Deep understanding of AD security internals: Kerberos, NTLM, LDAP, ACLs/delegation, privileged groups, admin tiering, DCSync/replication rights, krbtgt rotation, golden/silver ticket risk, domain/forest trusts, SID history, SPNs, constrained/unconstrained/resource-based constrained delegation, SYSVOL/GPO security, DNS, and AD CS/PKI risk. Specific responsibilities include, but are not limited to: Own the security architecture for AvePoint's identity resilience platforms, including threat modeling, recovery trust criteria, privileged-access safeguards, secure restore guardrails, and post-recovery validation workflows across major enterprise identity providers.