Senior Active Directory (AD) Engineer

• Design, install, configure, and maintain Active Directory forests, domains, organizational units, trusts, sites, subnets, and domain controllers.
• Administer and optimize Active Directory Domain Services, including replication topology, Flexible Single Master Operations (FSMO) roles, schema, global catalog, and directory health.
• Develop, implement, and enforce Group Policy Objects (GPOs) to support security, configuration management, access controls, and enterprise standards.
• Harden Active Directory environments by applying security baselines, privileged access controls, tiered administration practices, auditing, and remediation of identified vulnerabilities.
• Manage hybrid identity services and synchronization between on-premises Active Directory and Microsoft Entra ID using Microsoft Entra Connect / Azure AD Connect.
• Troubleshoot and resolve complex authentication, authorization, replication, trust, DNS, Kerberos, NTLM, LDAP, and directory performance issues.
• Create and maintain advanced PowerShell scripts to automate user and group provisioning, object lifecycle management, reporting, health checks, and routine administration.
• Plan and execute Active Directory upgrades, domain or forest migrations, forest consolidations, tenant integration activities, and decommissioning initiatives.
• Develop, test, and maintain disaster recovery procedures for domain controllers, schema, trusts, DNS-integrated zones, and critical identity services.
• Monitor Active Directory capacity, availability, security events, and service health; identify trends and implement preventive or corrective actions.
• Provide technical leadership and subject-matter expertise for identity-related incidents, problems, changes, and major infrastructure projects.
• Produce and maintain accurate technical documentation, including architecture diagrams, operating procedures, configuration standards, recovery plans, and knowledge articles.
• Collaborate with Cybersecurity, IAM, Cloud, Network, Server, Service Desk, and application teams to ensure identity solutions meet business, operational, and compliance requirements.
• Participate in change management, incident response, root-cause analysis, and continuous improvement activities in accordance with established IT service management practices.

​

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field; equivalent relevant professional experience may be considered.
• +5 years of hands-on experience administering and engineering Microsoft Active Directory in enterprise environments.
• Excellent communication skills in English (B2+ or higher) and ability to collaborate across functions and geographies.
• Experience supporting large-scale, multi-domain, multi-forest, or geographically distributed Active Directory environments.
• Experience managing Active Directory infrastructure, including domain controllers, forests, trusts, organizational units, replication, and Group Policy.
• Experience supporting hybrid identity environments that integrate on-premises Active Directory with Microsoft Entra ID.
• Experience troubleshooting complex authentication, replication, DNS, Kerberos, NTLM, LDAP, and directory service issues.
• Experience planning or executing Active Directory upgrades, migrations, consolidations, or disaster recovery activities.
• Experience operating within formal incident, problem, change, and configuration management processes.

• Advanced knowledge of Active Directory Domain Services (AD DS), Group Policy Objects (GPOs), organizational units, trusts, sites and services, replication, and FSMO roles.
• Strong knowledge of Microsoft Windows Server operating systems and core infrastructure services, including Domain Name System (DNS) and Dynamic Host Configuration Protocol (DHCP).
• Advanced PowerShell scripting skills for administration, automation, reporting, provisioning, and remediation.
• Hands-on experience with Microsoft Entra ID, Microsoft Entra Connect / Azure AD Connect, and hybrid identity architecture.
• Working knowledge of Active Directory Federation Services (AD FS), modern authentication, single sign-on, and identity federation concepts.
• Strong understanding of Kerberos, NTLM, LDAP/LDAPS, Public Key Infrastructure (PKI), certificates, and authentication flows.
• Knowledge of Active Directory security hardening, privileged access management, least privilege, audit controls, and security baselines.
• Ability to use monitoring, diagnostic, and administrative tools to evaluate directory health, replication, performance, and security events.
• Ability to create and maintain architecture diagrams, technical standards, runbooks, recovery procedures, and support documentation.

​

• Excellent written and verbal communication skills, with the ability to explain complex technical concepts to technical and non-technical audiences.
• Strong analytical, troubleshooting, and root-cause analysis capabilities.
• Ability to prioritize competing incidents, project activities, and operational responsibilities in a high-availability environment.
• Strong collaboration skills and the ability to work effectively across infrastructure, cybersecurity, cloud, IAM, and application teams.
• High level of accountability, attention to detail, documentation discipline, and security awareness.
• Ability to make sound technical decisions under pressure and during service restoration or disaster recovery events.
• Continuous improvement mindset with a focus on automation, reliability, standardization, and operational excellence.

​

• Microsoft Certified: Azure Administrator Associate, Azure Solutions Architect Expert, Identity and Access Administrator Associate, MCSE, or a comparable Microsoft certification.
• ITIL Foundation or higher certification.
• Experience with Microsoft Entra ID governance, Conditional Access, Privileged Identity Management, or identity protection capabilities.
• Experience with Active Directory security assessment and monitoring tools.
• Experience supporting multinational or global organizations and highly regulated environments.
• Experience with infrastructure-as-code, configuration management, or additional automation tools.
• Experience supporting cloud migrations, mergers and acquisitions, domain integrations, or enterprise transformation programs.

• This is a hybrid position based in Ultra Park II, Lagunilla (Heredia). On-site presence is required only when necessary, such as for meetings, trainings, or collaborative activities, in alignment with the company’s telework agreement, which currently requires employees to work on-site three (3) days per week)
• Private Medical Insurance
• Asociacion Solidarista
• Life Insurance
• Personal Day Off