Windows Engineer

About us:

Working at Tech Holding isn't just a job, it's an opportunity to be a part of something bigger. We are a full-service consulting firm that was founded on the premise of delivering predictable outcomes and high-quality solutions to our clients.  Our founders and team members have industry experience and have held senior positions in a wide variety of companies – from emerging startups to large Fortune 50 firms – and we have taken our combined experiences and developed a unique approach that is supported by the principles of deep expertise, integrity, transparency, and dependability.

The Role: 

We are looking for a Senior Windows Engineer for a project-based assignment to strengthen the stability and resiliency of a business-critical Windows environment across Active Directory, DNS, authentication, automation, observability, security, and disaster recovery. This is a hands-on platform engineering role that combines deep Active Directory and Kerberos expertise with Windows automation, cloud infrastructure, and Infrastructure as Code. You will work across directory services, authentication, golden image and patching pipelines, PowerShell automation, PKI, configuration management, and recovery capabilities while helping improve the reliability and resilience of the overall Windows platform. The ideal candidate is a Windows platform and automation engineer rather than a traditional Windows administrator, with strong cloud fluency and experience managing infrastructure through code and automation.

Key Responsibilities: 

• Improve Active Directory and DNS resilience, including replication topology and health, FSMO roles, DFS-R, NTDS, AD-integrated DNS, and domain controllers running as cloud instances.
• Support the estate's migration from NTLM to Kerberos, ensuring both protocols can operate without an outage during the transition.
• Work with service principal names and duplicate-SPN failure modes, constrained delegation, AES over RC4 through the supported-encryption-types attribute, managed and group managed service accounts, and reverse DNS.
• Support identity integration across the estate, including LDAP for non-Windows hosts, desktop single sign-on via Kerberos passthrough with constrained delegation, cloud single sign-on, and brokered application identity.
• Support and improve the golden image and patch pipeline, including image bake automation, CI-scheduled builds, promotion, deprecation, deregistration, and CVE-driven rebuilds.
• Improve Windows observability, including infrastructure agents, Windows service and event-channel collection, script-derived metrics, domain controller service health, replication status, and operational log-channel forwarding.