Cloud Solution Architect (v-CSA) – Active Directory, PKI & Hybrid Identity

We are looking for a Cloud Solution Architect with deep expertise in Public Key Infrastructure (PKI) / Active Directory Certificate Services (AD CS), Active Directory Federation Services (ADFS) and Active Directory to support enterprise and regulated customers in Sweden and the Nordics. This is a customer-facing role responsible for delivering secure identity and certificate architecture, acting as a trusted technical advisor, and executing repeatable AD CS, ADFS and Windows security engagements across on-premises and hybrid environments. This position is a backfill: depth in PKI / AD CS and ADFS is the primary requirement, with Windows Server/Client security and hybrid identity (Microsoft Entra) as essential complementary skills. Key Responsibilities:

1. PKI, Certificate Services & Identity Architecture

• Design, assess and implement enterprise PKI and Active Directory Certificate Services (AD CS) solutions, including CA hierarchy, templates, enrollment, revocation and certificate lifecycle management.
• Design and support Active Directory Domain Services (AD DS) and ADFS architectures, including federation, claims, relying-party trusts and modernization/migration to Microsoft Entra ID.
• Guide customers on certificate-based trust models, authentication, authorization and secure identity architecture.

1. Customer Delivery & Execution

• Lead end-to-end delivery of Unified/EDE engagements, including Active Directory Certificate Services Assessment, Onboarding Accelerator – Deployment and Migration Assistance for AD CS (Base and Add-On), Technical Blocker Mitigation – AD CS, Show Technical Ability – AD CS and ADFS Assessment.
• Troubleshoot complex certificate, authentication (Kerberos/NTLM), federation, DNS, Group Policy and DFS issues.
• Deliver high-quality, repeatable technical engagements with clear findings, remediation plans and reports.

1. Trusted Advisor & Stakeholder Management

• Act as a trusted technical advisor for customers, CSAMs, SDMs and internal stakeholders.
• Translate business, compliance and security requirements into practical technical architecture.
• Communicate clearly with technical teams and customer decision makers, in English and Swedish.

1. Security Hardening & Governance

• Guide customers on secure-by-design identity and certificate architectures.
• Drive security hardening for Windows Server, Windows Client, Active Directory, AD CS and ADFS.
• Support data security architecture discussions (e.g., Architecture Service – Data Security) where they relate to identity and certificate trust.

1. Operations, Resilience & Optimization

• Improve operational stability, monitoring and reliability of identity, federation and certificate services.
• Support backup, disaster recovery and business continuity for AD, AD CS and ADFS.

1. Collaboration & Knowledge Sharing

• Collaborate with CSAMs, partners, engineering teams and CSA communities to deliver customer outcomes.
• Contribute to reusable assets, delivery IP and best practices for PKI, ADFS and hybrid identity.
• Share knowledge within the Nordic pod to keep identity and certificate depth in the team after transition.

Required Technical Skills: Target Skill Set (required) The role covers the following CSA GD taxonomy skills. Only the Tier 1 skills are mandatory at expert level; Tier 2 skills are required at a solid working level and can be deepened on the job. For every technology, the candidate is expected to cover backup and recovery as well as design, operations and troubleshooting. Tier 1 – Mandatory (expert-level, deep hands-on delivery)

• Public Key Infrastructure (PKI) and Certificate Services – AD CS CA hierarchy, templates, enrollment, revocation and certificate lifecycle; CA database and private-key backup, CA recovery/restore and CRL/AIA continuity.
• Active Directory Federation Services (ADFS) – federation design, relying-party trusts, claims, SSO and migration to Microsoft Entra ID; ADFS configuration and token-signing certificate backup, farm recovery and high availability.
• Active Directory – AD DS design, operations, troubleshooting, Group Policy, DNS and modernization; system-state backup, authoritative/non-authoritative restore and AD forest recovery.

