Technical Consultant - EDS (Enterprise Directory Services)

Technical Consultant - EDS (Enterprise Directory Services)

Posted Today by NP Group

Apply
£650 Per day
Inside
Hybrid
London, UK
Apply
Active Directory Active Directory Federation Services Automation Azure Active Directory Change Management Configuration Management Device Tracking Software DevOps Directory Service Domain Name System (DNS) Servers Hardening Identity And Access Management Information Systems Security Information Technology Infrastructure Library Kusto Query Language Management Microsoft 365 Microsoft Azure Microsoft Intune (Mobile Device Management Software) Microsoft Windows Product Roadmaps Python (Programming Language) Role-Based Access Control (RBAC) Security Assertion Markup Language (SAML) SMTP (Simple Mail Transfer Protocol) TCP/IP Technical Consulting Terraform Windows PowerShell Windows Security

Summary: The Technical Consultant for Enterprise Directory Services (EDS) will focus on hands-on engineering and operational support for Microsoft Active Directory and Microsoft Entra ID. This role involves incident resolution, security hardening, and collaboration with subject matter experts to enhance identity and access management solutions. The consultant will implement engineering changes and contribute to compliance processes while ensuring adherence to service level agreements. The position is hybrid, requiring three days a week onsite in London or Surrey.

Key Responsibilities:

  • Efficiently triage and resolve incidents, service requests, and standard changes across AD/Entra ID, PKI, AD FS, and Quest Active Roles.
  • Implement Tier-0/DC hardening and manage GPO governance.
  • Enhance security through Kerberos/LDAP protections and Conditional Access/PIM controls.
  • Execute changes based on SME/architect designs using PowerShell and Microsoft Graph.
  • Conduct security remediation using tools like BloodHound/AzureHound and PingCastle.
  • Contribute to monitoring, ops quality, and compliance processes.
  • Participate in major-incident support and knowledge sharing.

Key Skills:

  • Deep experience with Active Directory and Entra ID (Azure AD), including AD FS and Azure AD Connect.
  • Practical understanding of AD security concepts and lateral-movement risks.
  • CIS-aligned DC baselines and host Firewalls knowledge.
  • Experience with Conditional Access and PIM for roles and Groups.
  • GPO design/governance and service-account policies knowledge.
  • Proficiency in PowerShell, Microsoft Graph, KQL, Terraform, and Python.
  • Hands-on experience with BloodHound/AzureHound and PingCastle.
  • Familiarity with Active Roles and Change Auditor for RBAC tracking.
  • Understanding of Microsoft Intune and MDM/MAM/Conditional Access.
  • Strong knowledge of OAuth2/OIDC, SAML, and PKI/AD CS standards.
  • Understanding of security principles like least privilege and separation of duties.
  • Networking foundations knowledge including HTTP, SMTP, DNS, TCP/IP.
  • Clear communication and presentation skills for technical and senior audiences.
  • ITIL certification and familiarity with structured change management (desirable).

Salary (Rate): £650 per day

City: London

Country: UK

Working Arrangements: hybrid

IR35 Status: inside IR35

Seniority Level: undetermined

Industry: IT

Detailed Description From Employer:

Contract: Technical Consultant - EDS (Enterprise Directory Services)
Start Date: ASAP
Duration: 12 months
Location: Hybrid - 3 days a week onsite in London and/or Surrey office
Rate: £550 - £650 per day (deemed inside IR35)
Reference: 19713

The Enterprise Directory Services (EDS) team engineers and manages solutions and infrastructure supporting the client's global enterprise directory services and identity & access management, including Microsoft Active Directory and Microsoft Entra ID.You'll join the EDS team as a hands-on engineer focused on day-to-day operations and security hardening across Active Directory and Microsoft Entra ID (Azure AD). You will work with platform SMEs and the wider team to deliver BAU tickets, implement hardening baselines, and execute engineering changes. The emphasis is on collaboration and delivery-contributing expert work under established standards and designs rather than owning product roadmaps or leading programs.

In this role, you will be responsible for efficiently triaging and resolving incidents, service requests, and standard changes across AD/Entra ID, PKI, AD FS, and Quest Active Roles, ensuring adherence to SLAs. You will implement Tier-0/DC hardening, manage GPO governance, and enhance security through Kerberos/LDAP protections and Conditional Access/PIM controls. Your engineering expertise will be pivotal in executing changes based on SME/architect designs, utilising PowerShell and Microsoft Graph for automation and configuration management. You will conduct security remediation using tools like BloodHound/AzureHound and PingCastle, whilst also contributing to monitoring, ops quality, and compliance processes. Collaboration with SMEs and various teams is essential, alongside actively participating in major-incident support and knowledge sharing.

Experience & Qualifications

  • Microsoft identity stack: Deep experience with Active Directory and Entra ID (Azure AD), plus associated infrastructure such as AD FS and Azure AD Connect; excellent knowledge of AD 2016/2019 design, troubleshooting, and administration.
  • Tiering & privileged access: Practical understanding of AD security concepts (Tier-0/Tier-1, PAWs) and lateral-movement risks; PAW/jump pattern design and rollout.
  • Active Directory hardening: CIS-aligned DC baselines, host Firewalls, and no-Internet DC patterns.
  • Entra ID controls at scale: Conditional Access (MFA/device/risk), and PIM for roles and PIM for Groups.
  • GPO & identity hygiene: Tier-0/Tier-1 GPO design/governance, SPN hygiene, gMSA adoption, and service-account policies (length/rotation).
  • Automation-first: PowerShell and Microsoft Graph for audits, enforcement, and remediation; KQL, Terraform, Python; policy/config-as-code mindset in a DevOps environment.
  • Exposure tooling: Hands-on with BloodHound/AzureHound and PingCastle (collection, analysis, and driving remediation).
  • Quest ecosystem: Active Roles (ARS) and Change Auditor (or equivalent) for RBAC and change/drift tracking.
  • Endpoint & access management: Experience with Microsoft Intune or strong understanding of MDM/MAM/Conditional Access.
  • Standards & protocols: Strong understanding of OAuth2/OIDC and SAML; experience with PKI/AD CS and relevant Windows security standards.
  • Security principles: Least privilege, separation of duties, auditability; confident engagement with InfoSec.
  • Networking foundations: HTTP, SMTP, DNS, TCP/IP, proxies, and load balancers.
  • Communication: Clear written/verbal communication and presentation skills for technical and senior audiences.
  • Process: ITIL certification (desirable) and familiarity with structured change management.

Networking People (UK) is acting as an Employment Business in relation to this vacancy.

Apply
Similar Jobs
Loading data...