Senior Identity Security Architect, Active Directory

Stafford Gray LLC

. Assess and harden enterprise Active Directory environments, including forests, trusts, Kerberos, Group Policy, permissions, and delegation .

Posted 10/14/2026contractRemote • Minnesota • United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive hands-on experience in securing Active Directory environments and implementing identity governance solutions. Proficient in designing Tier 0 protections and remediating attack paths while effectively communicating technical risks to stakeholders.

Highest-signal resume keywords

Active Directory SecurityIdentity GovernancePrivileged Access ManagementMicrosoft Entra IDCertificate Services

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Active DirectoryKerberosTier 0 DesignJust-in-Time AccessJust-Enough AccessCredential Theft RemediationRansomware ResilienceIdentity Telemetry IntegrationCryptographic ModernizationHybrid Identity Security

Soft Skills

Technical Risk Communication

Tools & Technologies

BloodHoundPingCastlePurple KnightSemperisMicrosoft Defender for IdentityCyberArkBeyondTrustSailPointSaviyntXDR

Certifications & Qualifications

SC-100SC-300CRTPCRTEOSCPCISSP

Industry Keywords

Enterprise SecurityAccess ReviewsJoiner Mover Leaver AutomationNon-Human IdentitiesPrivileged Access Workstations

About the role

Key responsibilities & impact

Assess and harden enterprise Active Directory environments, including forests, trusts, Kerberos, Group Policy, permissions, and delegation
Secure Active Directory Certificate Services (ADCS) and remediate certificate-based attack paths
Design and implement Tier 0 protection, including administrative tiering, privileged access workstations, and least privilege
Identify and remediate attack paths, credential theft exposure, and lateral movement risk
Secure hybrid identity between Active Directory and Microsoft Entra ID, including strong authentication and Conditional Access
Implement Just-in-Time and Just-Enough Access to reduce standing privilege
Plan and test Active Directory forest recovery and ransomware resilience
Secure service accounts and other non-human identities
Perform hands-on architecture and remediation for large enterprises
Explain technical risk clearly to client stakeholders

Requirements

What you’ll need

Extensive hands-on experience securing Active Directory in large enterprise environments
Deep knowledge of ADCS, Kerberos, Tier 0 design, and privileged access
Experience with tools such as BloodHound, PingCastle, Purple Knight, Semperis, or Microsoft Defender for Identity
Strong experience with Microsoft Entra ID and hybrid identity
Ability to explain technical risk clearly to client stakeholders
Identity governance (SailPoint, Saviynt, or Entra ID Governance), including access reviews and joiner, mover, leaver automation
Privileged access management tools such as CyberArk or BeyondTrust
Experience integrating identity telemetry with XDR or threat hunting
Certificate and cryptographic modernization or quantum readiness planning
Certifications such as SC-100, SC-300, CRTP, CRTE, OSCP, or CISSP
Contract role, W2 or 1099
Fully remote, US-based
Long-term engagement

Benefits

Comp & perks

Occasional travel for client meetings may be required, typically a few times per year