Active Directory​/Identity Engineer; Senior

DecisionPoint seeks an Active Directory / Identity Engineer to own and sustain the Microsoft Active Directory Domain Services environment supporting the USMEPCOM ENLIST program. This senior engineering position manages AD objects, organizational units, Group Policy Objects, trusts, replication, schema governance, delegated permissions, domain services, and recovery capabilities.

The Active Directory / Identity Engineer ensures that directory services remain secure, available, recoverable, and aligned with USMEPCOM operational and cybersecurity requirements. The engineer supports domain and forest planning, account and group administration, site replication, trust relationships, Group Policy, domain-controller lifecycle activities, backup, restoration, and modernization.

The position also evaluates and tests approved Identity, Credential, and Access Management capabilities, including potential Okta integrations and other identity-modernization technologies. These modernization activities complement—not replace—the position’s requirement for direct, hands‑on AD DS engineering expertise.

The engineer works closely with cybersecurity, Service Desk, systems, cloud, network, application, COOP, and Government identity stakeholders. This position is remote, with Chicago‑area candidates preferred. Occasional after‑hours maintenance, incident response, COOP exercises, on‑site support, or travel may be required.

Note: By applying to this position, you acknowledge and consent to having your resume included in an active competitive government contract bid.

The Active Directory / Identity Engineer will:

• Serve as the senior technical owner for the USMEPCOM Active Directory Domain Services environment.
• Install, configure, maintain, update, troubleshoot, and recover Active Directory services and supporting components.
• Create, modify, disable, delete, and manage authorized AD objects in accordance with approved processes.
• Manage organizational units, users, computers, groups, service accounts, shared resources, and other directory objects.
• Maintain the domain plan, organizational‑unit plan, site plan, trust plan, Group Policy design, and related architecture documentation.
• Design and maintain an organizational‑unit structure that supports administration, policy application, security boundaries, and delegated management.
• Manage organizational‑unit permissions and administrative delegation using least‑privilege principles.
• Review delegated access and correct excessive, obsolete, inherited, or conflicting permissions.
• Develop, test, implement, maintain, and troubleshoot Group Policy Objects.
• Manage GPO links, inheritance, precedence, security filtering, loopback processing, WMI filters, backups, version history, and recovery.
• Evaluate proposed GPO changes for security, operational, and customer impact before production implementation.
• Identify and resolve conflicting, obsolete, duplicative, or ineffective Group Policy settings.
• Manage trust relationships with enterprise and external AD structures.
• Configure, validate, monitor, and troubleshoot domain and forest trusts within approved security boundaries.
• Review trust direction, transitivity, authentication scope, name‑suffix routing, and related security settings.
• Manage AD sites, subnets, site links, replication schedules, bridgehead behavior, and replication topology.
• Monitor and troubleshoot replication latency, failures, lingering objects, directory inconsistencies, and site‑topology problems.
• Maintain the health of domain controllers, directory databases, SYSVOL, DFS Replication, time synchronization, and AD‑integrated DNS dependencies.
• Monitor Flexible Single Master Operations roles and support approved role transfer or seizure when…