Active Directory Security Engineer

• Active Directory Administration & Infrastructure Administer and maintain Active Directory Domain Services (AD DS) across multiple forests, domains, and sites.
• Design, configure, and maintain forest and domain architecture, domain controllers, Group Policy Objects (GPOs), and AD replication.
• Manage AD-integrated DNS, Sites and Services, domain trusts, and multi-forest environments.
• Troubleshoot authentication, replication, and directory services issues.
• Maintain the availability, performance, and reliability of enterprise Active Directory infrastructure.

• Conduct Active Directory security assessments and implement security hardening measures.
• Implement and maintain Tier 0 security and privileged access models.
• Identify, investigate, and remediate attack paths, excessive permissions, and privilege escalation risks.
• Configure and secure Kerberos and NTLM authentication, LDAP signing, and channel binding.
• Deploy and manage Local Administrator Password Solution (LAPS) and Group Managed Service Accounts (gMSA).
• Review and manage delegation, Access Control Lists (ACLs), and administrative permissions to enforce least-privilege access.
• Strengthen authentication controls and reduce identity-related security vulnerabilities.

• Administer Active Directory Certificate Services (AD CS) and Public Key Infrastructure (PKI).
• Develop, maintain, and execute Active Directory forest recovery and disaster recovery procedures.
• Support identity-related security incidents, investigations, and remediation activities.
• Partner with security and infrastructure teams to improve identity protection and meet security requirements.

• Administer Microsoft Entra ID and Microsoft Entra Connect.
• Manage hybrid identity synchronization between on-premises Active Directory and Microsoft Entra ID.
• Configure and maintain Conditional Access policies, Multi-Factor Authentication (MFA), and Privileged Identity Management (PIM).
• Troubleshoot identity synchronization, authentication, and access-related issues.

• Develop and maintain PowerShell scripts to automate Active Directory administration, security checks, and reporting.
• Collaborate with cybersecurity, infrastructure, and operations teams on identity-related projects, incidents, and audits.
• Maintain technical documentation, security standards, operational procedures, and architecture diagrams.

• Strong enterprise-level experience administering Active Directory Domain Services (AD DS).
• Hands-on experience with forest and domain architecture, domain controllers, and Group Policy (GPO).
• Experience managing AD replication, DNS, Sites and Services, domain trusts, and multi-forest environments.
• Strong troubleshooting skills across enterprise Active Directory environments.

• Hands-on experience performing Active Directory security assessments and hardening.
• Knowledge of Tier 0 security architecture and privileged access management.
• Experience securing Kerberos, NTLM, LDAP signing, and LDAP channel binding.
• Experience implementing and managing LAPS and gMSA.
• Strong understanding of delegation, ACLs, least-privilege access, and authentication hardening.
• Ability to identify and remediate attack paths, excessive permissions, and privilege escalation vulnerabilities.

• Experience administering Active Directory Certificate Services (AD CS) and PKI.
• Knowledge of Active Directory forest recovery and disaster recovery procedures.

• Experience with Microsoft Entra ID, Entra Connect, and hybrid identity synchronization.
• Hands-on experience with Conditional Access, MFA, and PIM.

Scripting & Automation

• Strong PowerShell scripting skills for Active Directory administration, automation, troubleshooting, and reporting.

Physical Requirements

• Ability to work at a computer for extended periods, typically 6–8 hours per day.
• Ability to perform repetitive keyboard, mouse, and monitor tasks.
• Ability to lift and carry equipment weighing up to 25 pounds.
• Ability to occasionally access server rooms or data centers, including standing, bending, or climbing stairs.
• Ability to read information displayed on computer screens, equipment labels, and hardware components.

Nesco Resource offers a comprehensive benefits package for our associates, which includes a MEC (Minimum Essential Coverage) plan that encompasses Medical, Vision, Dental, 401K, and EAP (Employee Assistance Program) services.

Nesco Resource provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws.

#EDS014