Senior Identity Security Architect, Active Directory (Remote, Contract)
斯塔福德·格雷正在为全球身份安全咨询公司聘请几位高级身份安全建筑师。这些是长期，完全远程的合同角色，用于熟悉 Active Directory 在最深层次的专家，并希望解决大型企业的难以解决的身份安全问题。客户会议可能需要偶尔旅行，通常每年几次。我们寻找顶级技术人才。这个职能集中于实践架构和修复，而不是人员管理。补偿非常竞争力，基于经验。你会做什么？·评估和加强企业的 Active Directory 环境，包括森林，信托，Kerberos,集团政策，许可证和委托 ·安全 Active Directory 认证服务 (ADCS) 和修复基于证书的攻击路径 ·设计和实施 Tier 0保护，包括行政层次化，特权访问工作站和最小特权 ·识别和修复攻击路径，身份证盗窃以及侧面移动风险 ·安全的 Active Directory 与 Microsoft Entra ID 之间的混合身份，包括强有力的验证和条件访问 ·实现正时及正足访问以减少立场特权 · 计划和测试 Active Directory 森林恢复和勒索软件弹性 · 安全服务帐户和其他非人类身份你带来什么 · 在大型企业环境中保护 Active Directories 的广泛实践经验 · 深入了解 ADCS,Kerberos,Tier 0设计以及享有特权访问 ·使用 BloodHound,PingCastle, Purple Knight,Semperis 或 Microsoft Identity Defender 等工具的经验 ·强大的 Microsoft Entra ID 和混合身份经验 ·能够向客户利益相关者清楚解释技术风险 ·身份管理 （SailPoint, Saviynt 或 Entra ID Governance）,包括访问审查和连接器，移动器，离开器自动化 · 享有特权的访问管理工具如 CyberArk 或 BeyondTrust ·与 XDR 或威胁猎户结合身份遥测技术的经验 ·证书和加密现代化或量子准备计划 ·SC-100,SC-300,CRTP,CRTE,OSCP 或 CISSP 等认证 ·合同角色，W2或1099 ·完全远程，美国本地 ·长期参与 原创于喜马拉雅山上发布
查看英文原文
Stafford Gray is hiring several Senior Identity Security Architects on behalf of a global identity security consultancy. These are long-term, fully remote contract roles for experts who know Active Directory at its deepest level and want to solve hard identity security problems for large enterprises. Occasional travel for client meetings may be required, typically a few times per year.
We are looking for top-tier technical talent. This role is focused on hands-on architecture and remediation, not people management. Compensation is highly competitive and based on experience.
What You Will Do
- Assess and harden enterprise Active Directory environments, including forests, trusts, Kerberos, Group Policy, permissions, and delegation
- Secure Active Directory Certificate Services (ADCS) and remediate certificate-based attack paths
- Design and implement Tier 0 protection, including administrative tiering, privileged access workstations, and least privilege
- Identify and remediate attack paths, credential theft exposure, and lateral movement risk
- Secure hybrid identity between Active Directory and Microsoft Entra ID, including strong authentication and Conditional Access
- Implement Just-in-Time and Just-Enough Access to reduce standing privilege
- Plan and test Active Directory forest recovery and ransomware resilience
- Secure service accounts and other non-human identities
What You Bring
- Extensive hands-on experience securing Active Directory in large enterprise environments
- Deep knowledge of ADCS, Kerberos, Tier 0 design, and privileged access
- Experience with tools such as BloodHound, PingCastle, Purple Knight, Semperis, or Microsoft Defender for Identity
- Strong experience with Microsoft Entra ID and hybrid identity
- Ability to explain technical risk clearly to client stakeholders
Requirements
Nice to Have
- Identity governance (SailPoint, Saviynt, or Entra ID Governance), including access reviews and joiner, mover, leaver automation
- Privileged access management tools such as CyberArk or BeyondTrust
- Experience integrating identity telemetry with XDR or threat hunting
- Certificate and cryptographic modernization or quantum readiness planning
- Certifications such as SC-100, SC-300, CRTP, CRTE, OSCP, or CISSP
Details
- Contract role, W2 or 1099
- Fully remote, US-based
- Long-term engagement
Originally posted on Himalayas