Senior Active Directory Architect (Hybrid) – Contract
Duration: 12+ months
Location: Manassas, VA or Wilmington, DE
Work Arrangement: Hybrid, onsite 3 days per week
Interview Process: Video interview
Candidate Location Requirement: Candidates must currently reside within drivable commuting distance of either Manassas, VA, or Wilmington, DE. Candidates who require relocation will not be considered. 

Position Overview

We are seeking a Senior Active Directory Architect to lead the design, security, optimization, and evolution of enterprise Active Directory infrastructure. This is a specialized Active Directory architecture position focused primarily on on-premises Active Directory, enterprise AD migrations, domain consolidation, and hybrid identity integration with Microsoft Entra ID.

The ideal candidate will bring deep technical expertise in Active Directory architecture, extensive experience leading complex migration initiatives, and the ability to establish secure, scalable, and reliable identity infrastructure across a large enterprise environment.

Important: This is an Active Directory architecture position, not an IAM architecture position. Candidates must have substantial hands-on Active Directory expertise and a proven track record leading AD migrations and infrastructure initiatives. Experience with Microsoft Entra ID and broader Identity and Access Management (IAM) technologies is important, but Active Directory architecture must be the candidate's primary area of expertise.

Location Requirement: Candidates must already live within reasonable driving distance of one of the two work locations and be able to work onsite three days per week. Candidates planning to relocate to the area will not be considered.

Required Qualifications

• 10+ years of experience in Active Directory engineering, administration, and infrastructure, including at least 3 years in an architect, technical lead, or equivalent senior design role.

• Deep technical expertise in Active Directory Domain Services (AD DS), including forests, domains, trusts, sites, replication, and domain architecture.

• Extensive experience architecting, maintaining, and optimizing enterprise Active Directory environments.

• Demonstrated success leading large-scale Active Directory migrations, domain consolidations, or restructuring projects.

• Hands-on experience integrating on-premises Active Directory with Microsoft Entra ID in hybrid identity environments.

• Strong knowledge of DNS, DHCP, Group Policy, Active Directory Certificate Services (AD CS), and identity infrastructure dependencies.

• Experience with PowerShell scripting and automation for Active Directory administration, migration, or infrastructure management.

• Working knowledge of enterprise identity security principles, privileged access controls, and authentication technologies.

• Strong troubleshooting, documentation, communication, and technical leadership skills.

• Must currently reside within drivable commuting distance of Manassas, VA, or Wilmington, DE, and be able to work onsite three days per week. Relocation candidates will not be considered.

• A demonstrated history of stable employment and/or extended project engagements.

Key Responsibilities

• Architect, maintain, and optimize enterprise Active Directory Domain Services (AD DS), including forests, domains, trusts, sites, and replication.

• Lead large-scale Active Directory migrations, domain consolidations, restructuring initiatives, and related infrastructure modernization projects.

• Design and implement hybrid identity integration between on-premises Active Directory and Microsoft Entra ID using Entra Connect and/or Cloud Sync.

• Develop and maintain Active Directory architecture standards, security baselines, operational procedures, and technical documentation.

• Design and manage Group Policy architecture, administrative delegation, role-based access control (RBAC), and privileged administrative models.

• Strengthen Active Directory security by identifying and mitigating risks associated with privilege escalation, Kerberoasting, pass-the-hash attacks, and other identity-based threats.

• Support identity lifecycle management, authentication, authorization, single sign-on (SSO), and multifactor authentication (MFA).

• Implement and manage Microsoft Entra ID capabilities, including Conditional Access, Privileged Identity Management (PIM), and application registrations.

• Collaborate with security, infrastructure, and compliance teams to support Zero Trust initiatives, audit requirements, and enterprise security objectives.

• Contribute to privileged access management (PAM) and identity governance initiatives using applicable enterprise platforms.

• Develop PowerShell scripts and automation to improve identity administration, migration execution, security, and operational efficiency.

• Provide technical leadership, mentor engineering teams, and communicate architectural decisions and recommendations to technical stakeholders and leadership.

Preferred Qualifications

• Microsoft certifications such as SC-300 (Identity and Access Administrator), AZ-104 (Azure Administrator), or AZ-305 (Azure Solutions Architect).

• Security certifications such as CISSP or CISM.

• Advanced experience with Microsoft Entra ID, including Entra Connect, Cloud Sync, Conditional Access, PIM, application registrations, and Entra ID Governance.

• Experience with identity governance or privileged access management platforms such as SailPoint, Okta, CyberArk, or BeyondTrust.

• Strong understanding of SSO, MFA, SAML, OAuth 2.0, OpenID Connect, Kerberos, and LDAP.

• Experience with Microsoft Defender for Identity and Microsoft Sentinel.

• Experience supporting regulated environments, including financial services, healthcare, or government.

• Familiarity with security frameworks and compliance requirements such as NIST, SOX, and HIPAA.

• Bachelor's degree in Computer Science, Information Systems, or a related discipline, or equivalent practical experience.

• Recent project experience in the Manassas, VA, or Wilmington, DE, area.

Ideal Candidate Profile

The strongest candidates will be experienced Active Directory architects who have personally led complex enterprise AD migrations and can make sound architectural decisions across large, established environments. They should be comfortable working deeply with on-premises Active Directory while also understanding how it integrates with Microsoft Entra ID and enterprise IAM capabilities.

Candidates whose primary background is IAM governance, cloud identity, or access management, without substantial Active Directory architecture and migration experience, are not the intended fit for this position.