Senior Identity Infrastructure Engineer

Anticipated Contract End Date/Length: 6 months
Work Set Up: On-site, 5 days per week
Clearance Required: BPSS

Our client in the Information Technology and Services industry is looking for a Senior Identity Infrastructure Engineer to support and maintain the core identity infrastructure platforms underpinning the organisation's Identity and Access Management (IDAM) services. The successful candidate will be responsible for the administration, support, security, and continuous improvement of Active Directory, PKI, DNS, Group Policy, and authentication infrastructure, while providing L2/L3 operational support across the identity estate.

What you will do:

• Administer and maintain enterprise Active Directory forests, domains, and domain controllers.
• Manage Active Directory Sites and Services, replication topology, trusts, and directory services infrastructure.
• Administer AD-integrated DNS and support enterprise authentication services.
• Manage Group Policy architecture, including policy design, implementation, troubleshooting, and lifecycle management.
• Support Active Directory backup, recovery, disaster recovery, and business continuity processes.
• Monitor Active Directory platform health, performance, security, and replication.
• Support Active Directory upgrades, migrations, consolidation projects, and infrastructure improvements.
• Implement and maintain Active Directory security hardening standards and privileged access controls.
• Administer and support Microsoft Active Directory Certificate Services (AD CS).
• Manage Certificate Authorities, certificate templates, enrolment, and certificate lifecycle processes.
• Support Offline Root CA and Issuing CA infrastructure.
• Administer Certificate Revocation Lists (CRL), Authority Information Access (AIA), and certificate distribution services.
• Monitor certificate compliance, renewals, revocations, and expiration management.
• Maintain PKI operational documentation, recovery procedures, and security standards.
• Troubleshoot cryptographic and certificate-related issues across infrastructure and security platforms.
• Support Microsoft Entra Connect and hybrid identity infrastructure.
• Maintain LDAP, LDAPS, Kerberos, and NTLM authentication services.
• Support integrations between Active Directory and enterprise identity platforms, including MIM, Entra ID, Okta, and BeyondTrust.
• Support authentication, directory, and identity infrastructure incidents through to resolution.
• Provide L2/L3 support for identity-related incidents and service requests.
• Troubleshoot user provisioning, synchronisation, and authentication issues.
• Collaborate with IDAM engineers to investigate root causes and implement long-term solutions.
• Develop and maintain PowerShell automation for identity infrastructure administration.
• Drive service improvements, platform optimisation, and operational efficiencies.
• Contribute to security improvement initiatives, vulnerability remediation, and infrastructure modernisation.
• Produce and maintain technical documentation, operational procedures, and support runbooks.

• Possess extensive hands-on experience administering enterprise Active Directory environments.
• Demonstrate strong knowledge of Active Directory Domain Services (AD DS), Sites and Services, forest and domain administration, DNS, Group Policy, LDAP/LDAPS, Kerberos, trusts, replication, and AD backup and recovery.
• Have experience troubleshooting complex authentication and directory service issues.
• Possess strong experience administering Microsoft Active Directory Certificate Services (AD CS).
• Have experience managing Certificate Authorities, certificate templates, CRL and AIA infrastructure, certificate lifecycle management, enrolment services, key recovery, and archival.
• Possess experience supporting enterprise PKI environments.
• Have experience administering Windows Server 2016, 2019, and/or 2022 environments.
• Demonstrate strong PowerShell scripting and automation capabilities.
• Possess experience with security hardening, privileged administration, high availability, disaster recovery, infrastructure monitoring, and operational support.
• Have working knowledge of Microsoft Entra ID, Microsoft Entra Connect/Cloud Sync, Microsoft Identity Manager (MIM), Okta, and BeyondTrust.
• Understand Identity and Access Management (IAM), Joiner-Mover-Leaver processes, identity lifecycle management, authentication and authorisation, access governance, and Role-Based Access Control (RBAC).
• Have experience supporting hybrid identity architectures, preferably including MIM and Okta administration and integration.
• Possess knowledge of BeyondTrust PAM or Endpoint Privilege Management.
• Have experience with Tier 0 administration and privileged access models.
• Demonstrate familiarity with CrowdStrike, Zscaler, and security platform integrations.
• Possess experience supporting highly regulated or secure environments and ITIL-based operational support models.
• Have experience supporting large-scale enterprise identity programmes.
• Demonstrate the ability to operate independently in complex, security-focused environments and troubleshoot critical identity infrastructure issues.
• Collaborate effectively with operational, security, engineering, and IDAM teams.
• Meet BPSS eligibility requirements.
• Be willing to work on-site 5 days per week from secure facilities in Manchester or Inverness.
• Be willing to work through an umbrella company on a PAYE basis.

Candidates must be legally authorized to live and work in the country where the position is based, without requiring employer sponsorship.

HelloKindred is committed to fair, transparent, and inclusive hiring practices. We assess candidates based on skills, experience, and role-related requirements.

We appreciate your interest in this opportunity. While we review every application carefully, only candidates selected for an interview will be contacted.

HelloKindred is an equal opportunity employer. We welcome applicants of all backgrounds and do not discriminate on the basis of race, colour, religion, sex, gender identity or expression, sexual orientation, age, national origin, disability, veteran status, or any other protected characteristic under applicable law.