{"id":3281246,"url":"https://alion.io/job/decisionpoint-corporation-active-directory-identity-engineer-senior","title":"Active Directory / Identity Engineer (Senior)","company":{"id":3863688,"name":"DecisionPoint Corporation","domain":"decisionpointcorp.com","url":"https://alion.io/company/decisionpoint-corporation","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":{"grade":"A","score":100,"open_postings":3,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":26,"computed_at":"2026-11-05T05:54:30Z"}},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Chicago, United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":70000,"max_usd":132000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":713},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"DNS","optional":false},{"name":"LDAP","optional":false},{"name":"Least Privilege","optional":false},{"name":"Okta","optional":false},{"name":"Service Desk","optional":false},{"name":"Windows","optional":false},{"name":"Azure","optional":true},{"name":"ITIL","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"PowerShell","optional":true},{"name":"Windows Server","optional":true},{"name":"Zero Trust","optional":true}],"status":"live","first_seen_at":"2026-10-26T16:34:33Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-11-05T06:01:02Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":9},"description":"Overview\nDecisionPoint seeks an Active Directory / Identity Engineer to own and sustain the Microsoft Active Directory Domain Services environment supporting the USMEPCOM ENLIST program. This senior engineering position manages AD objects, organizational units, Group Policy Objects, trusts, replication, schema governance, delegated permissions, domain services, and recovery capabilities.\nThe Active Directory / Identity Engineer ensures that directory services remain secure, available, recoverable, and aligned with USMEPCOM operational and cybersecurity requirements. The engineer supports domain and forest planning, account and group administration, site replication, trust relationships, Group Policy, domain-controller lifecycle activities, backup, restoration, and modernization.\nThe position also evaluates and tests approved Identity, Credential, and Access Management capabilities, including potential Okta integrations and other identity-modernization technologies. These modernization activities complement-not replace-the position’s requirement for direct, hands-on AD DS engineering expertise.\nThe engineer works closely with cybersecurity, Service Desk, systems, cloud, network, application, COOP, and Government identity stakeholders. This position is remote, with Chicago-area candidates preferred. Occasional after-hours maintenance, incident response, COOP exercises, on-site support, or travel may be required.\nNote: By applying to this position, you acknowledge and consent to having your resume included in an active competitive government contract bid.\nDuties & Responsibilities\nThe Active Directory / Identity Engineer will:\nServe as the senior technical owner for the USMEPCOM Active Directory Domain Services environment. \nInstall, configure, maintain, update, troubleshoot, and recover Active Directory services and supporting components. \nCreate, modify, disable, delete, and manage authorized AD objects in accordance with approved processes. \nManage organizational units, users, computers, groups, service accounts, shared resources, and other directory objects. \nMaintain the domain plan, organizational-unit plan, site plan, trust plan, Group Policy design, and related architecture documentation. \nDesign and maintain an organizational-unit structure that supports administration, policy application, security boundaries, and delegated management. \nManage organizational-unit permissions and administrative delegation using least-privilege principles. \nReview delegated access and correct excessive, obsolete, inherited, or conflicting permissions. \nDevelop, test, implement, maintain, and troubleshoot Group Policy Objects. \nManage GPO links, inheritance, precedence, security filtering, loopback processing, WMI filters, backups, version history, and recovery. \nEvaluate proposed GPO changes for security, operational, and customer impact before production implementation. \nIdentify and resolve conflicting, obsolete, duplicative, or ineffective Group Policy settings. \nManage trust relationships with enterprise and external AD structures. \nConfigure, validate, monitor, and troubleshoot domain and forest trusts within approved security boundaries. \nReview trust direction, transitivity, authentication scope, name-suffix routing, and related security settings. \nManage AD sites, subnets, site links, replication schedules, bridgehead behavior, and replication topology. \nMonitor and troubleshoot replication latency, failures, lingering objects, directory inconsistencies, and site-topology problems. \nMaintain the health of domain controllers, directory databases, SYSVOL, DFS Replication, time synchronization, and AD-integrated DNS dependencies. \nMonitor Flexible Single Master Operations roles and support