Active Directory / Identity Engineer (Senior)

About this role

Overview
DecisionPoint seeks an Active Directory / Identity Engineer to own and sustain the Microsoft Active Directory Domain Services environment supporting the USMEPCOM ENLIST program. This senior engineering position manages AD objects, organizational units, Group Policy Objects, trusts, replication, schema governance, delegated permissions, domain services, and recovery capabilities.
The Active Directory / Identity Engineer ensures that directory services remain secure, available, recoverable, and aligned with USMEPCOM operational and cybersecurity requirements. The engineer supports domain and forest planning, account and group administration, site replication, trust relationships, Group Policy, domain-controller lifecycle activities, backup, restoration, and modernization.
The position also evaluates and tests approved Identity, Credential, and Access Management capabilities, including potential Okta integrations and other identity-modernization technologies. These modernization activities complement—not replace—the position’s requirement for direct, hands-on AD DS engineering expertise.
The engineer works closely with cybersecurity, Service Desk, systems, cloud, network, application, COOP, and Government identity stakeholders. This position is remote, with Chicago-area candidates preferred. Occasional after-hours maintenance, incident response, COOP exercises, on-site support, or travel may be required.
Note: By applying to this position, you acknowledge and consent to having your resume included in an active competitive government contract bid.
Duties & Responsibilities
The Active Directory / Identity Engineer will:

• Serve as the senior technical owner for the USMEPCOM Active Directory Domain Services environment.

• Install, configure, maintain, update, troubleshoot, and recover Active Directory services and supporting components.

• Create, modify, disable, delete, and manage authorized AD objects in accordance with approved processes.

• Manage organizational units, users, computers, groups, service accounts, shared resources, and other directory objects.

• Maintain the domain plan, organizational-unit plan, site plan, trust plan, Group Policy design, and related architecture documentation.

• Design and maintain an organizational-unit structure that supports administration, policy application, security boundaries, and delegated management.

• Manage organizational-unit permissions and administrative delegation using least-privilege principles.

• Review delegated access and correct excessive, obsolete, inherited, or conflicting permissions.

• Develop, test, implement, maintain, and troubleshoot Group Policy Objects.

• Manage GPO links, inheritance, precedence, security filtering, loopback processing, WMI filters, backups, version history, and recovery.

• Evaluate proposed GPO changes for security, operational, and customer impact before production implementation.

• Identify and resolve conflicting, obsolete, duplicative, or ineffective Group Policy settings.

• Manage trust relationships with enterprise and external AD structures.

• Configure, validate, monitor, and troubleshoot domain and forest trusts within approved security boundaries.

• Review trust direction, transitivity, authentication scope, name-suffix routing, and related security settings.

• Manage AD sites, subnets, site links, replication schedules, bridgehead behavior, and replication topology.

• Monitor and troubleshoot replication latency, failures, lingering objects, directory inconsistencies, and site-topology problems.

• Maintain the health of domain controllers, directory databases, SYSVOL, DFS Replication, time synchronization, and AD-integrated DNS dependencies.

• Monitor Flexible Single Master Operations roles and support approved role transfer or seizure when necessary.

• Plan and execute domain-controller installation, replacement, upgrade, demotion, and retirement activities.

• Develop and implement approved plans to transition Active Directory to supported versions.

• Manage AD schema governance and coordinate tightly controlled schema extensions.

• Evaluate schema-change requests for compatibility, replication impact, operational risk, recovery requirements, and required approvals.

• Maintain current directory schematics, architecture diagrams, object models, administrative boundaries, trust diagrams, and replication diagrams.

• Administer account and group changes escalated from approved Service Desk and access-management processes.

• Support troubleshooting of authentication, authorization, account, group-membership, policy, trust, replication, and directory-permission issues.

• Coordinate with the Service Desk to improve identity-related ticket routing, troubleshooting, escalation, and knowledge content.

• Provide advanced engineering support during identity, authentication, domain, and access-management incidents.

• Identify widespread authentication failures or other outage signals and escalate them through approved incident-response procedures.

• Support root-cause analysis and corrective-action development for recurring directory and identity incidents.

• Develop and maintain Active Directory backup, restoration, and forest-recovery procedures.

• Test system-state backups, directory restoration, authoritative and non-authoritative recovery, deleted-object recovery, and forest-recovery procedures.

• Support COOP exercises, disaster-recovery testing, recovery validation, and actual continuity events.

• Document recovery results, deficiencies, corrective actions, and lessons learned.

• Evaluate and test approved ICAM and identity-modernization technologies.

• Support integration testing between Active Directory and Okta or other Government-approved identity platforms.

• Validate identity synchronization, account linking, authentication flows, group or attribute mappings, provisioning behavior, access controls, and failure handling.

• Support testing of approved…