Hybrid Active Directory Jobs (NOW HIRING)

Vice President, Workforce Identity and Directory Services – serves as the primary owner of all Active Directory related infrastructure and strategy, leading design, governance, and modernization of the enterprise identity platform across on‑premises, hybrid, and cloud environments.

• Serve as the primary owner and point‑of‑contact for all Active Directory infrastructure, strategy, and operations across on‑premises and cloud environments.
• Lead and execute a long‑term technology roadmap to modernize the Active Directory environment, including forest and domain consolidation, AD tiering model implementation, strategic reduction and decommissioning of on‑premises domain controllers, and accelerating workload migration from on‑premises AD to Microsoft EntraID.
• Architect and govern enterprise Active Directory Domain Services (ADDS), Active Directory Certificate Services (ADCS), DNS, DHCP, PKI, ensuring high‑availability, disaster‑recovery readiness, and security at scale.
• Drive the adoption and optimization of Microsoft EntraID security features, including Conditional Access, Identity Protection, Identity Governance, Workload Identities, and EntraPermissionsManagement.
• Govern EntraID external collaboration and application identity, including cross‑tenant access policies, B2B guest account lifecycle, app registration and enterprise application management, API permission and consent policy governance, and service principal security and credential rotation.
• Manage hybrid Active Directory environments, including AzureAD Connect / Cloud Sync configuration, seamless SSO, pass‑through authentication, and directory synchronization health monitoring.
• Design and enforce Group Policy architecture at scale, including GPO lifecycle management, security baselines, and policy inheritance strategies across complex OU structures.
• Establish and enforce identity security best practices, policies, and standards across the organization in alignment with zero‑trust principles and AD tiering models (Enhanced Security Admin Environment).
• Oversee Kerberos, NTLM, LDAP, and certificate‑based authentication protocols, driving migration away from legacy protocols toward modern authentication standards.
• Lead AD forest and domain trust management, replication topology optimization, Sites and Services configuration, and schema extension governance.
• Partner with Security, Compliance, and Risk teams to ensure identity infrastructure meets regulatory and audit requirements, including SOX, NIST, and industry‑specific mandates.
• Oversee incident response, disaster recovery, and root‑cause analysis for identity‑related security events, AD replication failures, and service disruptions.
• Evaluate emerging identity technologies and industry trends, including passwordless authentication, decentralized identity, and AI‑driven threat detection to inform strategic planning and investment decisions.

• 10+ years of progressive IT infrastructure experience with a focus on Active Directory and identity management, including at least 5 years in an architect or senior engineering capacity.
• Deep knowledge of Microsoft 365 from an identity and access management perspective, including Exchange Online, SharePoint Online, Teams integration with EntraID, M365 group and license management, app consent frameworks, service principals, and Microsoft 365 Defender for identity‑related threat detection.
• Deep fluency in authentication and federation protocols, including SAML, OAuth2.0, OpenID Connect, WS‑Federation, Kerberos, LDAP, and NTLM, with a track record of migrating environments away from legacy protocols.
• Experience implementing passwordless authentication strategies, including FIDO2, Windows Hello for Business, and certificate‑based authentication via PKI.
• Hands‑on experience with Active Directory security assessment and hardening tools such as BloodHound, PingCastle, and Purple Knight for attack path analysis and security posture evaluation.
• Knowledge of service account governance, including Group Managed Service Accounts (gMSA), and endpoint security tooling such as LAPS.
• Proficiency with PowerShell, Terraform, DSC, and Microsoft Graph API for identity infrastructure automation, reporting, and configuration drift detection.
• Working knowledge of NIST, SOX, or other regulatory compliance frameworks as they relate to identity management and PKI governance.
• Microsoft certifications such as Microsoft Certified: Identity and Access Administrator Associate, Azure Solutions Architect Expert, or Cybersecurity Architect Expert.
• Proven track record of building, mentoring, and managing high‑performing identity engineering teams.
• Excellent communication and stakeholder management skills, able to translate complex identity concepts for non‑technical audiences and influence at all levels of the organization.

• Identity architecture and strategic technology vision.
• Enterprise security and zero‑trust mindset.
• Deep technical problem solving across complex, multi‑forest AD environments.
• Stakeholder management and executive communication.
• Strong ownership, accountability, and bias toward action.
• Experience in financial services, private equity, or other highly regulated industries.

Expected annual base salary range: $160,000 – $225,000. Actual base salary within that range will be determined by several components including but not limited to the individual's experience, skills, qualifications and job location. Additional compensation and benefits include comprehensive health benefits (medical, dental, vision, FSA), paid time off, life insurance, 401(k) plan, discretionary bonuses, and potential equity and incentive compensation at leadership discretion.Benefits are offered in connection with the role and are guided by local market comparables for non‑US locations.

Blackstone is committed to providing equal employment opportunities to all employees and applicants for employment without regard to race, color, creed, religion, sex, pregnancy, national origin, ancestry, citizenship status, age, marital or partnership status, sexual orientation, gender identity or expression, disability, genetic predisposition, veteran or military status, status as a victim of domestic violence, a sex offense or stalking, or any other class or status in accordance with applicable federal, state, and local laws. This policy applies to all terms and conditions of employment, including but not limited to hiring, placement, promotion, termination, transfer, leave of absence, compensation, and training. All Blackstone employees, including but not limited to recruiting personnel and hiring managers, are required to abide by this policy.