Infrastructure Engineer - #2166544

Senior Identity Infrastructure Engineer – Active Directory & PKI

Location: Manchester or Inverness, within secure facilities

About the role

We are seeking an experienced Senior Identity Infrastructure Engineer to support and maintain the platforms underpinning enterprise Identity and Access Management (IDAM) services.

You will administer, secure and improve Active Directory, Public Key Infrastructure (PKI), DNS, Group Policy and authentication infrastructure. Working closely with security, engineering and IDAM teams, you will provide L2/L3 operational support and help ensure critical identity platforms remain available, resilient and secure.

Key responsibilities

Active Directory infrastructure

• Administer enterprise AD forests, domains and domain controllers.

• Manage AD Sites and Services, replication topology, trusts and directory infrastructure.

• Administer AD-integrated DNS and Group Policy, including design, implementation, troubleshooting and lifecycle management.

• Monitor platform health, performance, security and replication.

• Support AD backup, recovery, disaster recovery and business continuity.

• Support upgrades, migrations, consolidation and infrastructure improvements.

• Implement security hardening and privileged access controls.

Public Key Infrastructure

• Administer Microsoft Active Directory Certificate Services (AD CS).

• Manage Certificate Authorities, certificate templates, enrolment and lifecycle processes.

• Support Offline Root CA and Issuing CA infrastructure.

• Maintain Certificate Revocation Lists (CRL), Authority Information Access (AIA) and certificate distribution services.

• Monitor certificate compliance, renewals, revocations and expiry.

• Maintain PKI documentation, recovery procedures and security standards.

• Troubleshoot cryptographic and certificate-related issues.

Identity infrastructure and operational support

• Support Microsoft Entra Connect and hybrid identity infrastructure.

• Maintain LDAP, LDAPS, Kerberos and NTLM authentication services.

• Support AD integrations with Microsoft Identity Manager (MIM), Entra ID, Okta and BeyondTrust.

• Provide L2/L3 support for identity incidents and service requests.

• Troubleshoot provisioning, synchronisation, authentication and directory issues.

• Collaborate with IDAM engineers on root cause analysis and lasting solutions.

• Support wider identity operations during periods of increased demand.

Automation and continuous improvement

• Develop and maintain PowerShell automation for identity infrastructure administration.

• Improve platform performance, service delivery and operational efficiency.

• Contribute to vulnerability remediation, security improvements and infrastructure modernisation.

• Maintain technical documentation, operational procedures and support runbooks.

Essential skills and experience

Active Directory

• Extensive hands-on experience administering enterprise AD environments.

• Strong knowledge of AD DS, Sites and Services, forests and domains, DNS, Group Policy, LDAP/LDAPS, Kerberos, trusts and replication.

• Experience with AD backup and recovery.

• Ability to troubleshoot complex authentication and directory service issues.

PKI

• Strong experience administering Microsoft AD CS in enterprise environments.

• Experience managing Certificate Authorities, templates, CRL/AIA infrastructure, certificate lifecycle and enrolment services.

• Experience with key recovery and archival.

Infrastructure platforms

• Windows Server 2016/2019/2022 administration.

• PowerShell scripting and automation.

• Security hardening and privileged administration.

• High availability and disaster recovery planning.

• Infrastructure monitoring and operational support.

Identity technologies

• Working knowledge of Microsoft Entra ID, Entra Connect/Cloud Sync, MIM, Okta and BeyondTrust.

• Understanding of IAM, Joiner/Mover/Leaver processes, identity lifecycle management, authentication, authorisation, access governance and role-based access control (RBAC).

Desirable skills and experience

• Hands-on support for MIM and hybrid identity architectures.

• Okta administration and integration.

• BeyondTrust Privileged Access Management (PAM) or Endpoint Privilege Management.

• Tier 0 administration and privileged access models.

• CrowdStrike, Zscaler and security platform integrations.

• Experience in highly regulated or secure environments.

• Knowledge of ITIL operational support models.

• Experience supporting large-scale enterprise identity programmes.

Security clearance

Appointment requires Security Check (SC) clearance. For this vacancy, applicants must have resided continuously in the UK for the last five years and meet the other applicable clearance requirements.

During recruitment, you will be asked about clearance eligibility, including country of residence and nationality. Some posts are restricted to sole UK nationals; any applicable citizenship requirements will be confirmed during the application process.