- Bachelor’s degree in Computer Science, Engineering, Information Systems, Cybersecurity, or a related technical field; equivalent practical experience strongly considered.
- 12+ years of hands-on technical experience in identity infrastructure, cybersecurity architecture, incident response, or security engineering, with deep specialization in enterprise identity security.
- Direct experience securing or recovering complex identity environments, including Active Directory, Microsoft Entra ID, hybrid identity, federation, trust relationships, privileged access boundaries, application identities, workload identities, and ransomware or destructive-attack readiness.
- Deep understanding of AD security internals: Kerberos, NTLM, LDAP, ACLs/delegation, privileged groups, admin tiering, DCSync/replication rights, krbtgt rotation, golden/silver ticket risk, domain/forest trusts, SID history, SPNs, constrained/unconstrained/resource-based constrained delegation, SYSVOL/GPO security, DNS, and AD CS/PKI risk.
- Deep understanding of Entra ID security architecture: Conditional Access, PIM, privileged roles, administrative units, authentication methods, Identity Protection, app registrations, enterprise applications, service principals, OAuth consent, workload identities, cross-tenant access, federation, and token/session behavior.
- Strong understanding of hybrid identity security: Entra Connect, Cloud Sync, password hash sync, pass-through authentication, AD FS/federation, sourceAnchor/ImmutableID, hard/soft match, source-of-authority conflicts, and how on-premises compromise can affect Microsoft 365/Entra environments.
- Hands-on experience with identity incident response and recovery workflows, including compromised user containment, refresh-token/session revocation concepts, application/service-principal compromise response, API consent review, credential rotation, Conditional Access emergency response, and persistence removal.
- Experience designing security architecture for high-privilege tools or platforms that operate against Tier-0 infrastructure, including secure credential handling, least privilege, separation of duties, audit logging, tamper resistance, approval workflows, and customer-managed key/storage models.
- Familiarity with disaster recovery and business continuity requirements for identity systems, including RTO/RPO tradeoffs, known-good baselines, clean recovery environments, in-place vs. clean-tenant recovery decisions, and post-restore validation.
- Ability to translate complex security requirements into product requirements, architecture patterns, workflow guardrails, customer-facing warnings, and acceptance criteria that engineering teams can implement.
- Strong customer-facing credibility with CISOs, identity architects, AD engineers, SOC/IR teams, compliance leaders, and executive stakeholders.
- Demonstrated ability to lead without authority across Product, Engineering, Security, Architecture, Customer Success, Sales Engineering, and partner teams.
- Bonus: Experience working at or with vendors that build AD/Entra backup, recovery, ITDR, identity protection, or hybrid identity resilience products, such as Semperis, Quest, Cayosoft, Microsoft, Rubrik, Commvault, Veeam, CrowdStrike Identity, Mandiant, or equivalent.
- Bonus: Experience with Microsoft Defender for Identity, Microsoft Defender XDR, Microsoft Sentinel, Splunk, CrowdStrike, Semperis DSP, Quest, Cayosoft Guardian, or similar identity detection/response ecosystems.
- Bonus: Relevant certifications or recognition such as Microsoft Certified: Cybersecurity Architect Expert, Identity and Access Administrator, CISSP, GIAC, Microsoft MVP, or equivalent hands-on expertise.
The Salary Range for this role is $180,000 - $270,000. At AvePoint, we strive to offer competitive, fair, and equitable total rewards. The listed salary range represents a good faith estimate, with final offers based on location, experience, skills, and qualifications. The listed range reflects base salary only; our total rewards include base salary, comprehensive benefits (medical, dental, vision, 401(k) with match, unlimited PTO), and depending on the role, bonuses, commissions, or equity (RSUs). We welcome compensation discussions—apply even if your expectations fall outside the range.
Any personal data you share with us during the application process will be processed strictly in compliance with applicable data protection laws and our Privacy Notice.