Senior Active Directory Architect / SME

Location: Remote
Duration: 8–10 Weeks

Clearance: Public Trust

Position Overview

We are seeking a highly experienced Senior Active Directory Infrastructure Architect / SME to provide technical leadership for a large-scale Active Directory modernization and migration initiative within a federal enterprise environment.

The consultant will provide architecture and subject matter expertise for the modernization of existing Active Directory infrastructure, including migration from legacy Windows Server platforms to Windows Server 2025 and development of a secure hybrid Active Directory architecture spanning on-premises infrastructure and Microsoft Azure IaaS.

The selected candidate will serve as a technical lead and trusted advisor, providing assessment, architecture, migration strategy, validation, documentation, and knowledge transfer. Implementation activities will be performed in collaboration with customer technical teams under the guidance of the SME.

Key Responsibilities

Active Directory Assessment & Planning

• Conduct comprehensive assessments of existing Active Directory environments, including:
  • Forests and domains
  • Trust relationships
  • Sites and Services
  • Replication
  • DNS and DHCP
  • Group Policy
  • PKI integrations
• Identify technical dependencies, legacy application constraints, security risks, and migration challenges.
• Develop migration strategies, implementation roadmaps, rollback procedures, and maintenance plans.
• Lead technical workshops with infrastructure, security, networking, and application stakeholders.

Architecture & Design

• Design modern hybrid Active Directory architectures integrating on-premises and Microsoft Azure IaaS domain controllers.
• Develop AD site topology, replication strategies, DNS architecture, and network integration designs.
• Define Azure infrastructure architecture, including:
  • Virtual networks
  • Subnets
  • Resource groups
  • Network Security Groups
  • Hybrid connectivity
• Establish security baselines, hardening standards, auditing, monitoring, and compliance requirements.

Migration & Modernization

• Provide technical leadership for Active Directory schema upgrades and domain/forest functional-level enhancements.
• Guide deployment and promotion of Windows Server 2025 Domain Controllers.
• Lead or advise on FSMO role transfers and DNS/DHCP migration activities where applicable.
• Validate authentication services, Group Policy processing, AD replication, and DNS functionality throughout the migration.
• Provide technical guidance to implementation teams and troubleshoot migration-related issues.

Legacy Domain Controller Decommissioning

• Plan and oversee retirement of legacy Windows Server 2012 R2 Domain Controllers.
• Guide domain controller demotion and metadata cleanup procedures.
• Perform or oversee DNS cleanup and post-migration validation.
• Ensure migration activities minimize business disruption and maintain service availability.

Documentation & Knowledge Transfer

• Develop architecture diagrams, migration procedures, operational runbooks, and as-built documentation.
• Conduct final validation and Active Directory health assessments.
• Provide knowledge-transfer sessions to infrastructure and operations teams.
• Document operational recommendations, best practices, and ongoing maintenance requirements.

Required Qualifications

• 10+ years of enterprise Active Directory administration, engineering, and architecture experience.
• Extensive experience with:
  • Active Directory Domain Services (AD DS)
  • Windows Server 2012 R2 through Windows Server 2025
  • DNS and DHCP
  • Group Policy
  • PKI
  • Active Directory replication
  • FSMO roles
  • Active Directory Sites and Services
  • Domain Controller migrations
  • Hybrid identity and Microsoft Azure infrastructure
• Strong knowledge of:
  • Active Directory security hardening
  • Forest and domain functional levels
  • SYSVOL replication, including DFSR/FRS
  • Backup and disaster recovery
  • Migration rollback planning
  • Enterprise networking
  • VPNs, routing, firewalls, and hybrid connectivity
  • Azure networking and IaaS architecture
• Demonstrated experience leading enterprise infrastructure modernization and migration projects.
• Strong technical documentation and architecture skills.
• Excellent communication, stakeholder management, and technical leadership abilities.
• Ability to work independently in a remote consulting environment.

Preferred Qualifications

• Microsoft certifications related to Azure, Windows Server, Active Directory, or Identity Management.
• Experience supporting federal, defense, or highly regulated environments.
• Familiarity with security frameworks, audit requirements, and compliance standards.
• Experience integrating Active Directory with SIEM, monitoring, and centralized logging platforms.
• Experience designing and implementing hybrid identity solutions in large enterprise environments.