Senior Principal Infrastructure Engineer / SME (Active Directory, ADCS & Infoblox)

We are seeking a Senior Subject Matter Expert (SME) with 10+ years of enterprise experience to architect, secure, and govern our core identity, PKI, and network core services. In this senior leadership-level engineering role, you will own the long-term roadmap, security posture, and global availability for Microsoft Active Directory (AD), Microsoft Enterprise Certificate Services (ADCS), and Infoblox (DNS/DHCP/IPAM).

Key Responsibilities

Enterprise Identity (Active Directory)

• Design, optimize, and govern a highly available, on-premises Active Directory infrastructure.

• Security & Hardening: Assist in enforcing strict administrative tiering models and least-privilege access frameworks to defend against advanced threats.

• GPO & Compliance: Create, organize and enforce complex Group Policy Objects (GPOs) to maintain global security baselines and regulatory compliance.

• Consolidation & Strategy: Lead domain mergers, directory consolidations, and hybrid integrations with cloud identity solutions.

Enterprise PKI Governance (Microsoft Enterprise Certificate Server)

• PKI Architecture: Serve as the ultimate authority on the lifecycle, trust models, and design of the Microsoft Enterprise PKI environment, including offline Root CAs and subordinate Issuing CAs.

• Policy Enforcement: Establish and review Certificate Policy and Certification Practice Statements (CP/CPS), automated enrollment protocols, and CRL/OCSP validation paths.

• Disaster Recovery: Formulate, test, and execute bulletproof backup and disaster recovery strategies for critical cryptographic infrastructure.

Infoblox DDI

• Grid Infrastructure Ownership: Oversee the architectural design, patching, upgrade cycles, and capacity planning for the global Infoblox Grid (NIOS).

• Advanced DDI Management: Configure and troubleshoot complex global DNS views, DNSSEC, multi-vendor zone transfers, and high-availability DHCP failover setups.

• Introduce greater efficiency to network, host and application deployments by using Infoblox API integrations, automated IPAM allocations, and infrastructure-as-code deployment pipelines.

CORE COMPETENCIES

Identity & PKI: Microsoft Active Directory (AD DS), Azure AD / Entra ID, Group Policy (GPO), Enterprise Certificate Server (ADCS), Certificate Lifecycle Management. Cloud identity providers (Okta, Azure etc.).

Core Infrastructure: DNS, DHCP, WINS, Group Policy Objects (GPO), FSMO Roles, AD Schema design, Forest/Domain Trusts, LDAP

Automation & Scripting: PowerShell, Azure AD Connect, Graph API, Automated Certificate Revocation, Stale Account Cleanup

Network Services: Infoblox IPAM, DNS, DHCP (DDI), Grid Management.

Data Security: Advanced Windows Permissions (NTFS/Acls), Share Permissions, Security Auditing, Access Control Lists (ACLs).

Security & Hardening: Tiered Administration Models (Red Forest/ESC frameworks), Kerberos Hardening, Vulnerability Remediation, AD Health Checks.

Familiar with ITIL and change control.

Able to perform complex incident management across multiple teams.

TECHNICAL SKILLS

Directory Services: Active Directory, Active Directory Federated Services (ADFS), Kerberos, LDAP, GPO.

Public Key Infrastructure: ADCS, Certificate Authorities (Root/Subordinate), CRL, OCSP, NDES.

On premise and cloud identity providers (Okta, Azure etc.)

Storage & File Systems: Dell PowerScale, OneFS, CIFS/SMB, NFS, Everpure File Systems.

Linux and Unix OS and file systems and interop with Windows clients and servers (AD POSIX compatibility)

Networking & Core Services: Infoblox NIOS, DNSSEC, DHCP Failover, IPAM.

Automation & Scripting: PowerShell, Python, Bash, Active Directory module.

OS Environments: Windows Server (2012 through 2022/2025), Red Hat Enterprise Linux and other Linux distributions.

Complex incident management and communication skills

Capacity planning

Vendor management (procurement and licensing)

SFTP, SCP, NTP, SSH, HTTPS, clients and server

MS Office, Visio

VMware and/or other virtualization technologies.

Networking experience and able to collaborate with networking engineers to troubleshoot complex endpoint and server networking issues L1 to 8 (ping, tracert, wireshark)

Rubrik or similar backup technologies

Required Qualifications & Skills

• Experience: 10+ years of dedicated engineering experience in complex, large-scale enterprise infrastructures.

• Active Directory Mastery: Expert-level knowledge of AD directory replication, site topologies, trust relationships, and forensic troubleshooting.

• PKI Expertise: Deep cryptographic knowledge with proven experience building, migrating, and renewing enterprise-wide ADCS topologies.

• Infoblox: Expert-level administration of Infoblox Grid Manager, including large-scale network discovery, IPAM, and advanced DNS routing.

• Advanced Automation: High proficiency using PowerShell, Python, or automation platforms (Ansible, Terraform) to manage identity, PKI, and network resources at scale.

• Proven track record of working with cross-functional teams through major infrastructure transformations, outages, and architectural shifts.

Preferred Qualifications

• Desired Industry certifications (e.g., Microsoft Certified: Identity and Access Administrator Expert, Infoblox Core Professional/Expert).

• Expertise in hybrid cloud identity (Azure AD/Entra ID Connect, Okta and ManageEngine Identity solutions).

• Strong understanding of network security architectures (TLS 1.3, Kerberos, 802.1X authentication).