Nair Systems is currently looking Senior Active Directory & Identity Security Consultant our Qatar operations.
Required Skills & Experience
Experience
• 10+ years of Active Directory administration experience.
• 5+ years of Active Directory security hardening experience.
• Experience managing environments with:
• Multiple Forests
• Multiple Domains
• Complex Trust Relationships
• Hybrid Identity Deployments
Technical Skills
• Expert-level knowledge of:
• Active Directory Domain Services
• Group Policy Design and Administration
• Loopback Processing
• DNS Architecture and Security
• Windows Server 2016/2019/2022/2025
• Kerberos Authentication
• LDAP Security
• AD Replication
• AD Certificate Services
• PKI Infrastructure
• PowerShell Automation
• Microsoft Entra ID
• Identity Governance
Security Expertise
• Hands-on experience with:
• Active Directory Hardening
• Identity Threat Detection
• Identity Security Posture Management
• PAM Solutions
• Tier-0 Security
• Zero Trust Architecture
• Security Assessments
• Attack Path Remediation
Preferred Certifications
• Microsoft Certified: Identity and Access Administrator (SC-300)
• Microsoft Certified: Cybersecurity Architect (SC-100)
• Microsoft Security Operations Analyst (SC-200)
• Microsoft Certified Windows Server Hybrid Administrator
• CISSP
• CISM
Key Deliverables
• Active Directory Health Assessment
• AD Security Hardening Implementation
• GPO Architecture Review and Optimization
• DNS Security Assessment
• Multi-Forest and Trust Review
• Identity Security Posture Assessment
• Tier-0 Security Remediation
• Entra ID Security Review
• AD CS Security Assessment
• Knowledge Transfer and Operational Documentation
• PowerShell Automation and Operational Runbooks
Key Responsibilities
Active Directory Administration & Architecture
• Design, implement, administer, and optimize enterprise Active Directory environments.
• Manage:
• Domain Controllers
• FSMO Roles
• Sites and Services
• Replication Topologies
• Global Catalogs
• AD Schema
• Organizational Units (OU)
• Fine-Grained Password Policies
• Perform Active Directory health checks and remediation.
• Support domain consolidations, migrations, upgrades, and modernization initiatives.
• Develop and maintain Active Directory standards and operational procedures.
Group Policy (GPO) Design & Management
• Design, implement, and manage enterprise Group Policy architecture.
• Create and maintain:
• Security Baselines
• Administrative Templates
• User Configuration Policies
• Computer Configuration Policies
• Windows Hardening Policies
• Configure and troubleshoot:
• Loopback Processing (Merge and Replace Modes)
• WMI Filters
• Security Filtering
• GPO Delegation
• Group Policy Preferences
• Optimize Group Policy performance and inheritance.
• Conduct GPO audits, cleanup, and standardization exercises.
• Implement security controls through GPOs in alignment with Microsoft and CIS benchmarks.
Active Directory Security Hardening
• Lead Active Directory security assessments and remediation initiatives.
• Implement hardening controls for:
• Kerberos
• NTLM
• LDAP
• SMB
• Domain Controllers
• DNS Services
• AD Certificate Services
• Service Accounts
• Trust Relationships
• Design and implement:
• Tiered Administration
• Privileged Access Workstations (PAW)
• Just-In-Time Access (JIT)
• Just Enough Administration (JEA)
• Protected Users
• Authentication Silos
• Review and secure Administrative Groups and Privileged Identities.
• Perform Identity Attack Path Analysis and remediation.
DNS Architecture & Security
• Administer enterprise DNS infrastructure.
• Design and manage:
• AD Integrated Zones
• Forward Lookup Zones
• Reverse Lookup Zones
• Conditional Forwarders
• Stub Zones
• Delegated Zones
• Configure and troubleshoot:
• DNS Replication
• Dynamic DNS
• Name Resolution
• Split-Brain DNS
• DNS Failover
• Implement DNS security controls and best practices.
• Secure DNS against spoofing, poisoning, reconnaissance, and zone transfer risks.
• Review and manage DNS trust relationships and namespace architecture.
Multi-Forest & Trust Architecture
• Design and secure:
• Multi-Domain Forests
• Multi-Forest Architectures
• Resource Forests
• Account Forests
• Configure and manage:
• Forest Trusts
• External Trusts
• Shortcut Trusts
• Realm Trusts
• Assess trust relationships for security vulnerabilities.
• Design secure authentication flows across forests.
• Support mergers, acquisitions, and cross-forest migration projects.
Identity Security Posture Management
• Perform assessments using:
• SentinelOne Ranger
• Microsoft Defender for Identity
• Semperis DSP
• PingCastle
• BloodHound
• Purple Knight
• Tenable Identity Exposure
• Quest Identity Security Solutions
• Identify:
• Excessive Privileges
• Attack Paths
• Tier-0 Exposure
• Unconstrained Delegation
• Weak Kerberos Configurations
• Password Weaknesses
• Trust Relationship Risks
• Develop remediation plans and security improvement roadmaps.
Microsoft Entra ID & Hybrid Identity
• Design and support hybrid identity environments.
• Implement and manage:
• Microsoft Entra ID
• Entra Connect
• Cloud Sync
• Pass-Through Authentication
• Password Hash Sync
• Federation Services
• Configure:
• Conditional Access
• Identity Protection
• Privileged Identity Management (PIM)
• Access Reviews
• Lifecycle Management
• Support Microsoft 365 identity and access governance initiatives.
Privileged Access & Identity Governance
• Implement and manage Privileged Access Management solutions.
• Secure:
• Tier-0 Assets
• Service Accounts
• Group Managed Service Accounts (gMSA)
• Break Glass Accounts
• Administrative Workstations
• Integrate with CyberArk or equivalent PAM solutions.
• Conduct periodic access reviews and privilege audits.
Active Directory Certificate Services (AD CS)
• Design and administer Microsoft PKI infrastructure.
• Manage:
• Enterprise CAs
• Subordinate CAs
• Certificate Templates
• Auto Enrollment
• CRL Distribution
• OCSP
• Assess and remediate AD CS security vulnerabilities.
• Support certificate lifecycle management integrations (e.g., Keyfactor, DigiCert).
Joining time frame: 2 weeks (maximum 1 month)
Company Profile
Nair Systems, is a QFC based, boutique leading edge technology consulting and professional services firm focusing on Digital Banking, Artificial Intelligence, Big Data & Data Analytics, Cyber Security, Blockchain and Cryptocurrency and Robotic Process Automation.