entra ID Governance), including access reviews and joiner, mover, leaver automation
 * Privileged access management tools such as CyberArk or BeyondTrust
 * Experience integrating identity telemetry with XDR or threat hunting
 * Certificate and cryptographic modernization or quantum readiness planning
 * Certifications such as SC-100, SC-300, CRTP, CRTE, OSCP, or CISSP

## Description

* Assess and harden enterprise Active Directory environments, including forests, trusts, Kerberos, Group Policy, permissions, and delegation
 * Secure Active Directory Certificate Services (ADCS) and remediate certificate-based attack paths
 * Design and implement Tier 0 protection, including administrative tiering, privileged access workstations, and least privilege
 * Identify and remediate attack paths, credential theft exposure, and lateral movement risk
 * Secure hybrid identity between Active Directory and Microsoft Entra ID, including strong authentication and Conditional Access
 * Implement Just-in-Time and Just-Enough Access to reduce standing privilege
 * Plan and test Active Directory forest recovery and ransomware resilience
 * Secure service accounts and other non-human identities