Senior Active Directory Engineer – Mergers, Acquisitions & Divestitures

Description

The company is hiring a senior Active Directory engineer to design and build the identity work for its acquisitions. You will assess newly acquired environments, then plan and carry out the migration, consolidation and coexistence of directories across several forests. Every connection between two organisations must be secure, auditable and reversible. The same kind of work applies to divestitures.

This is a hands-on position. You will work with IT leadership, Security, Legal and the Integration Management Office to get identity ready for Day 1 and to consolidate it over the long term, often on tight timelines.

Responsibilities

• Assess acquired environments before and after closing: forest and domain layout, trusts, GPOs, schema, DNS, PKI, service accounts, privileged access and existing technical debt.
• Plan how acquired forests will move into a target forest, including temporary trusts or federation to bridge Day 1. Flag cases where consolidation is unwise, such as regulatory separation or legacy apps that cannot be supported.
• Run inter-forest migrations of users, groups, computers and service accounts in waves. Cover SID history, password migration or sync, workstation rejoins, profile moves and cutover of resource access.
• Clean up acquired objects before migration: name clashes, UPN and email suffix conflicts, stale accounts, duplicate groups and deeply nested groups.
• Migrate or rebuild dependent services such as DNS, DHCP, file shares and their ACLs, ADCS and PKI, application service accounts and LDAP or Kerberos-dependent apps.
• Deliver Day-1 services: cross-company email and calendar visibility, collaboration access and single sign-on to shared applications.
• Carry out long-term consolidation, including decommissioning forests and domains, cleaning up SID history, standardising GPOs and naming, and removing legacy trusts, domain controllers and stale objects.
• Coordinate tenant-to-tenant moves with the messaging and collaboration teams.
• Maintain a repeatable integration playbook and refine it after each deal.
• Support divestitures by mapping dependencies, cleaning up entitlements and providing identity support during Transition Service Agreements (TSAs).
• Decommission shared trusts and sync connections when a TSA ends.
• Review the security posture of acquired environments before any connection is made, covering AD health, privileged account exposure, legacy protocols and unpatched domain controllers.
• Design secure connections between companies using selective-authentication trusts, network segmentation, tiered administration and least-privilege access.
• Fix common AD attack paths such as Kerberoasting, unconstrained delegation, AdminSDHolder abuse, weak ADCS templates and excess Domain Admin membership.
• Work with Security and the SOC on monitoring, logging and incident response during integration.
• Support audit and regulatory work such as SOX, HIPAA, PCI and GDPR, where they apply.
• Keep runbooks, cutover plans, rollback plans and post-migration checklists up to date.
• Give Tier 3 support for complex AD, DNS, DHCP, GPO and PKI issues.
• Mentor junior engineers and help build standards and automation.

Requirements

• 8+ years of experience engineering enterprise Active Directory across multiple domains and forests.
• Hands-on M&A experience: at least [2-3] completed acquisitions or mergers where you personally led or carried out the identity work.
• Hands-on use of AD migration tools, such as Quest or Binary Tree On Demand Migration or Migration Manager, Microsoft ADMT, Microsoft Entra Connect or Cloud Sync, or other third-party tools such as ShareGate, BitTitan, Semperis, CoreView or equivalents.
• Deep knowledge of trust types and cross-forest design, including selective authentication, SID filtering, SID history and quarantine.
• Proven record of consolidating acquired forests into one target forest, with inter-forest migrations of at least [1,000+] users, and decommissioning the source forest.
• Strong grasp of AD security: tiered administration, PAM and PAW, LAPS, Kerberos and NTLM hardening, ADCS security, and attack and defence techniques.
• Solid working knowledge of DNS, DHCP, GPO, Sites and Services, replication and PKI or ADCS.
• Advanced PowerShell for automation, reporting and bulk changes.
• Experience with hybrid identity: Microsoft Entra ID, Entra Connect, tenant-to-tenant migration and Conditional Access.
• Clear communicator who can explain risk and trade-offs to executives, lawyers and non-technical stakeholders.
• Bachelor's degree in IT, Computer Science or equivalent experience.
• Preferred: divestiture experience.
• Preferred: tenant-to-tenant migrations in Microsoft 365 covering Exchange, Teams and SharePoint or OneDrive.
• Preferred: experience with identity security tools such as Microsoft Defender for Identity, Semperis DSP, Tenable AD, PingCastle or BloodHound used defensively.
• Preferred: federation and SSO between organisations using AD FS, SAML, OIDC, Ping or Okta.
• Preferred: Day-1 and Day-100 integration planning, working alongside an IMO, and exposure to TSAs.
• Preferred: PAM tools such as CyberArk, BeyondTrust or Delinea, and IGA tools such as SailPoint or Saviynt.
• Preferred: ITIL or change management in regulated environments.
• Preferred: certifications such as Microsoft AZ-500, SC-300 or MS-102, CISSP, or GIAC GCWN or GPPA, or similar.

Conditions

Full-time position.

Occasional travel to acquired sites, about [x%] of the time.

On-call and weekend cutover work is expected during migrations.

Benefits

• Medical, dental and vision coverage.
• Wellness support across physical, emotional, financial and social areas.
• Family support, including backup dependent care, adoption assistance, infertility coverage, family building support, behavioural health solutions, paid parental leave and paid caregiver leave.
• Training programmes, professional development resources, mentoring, employee resource groups and volunteer activities.