Lead Identity Infrastructure Engineer

The position is for a Lead Identity Infrastructure Engineer with experience designing, managing, securing, monitoring and supporting enterprise identity infrastructure, with primary emphasis on Active Directory, Public Key Infrastructure (PKI), Entra ID Application Registrations and related Domain Services technologies.

Responsibilities of this role include Active Directory architecture and lifecycle management; forest, domain and trust management; Certificate Services and Keyfactor integrations; operational monitoring and alerting; resilience, recovery and security hardening; and expert recommendations and guidance for Microsoft Entra ID application registrations and authentication strategies.

This role partners with Security, Enterprise Architecture, infrastructure teams and application owners to deliver compliant authentication and directory solutions. The role also supports, automation, high severity incident resolution, modern authentication patterns such as SAML and OAuth, and secure support for legacy authentication where required.

What you’ll be doing

• Serve as a technical expert for the architecture, engineering, administration and operational health of enterprise Active Directory and Domain Services.
• Provide subject matter expertise and strategy recommendations for projects involving Active Directory and Microsoft Entra ID application registrations, covering both legacy and modern authentication methods.
• Demonstrate deep technical expertise in Public Key Infrastructure, including Keyfactor PKIaaS, certificate templates, enrollment services, certificate lifecycle processes and Keyfactor integrations.
• Bring an AI agentic mindset to automation, continuous improvement and modernization opportunities that enhance the Domain Services service portfolio.
• Design, manage and secure Active Directory forests, domains, trusts, sites and services, replication, DNS dependencies and domain controller lifecycle activities.
• Build and improve monitoring, alerting, health checks and operational dashboards for Active Directory, authentication services and PKI using tools such as Splunk and enterprise monitoring platforms.
• Contribute to Active Directory security hardening, identity threat detection and response, privileged access controls, disaster recovery planning and recovery exercises.
• Lead troubleshooting and incident resolution for complex, high severity Active Directory, EntraID authentication and PKI incidents, including root cause analysis and corrective actions.
• Working knowledge of PowerShell Desired State Configuration (DSC) and GitLab for infrastructure configuration, source control, and automation.
• Work closely with Security and Enterprise Architecture to design enterprise compliant, resilient and supportable identity solutions.
• Develop and implement PowerShell based automation to improve security, consistency, monitoring and operational efficiency.
• Partner and guide cross functional teams, application owners and Managed Service Providers to integrate and support authentication and directory services.
• Provide advanced support for Microsoft Entra application registrations, enterprise applications, OAuth, OpenID Connect and SAML integrations as needed.
• Create and maintain architecture, operational and recovery documentation and share knowledge with the team.
• Build\Present engineered solutions to Architecture and Peer Review Boards., This position may be subject to Lincoln’s Political Contribution Policy. An offer of employment may be contingent upon disclosing to Lincoln the details of certain political contributions. Lincoln may decline to extend an offer or terminate employment for this role if it determines political contributions made could have an adverse impact on Lincoln’s current or future business interests, misrepresentations were made, or for failure to fully disclose applicable political contributions and or fundraising activities.

Any unsolicited resumes or candidate profiles submitted through our web site or to personal e-mail accounts of employees of Lincoln Financial are considered property of Lincoln Financial and are not subject to payment of agency fees.

Lincoln Financial (“Lincoln” or “the Company”) is an Equal Opportunity employer and, as such, is committed in policy and practice to recruit, hire, compensate, train and promote, in all job classifications, without regard to race, color, religion, sex, age, national origin or disability. Opportunities throughout Lincoln are available to employees and applicants are evaluated on the basis of job qualifications. If you are a person with a disability that impedes your ability to express your interest for a position through our online application process, or require TTY/TDD assistance, contact us by calling (866) 922-6543.

This Employer Participates in E-Verify. See the E-Verify notices.

OAuth Gmail Splunk Gitlab OpenID Marketing Dashboard Scripting Templates Hardening Annuities Leadership Automation Resilience Wholesaling Peer Review Fundraising Tax Accounting NT LAN Manager Version Control Authentications Windows Servers Access Controls Social Security Microsoft Graph Managed Services Active Directory Virtual Training Threat Detection Trust Management Recovery Testing Agile Methodology Disaster Recovery Windows PowerShell Domain Controllers Workflow Management Root Cause Analysis Kerberos (Protocol) Lifecycle Management Atlassian Confluence Engineering Management Disaster Recovery Plan Operational Resilience Enterprise Architecture Employment Applications Authentication Protocols Public Key Infrastructure Desired State Configuration Employee Assistance Programs Health And Wellness Coaching Continuous Improvement Process Role-Based Access Control (RBAC) Troubleshooting (Problem Solving) Lightweight Directory Access Protocols Security Assertion Markup Language (SAML)

At least 5 years, * 5+ years of experience managing and supporting enterprise identity services, with deep hands-on experience in Active Directory, PKI, and Entra ID Application Registrations.

