Principal Security Architect, Active Directory & Entra ID Backup and Recovery

The role

The Principal Architect will lead the technical architecture for AvePoint's hybrid identity resilience build strategy. This role focuses on the architecture of backup, restore, rollback, and disaster recovery capabilities for Active Directory, Microsoft Entra ID, and hybrid environments.

What you will do

• Own the end-to-end technical architecture for Active Directory and Microsoft Entra ID backup, restore, rollback, and disaster recovery capabilities.
• Define the architecture for protecting AD objects, attributes, group memberships, OUs, GPOs, DNS-related state, SYSVOL, domain controllers, forest metadata, and trust relationships.
• Design restore workflows for object-level, attribute-level, group membership, OU, GPO, domain controller, and forest-level recovery.
• Architect support for enterprise AD topologies including multi-domain forests, multiple forests, and hybrid AD-to-Entra scenarios.
• Design the AD collection and backup model including full-state snapshots and incremental change capture.
• Define the hybrid source-of-authority model for AD-synced and cloud-only objects.
• Extend AvePoint's existing Entra ID protection strategy into a coherent hybrid recovery architecture.
• Partner with Product Management to define MVP scope, technical tradeoffs, and acceptance criteria.
• Partner with Engineering to create architecture documents, data models, sequence diagrams, and technical specifications.
• Prototype high-risk technical areas such as AD state capture and object/attribute rollback.

Required qualifications

• Bachelor's degree in Computer Science, Engineering, Information Systems, or a related technical field; equivalent practical experience strongly considered.
• 12+ years of hands-on technical experience in identity infrastructure, directory services, infrastructure recovery, or enterprise systems engineering.
• 8+ years of deep Active Directory architecture experience, including design, operations, troubleshooting, migration, or recovery of enterprise AD environments.
• Direct experience with Active Directory backup, restore, object rollback, domain controller recovery, forest recovery, or directory-service disaster recovery.
• Strong understanding of AD internals, including domain controllers, NTDS.dit, System State, VSS, FSMO roles, RID pools, DSRM, AD-integrated DNS, SYSVOL/DFSR, Group Policy, tombstone/deleted-object lif
• Hands-on experience with complex AD topologies such as multi-domain forests, multiple forests, forest trusts, account/resource forest models, mergers and acquisitions, or regulated/segmented directory
• Deep working knowledge of Microsoft Entra ID and hybrid identity, including Entra Connect / Cloud Sync, sourceAnchor / ImmutableID, hard match / soft match behavior, Microsoft Graph, administrative un
• Experience designing or operating backup and recovery workflows with clear RPO/RTO thinking, recovery point selection, validation, restore ordering, auditability, and customer-facing operational simpl
• Ability to translate low-level directory behavior into product architecture.
• Strong scripting and automation experience, especially with PowerShell, LDAP tooling, Microsoft Graph, Windows Server administration, and lab automation.
• Demonstrated track record of designing and shipping deeply technical infrastructure, identity, or data protection products at scale.
• Outstanding written and verbal communication skills.

Nice to have

• Experience at an AD/Entra backup or recovery vendor is strongly preferred.
• Direct experience at, or deep familiarity with, vendors such as Quest, Semperis, Cayosoft, Netwrix, Commvault, Rubrik, Druva, Veeam, Microsoft, or similar identity/data protection vendors.
• Experience with AD migrations, tenant-to-tenant migrations, Entra ID backup/recovery, Okta/AD integration, or hybrid identity modernization.
• Microsoft MVP recognition, Microsoft identity certifications, or public technical speaking/writing history in AD, Entra ID, or directory services.

Benefits

• Medical
• Dental
• Vision
• 401(k) with match
• Unlimited PTO

About the company

AvePoint is a company that provides identity resilience and hybrid identity recovery solutions.