Sr. Lead Directory Services Engineer

Company Description

NBCUniversal is one of the world's leading media and entertainment companies. We create world-class content, which we distribute across our portfolio of film, television, and streaming, and bring to life through our theme parks and consumer experiences. We own and operate leading entertainment and news brands, including NBC, NBC News, MSNBC, CNBC, NBC Sports, Telemundo, NBC Local Stations, Bravo, USA Network, and Peacock, our premium ad-supported streaming service. We produce and distribute premier filmed entertainment and programming through Universal Filmed Entertainment Group and Universal Studio Group, and have world-renowned theme parks and attractions through Universal Destinations & Experiences. NBCUniversal is a subsidiary of Comcast Corporation.

Our impact is rooted in improving the communities where our employees, customers, and audiences live and work. We have a rich tradition of giving back and ensuring our employees have the opportunity to serve their communities. We champion an inclusive culture and strive to attract and develop a talented workforce to create and deliver a wide range of content reflecting our world.

Comcast NBCUniversal has announced its intent to create a new publicly traded company ('Versant') comprised of most of NBCUniversal's cable television networks, including USA Network, CNBC, MSNBC, Oxygen, E!, SYFY and Golf Channel along with complementary digital assets Fandango, Rotten Tomatoes, GolfNow, GolfPass, and SportsEngine. The well-capitalized company will have significant scale as a pure-play set of assets anchored by leading news, sports and entertainment content. The spin-off is expected to be completed during 2025.

Job Description

The Senior Lead Directory Services Engineer is responsible for leading and advancing enterprise directory infrastructure across on-premise, hybrid, and cloud environments. This role oversees Microsoft Active Directory, Entra ID/Azure AD, LDAP directories, Ping Directory, and RadiantOne VDS—along with domain controllers, servers, storage, and network dependencies. This individual ensures uptime, security, replication integrity, and modernization of identity platforms while partnering with Cyber, Infrastructure, and Business stakeholders.

RESPONSIBILITIES:

Key areas of focus for the Directory Services Engineer include ensuring global uptime, monitoring, and failover of directory services, seamlessly connecting directory services with identity and business systems, and enforcing secure protocols, admin separation, and access tiering.  The successful candidate will be responsible for the following activities:

• Directory & Infrastructure Leadership

• Design, secure, and maintain Active Directory, Entra ID/Azure AD, LDAP, Ping Directory, and RadiantOne VDS
• Manage domain controllers, server builds, storage integration, replication roles, and monitoring
• Oversee DNS/DHCP integration, site topology, failover, and global uptime

• Networking & Platform Integration

• Partner with network teams to manage VLANs, firewalls, subnets, VPN/site links, and isolated environments
• Coordinate directory services across Windows, Linux, Unix (AIX/Solaris), and macOS platforms

• Architecture, Security & Hardening

• Implement forest/domain architecture, OU models, replication topology, and delegated access
• Apply Tier 0 protections, MFA integration, privileged access separation, and credential hardening
• Enforce CIS, DISA STIG, and Microsoft baselines for directory services and supporting systems

• GPO & Policy Enforcement

• Lead Group Policy design and enforcement for security baselines, login policies, TLS/LDAPS, firewall controls, encryption, and device posture
• Conduct policy audits, conflict resolution, and impact assessments

• Identity Lifecycle & Object Governance

• Oversee provisioning and synchronization of users, groups, service accounts, and privileged identities
• Manage schema extensions, object standards, and directory hygiene across hybrid ecosystems

• Endpoint, OS & Server Security

• Harden servers and VMs with patch baselines, encryption, EDR/XDR, LSASS protection, PAWs, and conditional access
• Implement secure communications over Kerberos, LDAPS, and certificate-based trust

• Integration & Collaboration

• Integrate directory services with IT, IAM/PAM platforms, PKI, authentication systems, and enterprise applications
• Partner with Cloud, Security Engineering, and Infrastructure teams on modernization and resiliency efforts

• Modernization & Strategic Initiatives

• Lead cloud-native directory strategies, domain consolidatio