Senior Microsoft Infrastructure Engineer

About Ferrilli

Ferrilli (Robert Ferrilli, LLC) is a higher education IT professional services firm headquartered in Haddonfield, NJ. Our Enterprise Technology Services (ETS) practice helps colleges and universities modernize, secure, and run their infrastructure, from on-premises data centers to Microsoft cloud platforms.

Position summary

The Senior Microsoft Infrastructure Engineer is Ferrilli's lead technical resource for Active Directory and hybrid identity, with deep hands-on Azure administration skills. You will assess, remediate, and modernize on-premises AD environments, then extend them securely into Microsoft Entra ID and Azure.

This is a client-facing consulting role. You will work directly with campus IT leaders, deliver projects end to end, and serve as the escalation point for complex Microsoft infrastructure issues across multiple institutions.

Key responsibilities

On-premises Active Directory

• Design, administer, and troubleshoot multi-site AD DS environments, including forests, domains, trusts, sites and services, and replication.
• Lead AD health assessments, cleanup, and consolidation, including stale objects, OU redesign, and domain or forest migrations.
• Manage Group Policy architecture, DNS, DHCP, and AD Certificate Services (PKI).
• Harden AD using tiered administration, least-privilege delegation, LAPS, and remediation of findings from tools such as PingCastle or Purple Knight.
• Plan and execute domain controller upgrades, functional level raises, and AD backup and forest recovery procedures.

Hybrid identity

• Implement and maintain Microsoft Entra Connect / Cloud Sync, including password hash sync, pass-through authentication, and federation (AD FS) decisions.
• Configure Conditional Access, MFA, SSPR, and Privileged Identity Management.
• Integrate campus identity sources (for example, ERP-driven provisioning) with AD and Entra ID.

Azure administration

• Build and govern Azure environments: subscriptions, management groups, RBAC, Azure Policy, and landing zones.
• Administer IaaS workloads, virtual networks, VPN/ExpressRoute connectivity, storage, and Azure Backup and Site Recovery.
• Monitor cost, performance, and security with Azure Monitor, Defender for Cloud, and Cost Management.
• Automate administration with PowerShell, Azure CLI, and infrastructure as code (Bicep, ARM, or Terraform).

Client delivery and leadership

• Scope work, produce assessments, runbooks, and architecture documentation, and present findings to CIOs and IT staff.
• Mentor junior engineers and contribute to Ferrilli's ETS service offerings and proposal responses.

Required qualifications

• 8+ years of Microsoft infrastructure engineering, with at least 5 years as a primary administrator or architect of enterprise on-premises Active Directory.
• 3+ years administering production Azure environments.
• Expert knowledge of AD DS, Group Policy, DNS, AD replication, and trust relationships.
• Hands-on experience with Entra Connect or Cloud Sync and hybrid identity design.
• Proven ability to assess unfamiliar client environments quickly: inventory AD, Entra ID, and Azure configurations, identify risks and gaps against best practices, and turn findings into prioritized, actionable recommendations.
• Strong PowerShell scripting skills for AD and Azure automation.
• Working knowledge of Windows Server (2016-2025), networking fundamentals, and identity security best practices.
• Proven ability to document environments clearly and communicate with both technical staff and executives.
• Bachelor's degree in IT or a related field, or equivalent professional experience.

Preferred qualifications

• Experience in higher education IT or as a consultant serving multiple clients.
• Experience integrating higher education ERPs, such as Ellucian Colleague and Banner, with identity and access management platforms such as EUP and RapidIdentity for automated account provisioning and lifecycle management.
• Experience with AD forest migrations or tenant-to-tenant consolidations (for example, Quest or ADMT tooling).
• Familiarity with Intune, Microsoft 365 administration, and Defender for Identity.
• Exposure to security frameworks such as NIST CSF, CIS Controls, or GLBA requirements for institutions.

Certifications (preferred)

• Microsoft Certified: Azure Administrator Associate (AZ-104)
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ-800/AZ-801)
• Microsoft Certified: Azure Solutions Architect Expert (AZ-305) is a plus