We are seeking an experienced Active Directory (AD) and Tier-0 (T0) Infrastructure Automation Engineer to design, secure, automate, and modernize enterprise authentication platforms. This role will focus on Tier-0 security hardening, identity infrastructure resilience, and building automation + AI-assisted operations to improve reliability, reduce manual effort, and accelerate incident responsewhile maintaining strict security boundaries for privileged environments.

Key Responsibilities:

Active Directory & Tier-0 Engineering:

- Own and improve Tier-0 identity infrastructure: AD DS forests/domains, domain controllers, DNS, PKI dependencies, ADFS (if applicable), and privileged access pathways.
- Implement and maintain Tier-0 hardening controls: secure admin tiers, PAW/SAW strategies, GPO baselines, authentication policies, and privileged group governance.
- Design and execute AD modernization initiatives: domain restructuring, consolidation/separation, trust management, and authentication redesign.
- Ensure business continuity for identity platforms: backup/restore drills, authoritative restores, DC recovery, tombstone/lingering object prevention, and disaster recovery readiness.
- Perform risk assessments and remediation for Tier-0 exposures: delegation risks, unconstrained delegation, weak ACLs, stale privileged accounts, and legacy auth protocols.

Automation (IaC / Self-Healing / Runbooks)

Build automation for AD operations using PowerShell / Python, including:

- User/Group/OU lifecycle workflows
- GPO deployment validation
- DC health monitoring & auto-remediation
- DNS and replication check

AD object hygiene and privileged group reviews

- Implement Infrastructure-as-Code patterns where applicable (e.g., automation pipelines, configuration baselines, golden templates).
- Develop self-service enablement with guardrails (approval workflows, audit trails, rollback).

AI Integrations (Operations & Security Use Cases)

Integrate AI-assisted workflows into identity operations (within compliance boundaries), such as:





- Incident triage copilots: summarize logs/events and suggest next steps
- Root cause assistance: pattern recognition across DC logs, replication events, authentication failures
- Runbook recommendation: map incidents to approved remediation playbooks
- Knowledge mining: convert tribal knowledge into searchable internal guidance (KB automation)

Create safe AI guardrails for Tier-0 environments:

- Ensure data classification and redaction policies are enforced
- Prevent privileged secrets leakage (tokens, passwords, keys)
- Maintain auditability and approval gates for all actions suggested/executed

Monitoring, Logging & Compliance

- Own logging pipelines for identity platforms using tools like Microsoft Sentinel / Splunk / ELK / Log Analytics.
- Create dashboards and alerts for AD health, authentication anomalies, replication issues, privileged access abuse signals.
- Support audits (SOX/ISO/IEC/industry compliance): evidence collection, control mapping, and remediation tracking.

Collaboration & Stakeholder Management

- Work closely with cybersecurity, IAM, networking, endpoint engineering, and GRC teams.
- Provide explicit technical documentation, runbooks, architecture diagrams, and executive summaries.
- Participate in on-call/major incident bridge support for Tier-0 services (as needed).

Required Qualifications:

- 5+ years experience in Active Directory engineering/operations in large enterprise environments.
- Strong hands-on expertise in:
- AD DS, Domain Controllers, Sites & Services, DNS, Kerberos/NTLM, trusts
- Tier-0 security concepts, privileged admin models, GPO security baselines
- Troubleshooting AD replication, authentication failures, and DC recovery

Proven automation skills:

- PowerShell (advanced), scripting standards, modules, CI/CD integration
- Familiarity with Python is a plus
- Experience with security monitoring/identity analytics and log analysis.

Key Skills:

AD DS | Tier-0 Security | PowerShell Automation | GPO | DNS | Kerberos | DR/BCP | Monitoring & SIEM | PAM | Hybrid Identity | AI-assisted Ops | Runbooks

📌 Active Directory Consultant (Bengaluru)
🏢 Daimler Trucks Innovation Center
📍 Bengaluru