Active Directory / Identity Engineer (Journeyman)

DecisionPoint seeks an Active Directory / Identity Engineer to administer, sustain, secure, and recover the Microsoft Active Directory Domain Services environment supporting the USMEPCOM ENLIST program. This position manages AD objects, organizational units, Group Policy Objects, trusts, replication, schema changes, delegated permissions, domain services, and recovery capabilities. 

The Active Directory / Identity Engineer provides direct, hands-on AD DS support while assisting with approved Identity, Credential, and Access Management initiatives. The engineer helps test potential Okta integrations and other identity-modernization technologies without reducing the program’s need for strong traditional Active Directory engineering and operational expertise. 

The engineer works closely with the Senior AD/Identity Engineer, cybersecurity personnel, Service Desk, systems administrators, cloud and application teams, COOP personnel, and Government identity stakeholders. The position supports routine directory administration, complex troubleshooting, modernization testing, disaster recovery, and critical incident response. 

This position is remote, with Chicago-area candidates preferred. Occasional after-hours maintenance, COOP exercises, incident response, on-site support, or travel may be required. 

Candidates must meet all of the following requirements: 

• →Active Secret clearance or higher. 

• →Bachelor’s degree in information technology, information systems, or a related field, or equivalent professional experience where permitted by the applicable labor category. 

• →Minimum of six years of relevant experience in Active Directory administration, identity engineering, Windows infrastructure, systems engineering, or a related technical discipline. 

• →Direct, hands-on experience administering Microsoft Active Directory Domain Services in an enterprise environment. 

• →Experience managing AD objects, organizational units, Group Policy Objects, trusts, replication, schemas, delegated permissions, and directory recovery. 

• →Experience troubleshooting authentication, authorization, Group Policy, replication, trust, and directory-services issues. 

• →Experience supporting Active Directory backup, restoration, disaster recovery, or deleted-object recovery. 

• →Experience testing identity integrations or supporting enterprise identity-modernization activities. 

• →Understanding of the distinction between core AD DS responsibilities and external ICAM, federation, or cloud-identity services. 

• →Knowledge of enterprise identity security, least privilege, delegated administration, account management, and access-control principles. 

• →Ability to maintain architecture diagrams, domain and OU documentation, Group Policy records, recovery procedures, and technical standards. 

• →Ability to support after-hours maintenance, COOP exercises, disaster-recovery testing, and critical incidents when required. 

• →Strong written, verbal, analytical, and technical problem-solving skills. 

The following qualifications are preferred but are not required: 

• Experience integrating Active Directory with Okta. 

• Experience with Microsoft Entra ID or hybrid identity. 

• Experience supporting federal or Department of Defense identity environments. 

• Experience with SAML, OpenID Connect, OAuth, SCIM, LDAP, Kerberos, NTLM, or federation technologies. 

• Experience with Active Directory Federation Services or comparable identity-provider technology. 

• Experience using PowerShell for Active Directory administration, reporting, or automation. 

• Microsoft identity, Windows Server, Azure, or security certification. 

• Okta Certified Administrator or comparable Okta certification. 

• CompTIA Security+ or another relevant security certification. 

• Experience with CAC, PIV, certificate-based authentication, public key infrastructure, or DoD enterprise authentication. 

• Experience applying DISA Security Technical Implementation Guides to Active Directory or Windows infrastructure. 

• Experience supporting Risk Management Framework controls and authorization activities. 

• Familiarity with Zero Trust identity principles. 

• Experience using Active Directory monitoring, privileged-access, identity-governance, or audit tools. 

• ITIL v4 Foundation certification. 

• Enterprise Active Directory administration. 

• Organizational-unit and Group Policy management. 

• Trust, replication, schema, and permissions support. 

• Directory backup, restoration, and recovery. 

• Identity integration and modernization testing. 

• Authentication and authorization troubleshooting. 

• Security baseline and least-privilege implementation. 

• PowerShell and administrative automation. 

• COOP and disaster-recovery support. 

• Technical-documentation development. 

• Cross-functional identity and infrastructure coordination. 

• Strong configuration discipline and attention to detail. 

• Ability to retain hands-on AD DS expertise while supporting modern ICAM capabilities. 

• EEO and Affirmative Action Policy: DecisionPoint Corporation is an Equal Employment Opportunity and Affirmative Action employer. It is the policy of DecisionPoint Corporation to provide equal employment opportunity in accordance with all applicable Equal Employment Opportunity/Affirmative Action laws, directives and regulations to all employees and qualified applicants without regard to race, ethnicity, color, religion, national origin, sex, age, disability status, pregnancy, sexual orientation, gender identity, genetic information, protected veteran status, or any other protected status under Federal, State or Local laws.
• Pay Transparency Policy: In accordance with Presidential Executive Order 13665, DecisionPoint Corporation will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor's legal duty to furnish information.
• Authorization to Share Resume and Personal Information: By expressing your interest and submitting your resume for this position, you authorize DecisionPoint Corporation to share your resume, as well as personal information included on the resume, with its subsidiaries, affiliates and teaming partners for the purpose of considering you for this position and other available positions requiring comparable skills, education and experience. Should DecisionPoint Corporation. or its affiliates and teaming partners wish to initiate pre-employment discussions, you will be asked to complete an employment application and related employment documents.