Active Directory Specialist (44344)

Have you led Active Directory clean-up and security projects in enterprise environments? An identity security project is looking for an Active Directory Specialist who will analyze the client’s current AD environment, rebuild it into a clear structure and secure it – from Group Policy (GPO) and tiering through privileged account management and AD hardening to building a certificate authority (PKI). Expert-level experience with Active Directory in enterprise environments, AD CS, PowerShell and tools such as PingCastle or BloodHound is required.

🚀 Project
- Analysis of the current state of the AD environment
- Clean-up and restructuring of AD into a clear structure, including Group Policy (GPO) setup
- Introduction of tiering (administrative tier model)
- Introduction of privileged accounts and privileged access management
- AD hardening
- Building a certificate authority (PKI)

🎯 Skills
- Expert-level Active Directory – design, administration and restructuring of AD (OU structure, delegation of rights, groups, trusts) in enterprise environments
- Group Policy (GPO) – policy design and clean-up, security baseline via GPO
- AD Tiering model – hands-on implementation of Tier 0/1/2, separation of admin accounts, Privileged Access Workstations (PAW)
- Privileged account management – least privilege, Tier 0 protection (Protected Users, Authentication Policies/Silos)
- AD hardening according to best practices (CIS Benchmark, Microsoft Security Baselines), LAPS, disabling legacy protocols (NTLMv1, SMBv1), Kerberos security
- PKI / AD CS – building a certificate authority from scratch (Root and Issuing CA, certificate templates) incl. its security
- AD analysis and audit – PingCastle, Purple Knight or BloodHound
- PowerShell for AD administration and audit automation
- Independence and experience with similar AD clean-up projects, ability to design an end-to-end solution without guidance
- English B2

💡 Nice to have
- Microsoft Entra ID (Azure AD) / hybrid identity, Entra Connect
- PAM tools (CyberArk, Delinea, Microsoft LAPS / PIM)
- Microsoft Defender for Identity
- Certifications: Microsoft (SC-300, AZ-800/801), CISSP, OSCP or similar
- Knowledge of AD attacks (Kerberoasting, Pass-the-Hash, ADCS ESC vulnerabilities)
- Slovak/Czech

#LI-RU1