Senior Principal Infrastructure Engineer / SME (Active Directory, ADCS & Infoblox)

We are seeking a Senior Subject Matter Expert (SME) with 10+ years of enterprise experience to architect, secure, and govern our core identity, PKI, and network core services. In this senior leadership-level engineering role, you will own the long-term roadmap, security posture, and global availability for Microsoft Active Directory (AD), Microsoft Enterprise Certificate Services (ADCS), and Infoblox (DNS/DHCP/IPAM).Key ResponsibilitiesEnterprise Identity (Active Directory)• Design, optimize, and govern a highly available, on-premises Active Directory infrastructure.• Security & Hardening: Assist in enforcing strict administrative tiering models and least-privilege access frameworks to defend against advanced threats.• GPO & Compliance: Create, organize and enforce complex Group Policy Objects (GPOs) to maintain global security baselines and regulatory compliance.• Consolidation & Strategy: Lead domain mergers, directory consolidations, and hybrid integrations with cloud identity solutions.Enterprise PKI Governance (Microsoft Enterprise Certificate Server)• PKI Architecture: Serve as the ultimate authority on the lifecycle, trust models, and design of the Microsoft Enterprise PKI environment, including offline Root CAs and subordinate Issuing CAs.• Policy Enforcement: Establish and review Certificate Policy and Certification Practice Statements (CP/CPS), automated enrollment protocols, and CRL/OCSP validation paths.• Disaster Recovery: Formulate, test, and execute bulletproof backup and disaster recovery strategies for critical cryptographic infrastructure.Infoblox DDI• Grid Infrastructure Ownership: Oversee the architectural design, patching, upgrade cycles, and capacity planning for the global Infoblox Grid (NIOS).• Advanced DDI Management: Configure and troubleshoot complex global DNS views, DNSSEC, multi-vendor zone transfers, and high-availability DHCP failover setups.• Introduce greater efficiency to network, host and application deployments by using Infoblox API integrations, automated IPAM allocations, and infrastructure-as-code deployment pipelines.CORE COMPETENCIESIdentity & PKI: Microsoft Active Directory (AD DS), Azure AD / Entra ID, Group Policy (GPO), Enterprise Certificate Server (ADCS), Certificate Lifecycle Management. Cloud identity providers (Okta, Azure etc.).Core Infrastructure: DNS, DHCP, WINS, Group Policy Objects (GPO), FSMO Roles, AD Schema design, Forest/Domain Trusts, LDAPAutomation & Scripting: PowerShell, Azure AD Connect, Graph API, Automated Certificate Revocation, Stale Account CleanupNetwork Services: Infoblox IPAM, DNS, DHCP (DDI), Grid Management.Data Security: Advanced Windows Permissions (NTFS/Acls), Share Permissions, Security Auditing, Access Control Lists (ACLs).Security & Hardening: Tiered Administration Models (Red Forest/ESC frameworks), Kerberos Hardening, Vulnerability Remediation, AD Health Checks.Familiar with ITIL and change control.Able to perform complex incident management across multiple teams.TECHNICAL SKILLSDirectory Services: Active Directory, Active Directory Federated Services (ADFS), Kerberos, LDAP, GPO.Public Key Infrastructure: ADCS, Certificate Authorities (Root/Subordinate), CRL, OCSP, NDES.On premise and cloud identity providers (Okta, Azure etc.)Storage & File Systems: Dell PowerScale, OneFS, CIFS/SMB, NFS, Everpure File Systems.Linux and Unix OS and file systems and interop with Windows clients and servers (AD POSIX compatibility)Networking & Core Services: Infoblox NIOS, DNSSEC, DHCP Failover, IPAM.Automation & Scripting: PowerShell, Python, Bash, Active Directory module.OS Environments: Windows Server (2012 through 2022/2025), Red Hat Enterprise Linux and other Linux distributions.Complex incident management and communication skillsCapacity planningVendor management (procurement and licensing)SFTP, SCP, NTP, SSH, HTTPS, clients and serverMS Office, VisioVMware and/or other virtualization technologies.Networking experience and able to collaborate with networking engineers to troubleshoot complex endpoint and server networking issues L1 to 8 (ping, tracert, wireshark)Rubrik or similar backup technologiesRequired Qualifications & Skills• Experience: 10+ years of dedicated engineering experience in complex, large-scale enterprise infrastructures.• Active Directory Mastery: Expert-level knowledge of AD directory replication, site topologies, trust relationships, and forensic troubleshooting.• PKI Expertise: Deep cryptographic knowledge with proven experience building, migrating, and renewing enterprise-wide ADCS topologies.• Infoblox: Expert-level administration of Infoblox Grid Manager, including large-scale network discovery, IPAM, and advanced DNS routing.• Advanced Automation: High proficiency using PowerShell, Python, or automation platforms (Ansible, Terraform) to manage identity, PKI, and network resources at scale.• Proven track record of working with cross-functional teams through major infrastructure transformations, outages, and architectural shifts.Preferred Qualifications• Desired Industry certifications (e.g., Microsoft Certified: Identity and Access Administrator Expert, Infoblox Core Professional/Expert).• Expertise in hybrid cloud identity (Azure AD/Entra ID Connect, Okta and ManageEngine Identity solutions).• Strong understanding of network security architectures (TLS 1.3, Kerberos, 802.1X authentication).