approved role transfer or seizure when necessary. \nPlan and execute domain-controller installation, replacement, upgrade, demotion, and retirement activities. \nDevelop and implement approved plans to transition Active Directory to supported versions. \nManage AD schema governance and coordinate tightly controlled schema extensions. \nEvaluate schema-change requests for compatibility, replication impact, operational risk, recovery requirements, and required approvals. \nMaintain current directory schematics, architecture diagrams, object models, administrative boundaries, trust diagrams, and replication diagrams. \nAdminister account and group changes escalated from approved Service Desk and access-management processes. \nSupport troubleshooting of authentication, authorization, account, group-membership, policy, trust, replication, and directory-permission issues. \nCoordinate with the Service Desk to improve identity-related ticket routing, troubleshooting, escalation, and knowledge content. \nProvide advanced engineering support during identity, authentication, domain, and access-management incidents. \nIdentify widespread authentication failures or other outage signals and escalate them through approved incident-response procedures. \nSupport root-cause analysis and corrective-action development for recurring directory and identity incidents. \nDevelop and maintain Active Directory backup, restoration, and forest-recovery procedures. \nTest system-state backups, directory restoration, authoritative and non-authoritative recovery, deleted-object recovery, and forest-recovery procedures. \nSupport COOP exercises, disaster-recovery testing, recovery validation, and actual continuity events. \nDocument recovery results, deficiencies, corrective actions, and lessons learned. \nEvaluate and test approved ICAM and identity-modernization technologies. \nSupport integration testing between Active Directory and Okta or other Government-approved identity platforms. \nValidate identity synchronization, account linking, authentication flows, group or attribute mappings, provisioning behavior, access controls, and failure handling. \nSupport testing of approved federation and modern authentication protocols such as SAML, OpenID Connect, OAuth, SCIM, LDAP, or comparable technologies. \nCoordinate identity-integration activities with cybersecurity, application owners, cloud teams, network teams, and Government identity authorities. \nDevelop test plans, test cases, expected results, rollback procedures, and validation evidence for identity integrations. \nEvaluate modernization options while preserving required AD DS authentication, authorization, Group Policy, trust, recovery, and administrative capabilities. \nAssess modernization proposals for interoperability, security, operational support, lifecycle, resiliency, and mission impact. \nAutomate approved directory administration, health validation, reporting, audit, and configuration activities where appropriate. \nReview directory audit information and report activity outside approved baselines. \nSupport enforcement of DISA Security Technical Implementation Guides and approved security baselines. \nMonitor and remediate applicable directory-service vulnerabilities, configuration findings, and policy deficiencies. \nSupport Risk Management Framework controls, assessment evidence, Plan of Action and Milestones activities, and authorization documentation. \nFollow approved incident, problem, change, configuration, access, release, security, and quality-management processes. \nMaintain standard operating procedures, recovery plans, configuration baselines, change records, test results, and technical documentation. \nProvide directory-service health, availability, capacity, risk, issue, modernization, and recovery information for program reporting.\nQualifications\nRequired Qualifications\nCandidates must meet all of the following requirements:\nActive Secret clearance or higher. \nBachelor’s degree in information technology, information systems, or a related field, or equivalent professional experience where permitted by the applicable labor category. \nMinimum of eight years of relevant experience in Active Directory engineering, identity engineering, Windows infrastructure, systems engineering, or a related technical discipline. \nDirect, hands-on experience engineering and administering Microsoft Active Directory Domain Services in an enterprise environment. \nExperience managing AD objects, organizational units, Group Policy Objects, trusts, replication, schemas, delegated permissions, and directory recovery. \nExperience troubleshooting complex authentication, authorization, Group Policy, replication, trust, and directory-services issues. \nExperience planning or supporting Active Directory backup, restoration, disaster recovery, or forest recovery. \nExperience testing identity integrations or evaluating enterprise identity-modernization technologies. \nUnderstanding of the distinction between core AD DS administration and external ICAM, federation, or cloud-identity services. \nKnowledge of enterprise identity security, least