Staff Platform Engineer - Active Directory - Identity Services

Job summary

This hands-on senior engineering role shapes and improves secure, reliable identity services across a complex hybrid environment, with technical direction for enterprise Active Directory and contributions to Microsoft Entra ID. Responsibilities include designing directory topologies, strengthening identity security, modernising and migrating identity architectures, and advancing automation and reusable engineering practices across on-premises and AWS environments.

Qualifications

• Extensive practical Active Directory experience across forest and domain design, Group Policy, DNS, DFS, sites and services, replication, trusts, delegation, schema and object lifecycle management.
• Experience operating hybrid Active Directory estates spanning on-premises infrastructure and AWS, including EC2-hosted domain controllers and AWS Directory Service / AWS Managed Microsoft AD.
• Strong identity security knowledge covering least privilege, tiered administration, credential hygiene, Kerberos and NTLM hardening, LDAP security, identity threat detection and attack-path reduction.
• Working knowledge of Microsoft Entra ID, including hybrid identity, directory synchronisation, Conditional Access and modern authentication and authorisation.
• Strong scripting and automation capability applied to identity operations and repeatable engineering delivery.
• Experience with infrastructure-as-code and CI/CD technologies such as Terraform, AWS CDK, CloudFormation, Ansible, GitHub or GitHub Actions.
• Exposure to AWS services supporting directory workloads and automation, alongside observability technologies such as Grafana and Prometheus.
• Strong technical communication and influencing skills, with the ability to mentor engineers and explain complex identity and security concepts clearly.

Responsibilities

• Act as a senior technical authority for Active Directory across on-premises, AWS-hosted and AWS-managed directory environments, while contributing expertise across Microsoft Entra ID.
• Design and engineer hybrid directory topologies, including domain controller placement, replication, sites and services, DNS, network connectivity and trust patterns.
• Strengthen identity security through privileged access controls, tiered administration, hardening standards, credential protection and reduction of identity-based attack paths.
• Lead the transition towards target identity architectures, including Active Directory modernisation, cloud migration, hybrid identity integration and retirement of legacy authentication.
• Shape the technical roadmap for identity products and translate strategic priorities into clear, executable engineering plans.
• Champion automation, infrastructure as code, secure engineering standards and reusable patterns across identity services.
• Mentor engineers and build alignment on identity designs and standards across technical teams.
• Use metrics, feedback and emerging technologies to continuously improve identity security, reliability, supportability and cost effectiveness.

Skills

Relocation