Active Directory (AD) Engineer

About the role

Sysco is seeking an experienced Active Directory Engineer to design, implement, secure, and maintain enterprise‑level AD DS and hybrid Microsoft Entra ID environments. The role ensures identity infrastructure is available, performant, and resilient across complex multi‑domain and multi‑forest landscapes.

Key responsibilities

• Design, install, configure, and maintain AD forests, domains, OUs, trusts, sites, subnets, and domain controllers.
• Administer replication topology, FSMO roles, schema, global catalog, and overall directory health.
• Develop, implement, and enforce Group Policy Objects to meet security and configuration standards.
• Harden AD environments with security baselines, privileged access controls, tiered administration, and regular audits.
• Manage hybrid identity synchronization using Microsoft Entra Connect / Azure AD Connect.
• Troubleshoot complex authentication, authorization, replication, DNS, Kerberos, NTLM, LDAP, and performance issues.
• Create and maintain PowerShell scripts for automation of provisioning, reporting, health checks, and routine administration.
• Plan and execute AD upgrades, domain/forest migrations, consolidations, and decommissioning projects.
• Develop and test disaster recovery procedures for domain controllers, schema, trusts, and DNS‑integrated zones.
• Monitor capacity, availability, security events, and service health, identifying trends for continuous improvement.

Required profile

• Proven experience managing large‑scale Active Directory and hybrid Microsoft Entra ID environments.
• Strong understanding of authentication protocols (Kerberos, NTLM) and DNS infrastructure.
• Ability to work collaboratively with Cybersecurity, IAM, Cloud, Network, Service Desk, and application teams.
• Excellent problem‑solving skills for complex directory and replication issues.

Required skills

• Active Directory Domain Services (AD DS)
• Microsoft Entra ID / Azure AD Connect
• Group Policy Objects (GPO)
• PowerShell scripting
• Kerberos, NTLM, DNS, LDAP
• Replication topology and FSMO role management
• Schema and global catalog administration
• Disaster recovery planning for identity services
• Automation and monitoring tools