Tier 2 – Required working knowledge

• Windows Server Security – Windows Server hardening, Kerberos/NTLM, tiering and privileged access; secure backup and recovery of Tier 0 servers.
• Windows Client Security – Windows client hardening, security baselines and credential protection; recovery of BitLocker keys and client security configuration.
• Distributed File System (DFS) – DFS Namespaces and DFS Replication design, health and troubleshooting; DFS-N configuration backup and DFS-R database/content recovery.
• Microsoft Entra Enterprise Apps & SSO – enterprise application integration, SAML/OIDC SSO and app migration from ADFS to Entra ID; backup and restore of app/SSO configuration and signing-certificate rollover.
• Networking – networking fundamentals for identity services (DNS, name resolution, ports/firewalling, load balancing, proxies); DNS zone backup and recovery.

Core Must-have Skills: strong on-premises experience is a must

• Mandatory: expert-level depth in at least 2 of the 3 Tier 1 skills:
• Expert-level Public Key Infrastructure (PKI) / Active Directory Certificate Services (AD CS), including design, migration, certificate lifecycle, templates, enrollment, governance and troubleshooting, including backup and recovery.
• Expert-level Active Directory Federation Services (ADFS), including federation design, SSO/enterprise application integration, troubleshooting and migration to Microsoft Entra ID, including backup and recovery.
• Strong Active Directory Domain Services and Windows Server Security knowledge, including DNS, Group Policy, Kerberos/NTLM and security hardening, including backup and recovery.
• And:
• Strong Windows Client Security knowledge.
• Ability to operate confidently across on-premises and hybrid identity environments.
• Proven experience planning and executing backup, restore and disaster recovery for AD, AD CS and ADFS.

Additional Skills – Strongly Preferred

• Microsoft Entra External ID (B2B) scenarios.
• PowerShell scripting and automation for AD, AD CS and ADFS operations and reporting.

Better to Have

• Microsoft Defender for Identity, Microsoft Sentinel, Entra ID Protection / Conditional Access, privileged access and identity governance.
• Microsoft Entra Connect / Cloud Sync and hybrid identity fundamentals.

Delivery Accreditations

• Active accreditation (or readiness to accredit within the first [XXX] months) in: Active Directory Certificate Services Assessment; Onboarding Accelerator – Deployment and Migration Assistance for AD CS (Base / Add-On); Technical Blocker Mitigation – AD CS; Show Technical Ability – AD CS; Active Directory Federation Services Assessment.
• Architecture Service – Data Security is a plus.

Security & High-Security Environment Requirements

• Proven experience in environments with high security, compliance, confidentiality or regulated customer requirements (public sector, critical infrastructure, defense, financial services).
• Ability to follow strict confidentiality expectations and demonstrate professionalism, integrity, reliability and accountability.
• Where customer engagements require it, the candidate must be able to meet applicable security screening, background check or clearance requirements.
• Fluent English, spoken and written, is mandatory.
• Fluent Swedish or Finnish is strongly recommended. Additional Nordic languages are a plus.
• Based in Sweden; ability to work onsite as required for customer delivery, workshops or high-security engagements.
• Flexibility to travel within the Nordics as needed.

Core Qualifications & Capabilities

• L4 – Senior CE or above in customer-facing technical delivery or advisory roles with enterprise customers.
• Strong troubleshooting and problem-solving skills in critical identity, authentication, federation and certificate situations.
• Excellent communication, presentation and stakeholder engagement skills.
• Strong balance between deep technical expertise and business understanding.
• Strong ownership mindset, delivery discipline and ability to contribute to team knowledge and repeatable IP.

What Makes This Role Unique:

• Deep specialist role focused on PKI / AD CS and ADFS, among the highest-demand on-premises identity offerings in Nordic EDE delivery.
• Combines assessment, design, migration, hands-on delivery and customer advisory in high-security Nordic environments.
• Opportunity to expand into adjacent areas such as Entra ID modernization, Defender for Identity and Sentinel.