• Advanced knowledge of Active Directory architecture, including forests, domains, trusts, organizational units, replication, sites and services, DNS dependencies and Group Policy.
• Advanced experience with enterprise PKI, including Certificate Services, certificate templates, enrollment workflows, certificate lifecycle management and Keyfactor or comparable platforms.
• Deep experience and understanding of Microsoft Entra ID Application Registrations, Enterprise Applications, EntraID Connect and Microsoft Graph APIs.
• Strong troubleshooting skills across Active Directory, LDAP, Kerberos, NTLM, DNS, Windows Server, certificates and authentication related issues.
• Expert knowledge of legacy and modern directory and authentication protocols, including LDAP, Kerberos, NTLM, SAML, OAuth and OpenID Connect.
• Proficiency in scripting and automation using PowerShell and Microsoft Graph.
• Proven experience with Active Directory security hardening, role based access control, privileged access, forest and domain trust management and secure administration practices.
• In depth experience with Active Directory disaster recovery, recovery testing and operational resilience planning.
• Experience designing and operating monitoring, alerting and health validation for directory, authentication and PKI services; Splunk search and dashboard experience is preferred.
• Ability to collaborate with Agile teams and use Jira and Confluence to track engineering work and maintain technical documentation.
• 4 Year/bachelor’s degree or equivalent work experience (4 years of experience in lieu of Bachelor’s)

• Clearly defined career tracks and job levels, along with associated behaviors for each of Lincoln’s core values and leadership attributes
• Leadership development and virtual training opportunities
• PTO/parental leave
• Competitive 401K and employee benefits
• Free financial counseling, health coaching and employee assistance program
• Tuition assistance program
• Work arrangements that work for you
• Effective productivity/technology tools and training

The pay range for this position is $106,875 - $171,000 with anticipated pay for new hires between the minimum and midpoint of the range and could vary above and below the listed range as permitted by applicable law. Pay is based on non-discriminatory factors including but not limited to work experience, education, location, licensure requirements, proficiency and qualifications required for the role. The base pay is just one component of Lincoln’s total rewards package for employees. In addition, the role may be eligible for the Annual Incentive Program, which is discretionary and based on the performance of the company, business unit and individual. Other rewards may include long-term incentives, sales incentives and Lincoln’s standard benefits package.

At Lincoln Financial, we love what we do. We make meaningful contributions each and every day to empower our customers to take charge of their lives. Working alongside dedicated and talented colleagues, we build fulfilling careers and stronger communities through a company that values our unique perspectives, insights and contributions and invests in programs that empower each of us to take charge of our own future., Lincoln Financial (NYSE: LNC) helps people to confidently plan for their version of a successful future. We focus on identifying a clear path to financial security, with products including annuities, life insurance, group protection, and retirement plan services.

With our 120-year track record of expertise and integrity, millions of customers trust our solutions and service to help put their goals in reach.

Lincoln Financial Distributors, a broker-dealer, is the wholesale distribution organization of Lincoln Financial. Lincoln Financial is the marketing name for Lincoln Financial Corporation and its affiliates including The Lincoln National Life Insurance Company, Fort Wayne, IN, and Lincoln Life & Annuity Company of New York, Syracuse, NY. Lincoln Financial affiliates, their distributors, and their respective employees, representatives and/or insurance agents do not provide tax, accounting or legal advice.

Lincoln is committed to creating an inclusive environment and is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status.

Follow us on Facebook , X , LinkedIn , Instagram , and YouTube . For the latest company news, visit our newsroom .

Be Aware of Fraudulent Recruiting Activities

If you are interested in a career at Lincoln, we encourage you to review our current openings and apply on our website. Lincoln values the privacy and security of every applicant and urges all applicants to diligently protect their sensitive personal information from scams targeting job seekers. These scams can take many forms including fake employment applications, bogus interviews and falsified offer letters.