Senior Windows Platform Engineer | Contract | Remote

Tech Holding is a full-service consulting firm focused on delivering predictable outcomes and high-quality solutions to its clients. The company is seeking a Senior Windows Engineer to strengthen the stability and resiliency of a business-critical Windows environment across Active Directory, authentication, automation, observability, security, and disaster recovery. The role involves hands-on platform engineering, PowerShell automation, cloud infrastructure, Infrastructure as Code, PKI, configuration management, and recovery capabilities.

Responsibilities:

• Improve Active Directory and DNS resilience, including replication topology and health, FSMO roles, DFS-R, NTDS, AD-integrated DNS, and domain controllers running as cloud instances
• Support the estate's migration from NTLM to Kerberos, ensuring both protocols can operate without an outage during the transition
• Work with service principal names and duplicate-SPN failure modes, constrained delegation, AES over RC4 through the supported-encryption-types attribute, managed and group managed service accounts, and reverse DNS
• Support identity integration across the estate, including LDAP for non-Windows hosts, desktop single sign-on via Kerberos passthrough with constrained delegation, cloud single sign-on, and brokered application identity
• Support and improve the golden image and patch pipeline, including image bake automation, CI-scheduled builds, promotion, deprecation, deregistration, and CVE-driven rebuilds
• Improve Windows observability, including infrastructure agents, Windows service and event-channel collection, script-derived metrics, domain controller service health, replication status, and operational log-channel forwarding
• Develop and maintain PowerShell automation supporting Windows platform operations and resiliency
• Support Infrastructure as Code and configuration management, including Chef, Ansible, Systems Manager, guardrail policies, pipeline pre-deploy validation, and OpenTofu
• Support multi-account rebuild, guardrail policies, and module compliance
• Strengthen security and data-protection controls, including encryption by default on block storage, key management, web-tier protection, and instance metadata hardening
• Improve PKI and certificate services resilience, including certificate authority recovery posture
• Support disaster recovery design, cloud platform, and file services, including recovery tiering with defined RTO and RPO, pilot light versus active-passive trade-offs, non-disruptive failover testing, and divisional cloud accounts
• Support file-services resilience and legacy distributed file system decommissioning targeting zero RPO and sub-five-minute RTO
• Define, test, and document backup, restore, and forest recovery, including the achievable RTO
• Define when NTLM can be retired and how remaining NTLM use will be audited
• Define recovery requirements and establish certificate inventory and expiry alerting
• Address the RBAC transition or document the decision regarding its future state
• Exercise domain controller and directory recovery as part of resiliency testing
• Review the image catalogue and multi-tenant configuration
• Confirm whether Group Policy is genuinely unused or currently unmanaged

Requirements:

• Expert-level experience with Active Directory and DNS resilience, including replication topology and health, FSMO roles, DFS-R, NTDS, AD-integrated DNS, and domain controllers
• Expert-level knowledge of Kerberos authentication, including SPNs, duplicate-SPN failure modes, constrained delegation, AES/RC4 encryption, managed service accounts, group managed service accounts, and reverse DNS dependencies
• Strong experience with identity integration across Windows and non-Windows environments, including LDAP and single sign-on
• Expert-level experience with golden image and patch pipelines, including image bake automation, CI-scheduled builds, promotion, deprecation, deregistration, and CVE-driven rebuilds
• Strong Windows observability and PowerShell experience
• Strong experience with Infrastructure as Code and configuration management, including OpenTofu and tools such as Chef, Ansible, and Systems Manager
• Strong understanding of cloud infrastructure, security, data-protection controls, and infrastructure automation
• Strong experience with PKI and certificate services
• Strong experience with disaster recovery design, including RTO/RPO, recovery strategies, failover testing, and Windows file services
• Ability to work as a platform and automation engineer in a code-managed Windows environment rather than relying on traditional Windows administration practices
• Ability to work independently across complex, business-critical Windows infrastructure and communicate technical decisions clearly
• Applicants must be authorized to work for ANY employer in the U.S
• We are unable to sponsor or take over sponsorship of an employment Visa at this time