Staff Platform Engineer – Active Directory & Identity Services

About the role

The Staff Platform Engineer will own the technical direction of enterprise Active Directory across a complex hybrid identity environment. You will design, build and improve secure identity services spanning on‑premises infrastructure, AWS and Microsoft Entra ID, while mentoring engineers and driving automation.

Key responsibilities

• Act as senior technical authority for Active Directory across on‑premises, AWS‑hosted and AWS‑managed directory environments.
• Design hybrid directory topologies, including domain controller placement, replication, DNS, network connectivity and trust patterns.
• Strengthen identity security through privileged access controls, tiered administration, hardening standards and credential protection.
• Lead migration to modern identity architectures, including cloud migration, hybrid integration and legacy retirement.
• Champion automation, infrastructure‑as‑code and reusable engineering patterns across identity services.

Required profile

• Deep, practical Active Directory expertise at enterprise scale.
• Strong identity‑security mindset covering least‑privilege, tiered administration and attack‑path reduction.
• Experience operating hybrid AD estates on‑premises and in AWS (EC2‑hosted DCs, AWS Managed Microsoft AD).
• Ability to mentor engineers and influence architecture and security standards.

Required skills

• Active Directory (forest/domain design, GPO, DNS, DFS, replication, trusts, schema).
• Microsoft Entra ID (hybrid identity, sync, Conditional Access, modern authentication).
• AWS services for directory workloads (EC2, AWS Managed Microsoft AD).
• Infrastructure‑as‑code tools: Terraform, AWS CDK, CloudFormation, Ansible, GitHub Actions.
• Scripting/automation for identity operations.
• Observability tools: Grafana, Prometheus.