privilege, delegated administration, account management, and access-control principles. \nAbility to develop and maintain architecture diagrams, domain plans, OU plans, Group Policy documentation, trust diagrams, recovery procedures, and technical standards. \nAbility to support after-hours maintenance, COOP exercises, disaster-recovery testing, and critical incident response when required. \nStrong written, verbal, analytical, and technical problem-solving skills. \nPreferred Qualifications\nThe following qualifications are preferred but are not required:\nExperience integrating Active Directory with Okta. \nExperience with Microsoft Entra ID or hybrid identity. \nExperience supporting federal or Department of Defense ICAM initiatives. \nExperience with SAML, OpenID Connect, OAuth, SCIM, LDAP, Kerberos, NTLM, and federation technologies. \nExperience with Active Directory Federation Services or comparable identity-provider technologies. \nExperience with PowerShell scripting and directory-administration automation. \nMicrosoft identity, Windows Server, Azure, or security certification. \nOkta Certified Administrator, Okta Certified Consultant, or comparable Okta certification. \nCompTIA Security+, CISSP, or another relevant security certification. \nExperience with CAC, PIV, certificate-based authentication, public key infrastructure, or DoD enterprise authentication. \nExperience applying DISA Security Technical Implementation Guides to Active Directory and Windows infrastructure. \nExperience supporting DoD Risk Management Framework controls and authorization activities. \nExperience designing or testing identity capabilities aligned with Zero Trust principles. \nExperience with Active Directory monitoring, privileged-access management, identity governance, or audit tools. \nITIL v4 Foundation certification. \nSkills and Competencies\nEnterprise Active Directory engineering and administration. \nOrganizational-unit and Group Policy design. \nTrust, replication, schema, and permissions management. \nDirectory backup, restoration, and forest recovery. \nIdentity integration and modernization testing. \nAuthentication and authorization troubleshooting. \nSecurity baseline and least-privilege implementation. \nPowerShell and directory-administration automation. \nCOOP and disaster-recovery support. \nArchitecture and technical-documentation development. \nCross-functional identity and infrastructure coordination. \nStrong configuration discipline and attention to detail. \nAbility to retain deep AD DS expertise while evaluating modern ICAM capabilities.\nOur Equal Employment Opportunity Policy\nEEO and Affirmative Action Policy: DecisionPoint Corporation is an Equal Employment Opportunity and Affirmative Action employer. It is the policy of DecisionPoint Corporation to provide equal employment opportunity in accordance with all applicable Equal Employment Opportunity/Affirmative Action laws, directives and regulations to all employees and qualified applicants without regard to race, ethnicity, color, religion, national origin, sex, age, disability status, pregnancy, sexual orientation, gender identity, g...","description_format":"text","description_chars":13624,"description_truncated":true,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Digital Government","Information Security","IT Consulting & Digital Transformation","Cloud Consulting & Migration"],"lifecycle":[{"event":"open","at":"2026-10-26T16:34:33Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"Filed H-1B visas in the last two years","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":null,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":74,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.822,"p_room":0.9,"age_days":9,"expected_fill_days":26,"reasons":["conf:5","velocity","win:mid","comp:brand"],"computed_at":"2026-11-05T05:54:30Z"},"pay":null,"html_url":"https://alion.io/job/decisionpoint-corporation-active-directory-identity-engineer-senior","json_url":"https://alion.io/job/decisionpoint-corporation-active-directory-identity-engineer-senior.json","meta":{"generated_at":"2026-11-05T09:03:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11454,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3863688},"rest":"https://alion.io/mcp/rest/get_company?id=3863688"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdecisionpoint-corporation-active-directory-identity-engineer-senior"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdecisionpoint-corporation-active-directory-identity-engineer-senior"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdecisionpoint-corporation-active-directory-identity-engineer-senior"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/decisionpoint-corporation-active-directory-identity-engineer-senior\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdecisionpoint-corporation-active-directory-identity-engineer-senior"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3281246}},{"tool":"search_jobs","arguments":{"company":"decisionpointcorp.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3281246},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}