Tooling and assessment responsibilities

• The engineer will be expected to:
  • Install, configure or execute Purple Knight assessments in accordance with approved security and access requirements.
  • Run PingCastle health checks and security assessments across relevant AD environments.
  • Use Forest Druid to assess forest configuration, trust relationships, attack paths and identity-security risks.
  • Review and action Microsoft Defender for Identity recommendations, exposure findings, identity alerts and secure-score improvements.
  • Maintain controlled and repeatable assessment procedures.
  • Protect assessment outputs, which may contain sensitive identity and infrastructure information.
  • Compare results over time to demonstrate improvements in the security posture.
  • Ensure tools are used in accordance with licensing, security, privacy and change-management requirements.
  • Document tool versions, assessment dates, scope, assumptions and limitations.
  • Avoid treating automated tool output as evidence of a vulnerability without appropriate technical validation.

Vulnerability remediation delivery

• Prioritise remediation according to severity, exploitability, exposure, business criticality and programme objectives.
• Develop technical remediation plans, implementation procedures and rollback plans.
• Coordinate testing with infrastructure, application, endpoint, cloud and service owners.
• Implement changes through approved change-management processes.
• Validate remediation through repeat assessments and technical testing.
• Maintain evidence of:
  • The original finding.
  • The agreed remediation.
  • Testing and approvals.
  • The implemented change.
  • Post-remediation validation.
• Track residual risks, accepted exceptions and dependencies.
• Escalate risks that cannot be remediated within agreed timescales.

Engineering and automation

• Develop PowerShell scripts and automation to support identity assessment, remediation and reporting.
• Use Microsoft Graph and approved APIs to assess and manage Entra ID configuration.
• Automate checks for privileged access, stale accounts, risky configurations and policy compliance where appropriate.
• Create repeatable reporting from Purple Knight, PingCastle, Forest Druid and Defender for Identity outputs.
• Ensure scripts and automation are tested, documented, access-controlled and reviewed before production use.

Operational transition

• Produce technical documentation, configuration records and operational runbooks.
• Provide knowledge transfer to internal identity and infrastructure teams.
• Define repeatable assessment schedules and ownership for ongoing reviews.
• Establish processes for reviewing Purple Knight, PingCastle, Forest Druid and Defender for Identity results.
• Support transition of remediation controls into business-as-usual operations.
• Contribute to post-remediation reporting, lessons learned and continuous improvement.

Essential experience and skills

• Strong hands-on experience securing Microsoft Active Directory.
• Strong hands-on experience securing Microsoft Entra ID.
• Demonstrable experience delivering identity vulnerability-remediation programmes.
• Practical experience using:
  • Purple Knight.
  • PingCastle.
  • Forest Druid.
  • Microsoft Defender for Identity.
• Ability to interpret and remediate findings from these tools rather than simply producing assessment reports.
• Deep understanding of:
  • AD domains, forests, trusts and replication.
  • Group Policy.
  • Kerberos and NTLM.
  • LDAP.
  • Privileged access management.
  • Service accounts and managed service accounts.
  • Delegation and access control lists.
  • Microsoft Entra roles and permissions.
  • Conditional Access and multi-factor authentication.
  • Application registrations and service principals.
  • Microsoft Graph permissions.
  • Hybrid identity and directory synchronisation.
• Strong PowerShell capability.
• Experience with Microsoft Graph or equivalent identity APIs.
• Experience implementing secure changes in production environments.
• Understanding of change management, risk management and security assurance.
• Strong documentation and stakeholder-management skills.

Desirable experience

• Experience in financial services or another regulated industry.
• Experience with Microsoft Entra Connect or Microsoft Cloud Sync.
• Experience with privileged-access workstations and administrative tiering.
• Experience with identity governance, access reviews and entitlement management.
• Familiarity with zero-trust principles.
• Experience integrating identity-security findings with SIEM, SOAR, vulnerability-management or service-management platforms.
• Knowledge of Microsoft Defender XDR and related security recommendations.
• Experience with infrastructure-as-code or configuration-management tools.
• Relevant Microsoft, identity or cyber-security certifications.

Expected deliverables

The engineer will be expected to contribute to or own:

• Purple Knight assessment reports and remediation plans.
• PingCastle assessment reports and remediation plans.
• Forest Druid assessment outputs and remediation actions.
• Microsoft Defender for Identity recommendation reviews and remediation evidence.
• Microsoft Entra ID security-recommendation reviews.
• Validated identity-vulnerability and control-gap registers.
• Prioritised remediation plans.
• Active Directory hardening and privileged-access improvements.
• Entra ID configuration and access-control remediation.
• PowerShell and Microsoft Graph automation.
• Test and validation evidence.
• Exception and residual-risk records.
• Security and audit evidence.
• Operational runbooks and configuration documentation.
• Knowledge-transfer materials.
• Post-remediation reports demonstrating measurable improvement.

Measures of success

Success will be measured by:

• Reduction in validated high- and critical-risk findings from Purple Knight, PingCastle, Forest Druid and Defender for Identity.
• Reduction in Microsoft Entra ID security recommendations and material Secure Score gaps.
• Reduction in excessive privilege and unmanaged administrative access.
• Improved protection of privileged and emergency-access accounts.
• Reduction in legacy authentication and insecure protocols.
• Improved control of service principals, application permissions, credentials and secrets.
• Timely completion of agreed remediation milestones.
• Successful validation of remediation through repeat assessments.
• Quality and completeness of evidence supporting closure.
• Effective transition of ongoing assessment and remediation activities into business-as-usual operations.

Important control requirements

The successful candidate must:

• Follow approved access-control, security and change-management procedures.
• Use appropriately controlled administrative accounts.
• Treat Purple Knight, PingCastle, Forest Druid and Defender for