Senior Identity Security Architect, Active Directory (Remote, Contract)

Stafford Gray is hiring several Senior Identity Security Architects on behalf of a global identity security consultancy. These are long-term, fully remote contract roles for experts who know Active Directory at its deepest level and want to solve hard identity security problems for large enterprises. Occasional travel for client meetings may be required, typically a few times per year.
We are looking for top-tier technical talent. This role is focused on hands-on architecture and remediation, not people management. Compensation is highly competitive and based on experience.
What You Will Do
Assess and harden enterprise Active Directory environments, including forests, trusts, Kerberos, Group Policy, permissions, and delegation
Secure Active Directory Certificate Services (ADCS) and remediate certificate-based attack paths
Design and implement Tier 0 protection, including administrative tiering, privileged access workstations, and least privilege
Identify and remediate attack paths, credential theft exposure, and lateral movement risk
Secure hybrid identity between Active Directory and Microsoft Entra ID, including strong authentication and Conditional Access
Implement Just-in-Time and Just-Enough Access to reduce standing privilege
Plan and test Active Directory forest recovery and ransomware resilience
Secure service accounts and other non-human identities
What You Bring
Extensive hands-on experience securing Active Directory in large enterprise environments
Deep knowledge of ADCS, Kerberos, Tier 0 design, and privileged access
Experience with tools such as BloodHound, PingCastle, Purple Knight, Semperis, or Microsoft Defender for Identity
Strong experience with Microsoft Entra ID and hybrid identity
Ability to explain technical risk clearly to client stakeholders
Requirements
Nice to Have
Identity governance (SailPoint, Saviynt, or Entra ID Governance), including access reviews and joiner, mover, leaver automation
Privileged access management tools such as CyberArk or BeyondTrust
Experience integrating identity telemetry with XDR or threat hunting
Certificate and cryptographic modernization or quantum readiness planning
Certifications such as SC-100, SC-300, CRTP, CRTE, OSCP, or CISSP
Details
Contract role, W2 or 1099
Fully remote, US-based
Long-term engagement

Work arrangement
No