Wintel Active Directory Engineer - Secure

Job Description:

Wintel Active Directory (AD) Engineer – Job Description

Role Summary

The ITO Wintel Active Directory (AD) Engineer provides Level 3 operational support for Windows Server and Microsoft Active Directory across DXC-managed customer environments. The engineer maintains the health, security and compliance of directory services, including domain controllers, Group Policy, DNS/DHCP, certificate services and replication topology. Working within ITIL 4 frameworks, they implement approved changes, enforce secure baselines and support identity lifecycle workflows, keeping services stable, auditable and aligned with contractual SLAs. They escalate complex trust, identity or replication issues to senior engineers or architects.

Due to the nature of the work and the customers we support, the successful candidate must be eligible to meet UK Government and contractual personnel security requirements, including the applicable residency requirements for the role, and have the right to work in the United Kingdom. Some roles may also be subject to nationality requirements where these are necessary to meet UK Government or contractual security obligations.

Please note attendance on-site 5 days a week is required.

Key Responsibilities

• Plan AD capacity, domain controller placement, FSMO distribution and site topology.
• Maintain accurate Wintel and AD CMDB records, relationships and dependencies.
• Support OS lifecycle, patching and security roadmaps and infrastructure forecasting across managed environments.
• Investigate recurring directory incidents through Problem Management and propose permanent fixes.
• Update AD and Windows runbooks, procedures and knowledge articles with current configurations and lessons learned.
• Contribute to post-incident reviews and service improvements that enhance stability and efficiency.
• Keep customers informed of planned changes, maintenance windows and service impacts.
• Coordinate GPO, DNS and trust dependencies with Security, Identity and Network teams.
• Update incident managers and stakeholders on major-incident progress and resolution timelines.
• Implement security and operational GPOs with testing and peer review before production deployment.
• Support approved AD design and transition changes to OUs, trusts, sites and subnets.
• Verify tested, documented system state backups and authoritative restores before directory services go live.
• Maintain current, accessible AD topology diagrams and documentation using tools such as Visio.
• Build and configure physical and virtual Windows AD servers to CIS or equivalent security baselines.
• Patch domain controllers through approved changes, coordinating with Change Management to minimise disruption.
• Automate provisioning, health checks, replication monitoring and bulk reporting with PowerShell.
• Configure DNS zones, DHCP scopes and certificate dependencies to integrate with AD infrastructure.
• Resolve L3 Windows Server and AD incidents involving authentication, replication, GPOs and DNS.
• Process JML account provisioning, changes and de-provisioning through approved requests and identity lifecycle policies.
• Remove stale objects, review privileged groups and manage dormant accounts for directory security and compliance.
• Monitor domain controller health, replication latency and SYSVOL consistency to prevent service degradation.
• Secure baselines are enforced, and audit and compliance evidence is gathered and maintained to support internal and external reviews.
• Complex trust, identity federation, or multi-domain replication issues are escalated to senior staff with clear diagnostic information and recommended next steps.

Required Skills & Experience

Essential

• Windows Server Operations: 4–7 years’ hands-on enterprise managed-services experience administering Windows Server 2016, 2019, 2022 and 2025, with deep installation, configuration, patching and hardening knowledge across physical and virtual platforms.
• Active Directory: Strong on-premises expertise in domain controllers, FSMO roles, intra/inter-site replication, sites and services, OU design and trusts, plus comprehensive AD architecture and infrastructure dependency knowledge.
• Group Policy: Advanced GPO design, implementation, linking, troubleshooting and security enforcement across complex OUs and multiple sites.
• DNS & DHCP: Solid AD-integrated DNS, forward/reverse lookup zone, conditional forwarder and DHCP scope knowledge to resolve authentication and availability issues caused by name resolution.
• Security Hardening: Experience enforcing CIS or equivalent Windows Server baselines, with practical privileged access, stale object cleanup, group hygiene and security assessment knowledge.
• Identity Lifecycle: Practical JML provisioning, role-change and de-provisioning experience through approved changes, with AD least-privilege and role-based access knowledge.
• Virtualisation: Working VMware vSphere and/or Hyper-V deployment, management and troubleshooting knowledge, supporting confident operations and understanding of host impacts on guest OS performance.
• Scripting & Automation: Develop, maintain and troubleshoot PowerShell scripts for AD automation, health checks, reporting and bulk operations to improve efficiency and reduce manual effort.
• ITIL Practices: Confidently apply ITIL 4 Incident, Problem, Change and Configuration Management and contribute to the managed-services value chain.
• Monitoring & Troubleshooting: Methodically diagnose authentication, Kerberos/NTLM, replication and GPO issues using evidence, native Windows tools and third-party monitoring.
• Documentation: Maintain high-quality, accurate, current and team-accessible architecture diagrams, runbooks, SOPs and audit artefacts.
• CMDB Management: Maintain accurate configuration records and relationships supporting Change, Incident and Problem Management.

Desired:

• Certifications: Hold Microsoft Certified: Windows Server Hybrid Administrator Associate, Microsoft Certified: Identity and Access Administrator Associate, or equivalent Windows Server and AD vendor certifications.
• ITIL 4 Foundation: Foundation certification or higher is desirable, demonstrating ITIL 4 practice and service value chain knowledge.
• Certificate Services: Experience with Microsoft AD CS templates, enrolment, renewal dependencies and domain services integration.
• Azure AD / Entra ID: Demonstrate exposure to hybrid identity, Azure AD Connect, single sign-on and conditional access, with an understanding of links between on-premises AD and cloud identity services.
• Backup & Recovery: Demonstrate experience using Veeam, Commvault or similar enterprise tools for AD and system state recovery, including authoritative and non-authoritative restores.
• Capacity Planning: Demonstrate experience forecasting domain controller resources, storage and replication bandwidth to meet growth and service demand.
• Monitoring Tools: Demonstrate familiarity with SCOM, SolarWinds, Dynatrace or similar enterprise platforms and the ability to configure alerts and dashboards for proactive infrastructure management.
• Compliance Awareness: Demonstrate awareness of ISO 27001, Cyber Essentials and NIST and their impact on AD security configuration and audit requirements.
• Security Clearance: Holding or being able to obtain UK DV clearance is advantageous for defence-sector work.

At DXC Technology, we believe strong connections and community are key to our success. Our work model prioritizes in-person collaboration while offering flexibility to support wellbeing, productivity, individual work styles, and life circumstances. We’re committed to fostering an inclusive environment where everyone can thrive.

Recruitment fraud is a scheme in which fictitious job opportunities are offered to job seekers typically through online services, such as false websites, or through unsolicited emails claiming to be from the company. These emails may request recipients to provide personal information or to make payments as part of their illegitimate recruiting process. DXC does not make offers of employment via social media networks and DXC never asks for any money or payments from applicants at any point in the recruitment process, nor ask a job seeker to purchase IT or other equipment on our behalf. More information on employment scams is available here.