Active Directory Engineer

The Active Directory Engineer is a senior technical contributor responsible for the design, implementation, and transition of segregated Active Directory environments aligned to the approved Architecture for OT / Process Area networks. The role is central to establishing a secure, standards-aligned directory foundation that enforces robust IT/OT segregation and supports regulated manufacturing operations.

This position focuses on establishing and operationalizing:

A fully isolated Active Directory forest dedicated to OT / Process Area networks, with no trust dependencies that would compromise IT/OT separation

Forest/Domain structures for OT networks as defined by the enterprise OT directory architecture baseline

The engineer ensures that all directory services are implemented securely, consistently, and in alignment with enterprise standards, regulatory expectations (e.g., GxP / data integrity), and Purdue Model segmentation principles.

10+ years of hands-on Active Directory engineering experience in large, complex enterprise environments

Deep expertise in multi-forest / multi-domain AD architecture, forest and domain trusts, sites and replication, DNS, PKI, Group Policy, and authentication protocols (Kerberos, LDAP/LDAPS, NTLM)

Strong experience designing and hardening Windows Server and domain controller infrastructure

Experience implementing tiered administration models and securing privileged access (Tier 0 protection, PAW/jump-host design, PAM)

OT / Industrial IT Knowledge (Critical)

Demonstrated, in-depth understanding of IT/OT Active Directory segregation including isolated OT forest design, controlled or one-way trust models, selective authentication, and avoidance of IT/OT authentication dependencies

Strong working knowledge of the Purdue Model (ISA-95) for industrial control system segmentation, including Levels 0 5 and the role of the Industrial DMZ (IDMZ) in directory and authentication architecture

Experience designing directory and authentication services within OT / ICS / SCADA / process-control network environments

Familiarity with OT cybersecurity standards and frameworks such as IEC 62443 and NIST SP 800-82

Understanding of OT operational constraints (uptime, change control, legacy systems, validated/GxP environments) and how they influence directory design and migration

Preferred Qualifications

Prior delivery of OT-segregated directory services architectures in regulated or industrial settings (pharma, biotech, manufacturing, utilities)

Familiarity with certificate lifecycle management platforms and enterprise PKI operations

Experience integrating OT directory services with IDMZ components, jump servers, and privileged access solutions

Relevant certifications such as Microsoft Certified: Identity and Access Administrator, GIAC GICSP, ISA/IEC 62443, or equivalent

Experience in GxP / validated environments and associated documentation practices

Key Deliverables

Fully deployed, isolated OT AD forest and child-domain structure aligned to the approved Architecture

Documented architecture, DNS/PKI configuration, trust model, and security baselines