Our game-changers around the world have devoted their careers to ensuring every relationship is exceptional. And we’re proud to be recognized with awards such as "World's Best Workplaces," “Best Companies for Career Growth,” and “Best Company Culture,” year after year.
Join us and be part of this journey towards greater opportunities and brighter futures. We are looking for a Cloud Solution Architect with deep expertise in Public Key Infrastructure (PKI) / Active Directory Certificate Services (AD CS), Active Directory Federation Services (ADFS) and Active Directory to support enterprise and regulated customers in Sweden and the Nordics.
This is a customer-facing role responsible for delivering secure identity and certificate architecture, acting as a trusted technical advisor, and executing repeatable AD CS, ADFS and Windows security engagements across on-premises and hybrid environments. This position is a backfill: depth in PKI / AD CS and ADFS is the primary requirement, with Windows Server/Client security and hybrid identity (Microsoft Entra) as essential complementary skills.
Key Responsibilities
1. PKI, Certificate Services & Identity Architecture
Design, assess and implement enterprise PKI and Active Directory Certificate Services (AD CS) solutions, including CA hierarchy, templates, enrollment, revocation and certificate lifecycle management.
Design and support Active Directory Domain Services (AD DS) and ADFS architectures, including federation, claims, relying-party trusts and modernization/migration to Microsoft Entra ID.
Guide customers on certificate-based trust models, authentication, authorization and secure identity architecture.
2. Customer Delivery & Execution
Lead end-to-end delivery of Unified/EDE engagements, including Active Directory Certificate Services Assessment, Onboarding Accelerator – Deployment and Migration Assistance for AD CS (Base and Add-On), Technical Blocker Mitigation – AD CS, Show Technical Ability – AD CS and ADFS Assessment.
Troubleshoot complex certificate, authentication (Kerberos/NTLM), federation, DNS, Group Policy and DFS issues.
Deliver high-quality, repeatable technical engagements with clear findings, remediation plans and reports.
3. Trusted Advisor & Stakeholder Management
Act as a trusted technical advisor for customers, CSAMs, SDMs and internal stakeholders.
Translate business, compliance and security requirements into practical technical architecture.
Communicate clearly with technical teams and customer decision makers, in English and Swedish.
4. Security Hardening & Governance
Guide customers on secure-by-design identity and certificate architectures.
Drive security hardening for Windows Server, Windows Client, Active Directory, AD CS and ADFS.
Support data security architecture discussions (e.g., Architecture Service – Data Security) where they relate to identity and certificate trust.
5. Operations, Resilience & Optimization
Improve operational stability, monitoring and reliability of identity, federation and certificate services.
Support backup, disaster recovery and business continuity for AD, AD CS and ADFS.
6. Collaboration & Knowledge Sharing
Collaborate with CSAMs, partners, engineering teams and CSA communities to deliver customer outcomes.
Contribute to reusable assets, delivery IP and best practices for PKI, ADFS and hybrid identity.
Share knowledge within the Nordic pod to keep identity and certificate depth in the team after transition.
Required Technical Skills
Target Skill Set (required)
The role covers the following CSA GD taxonomy skills. Only the Tier 1 skills are mandatory at expert level; Tier 2 skills are required at a solid working level and can be deepened on the job. For every technology, the candidate is expected to cover backup and recovery as well as design, operations and troubleshooting.
Tier 1 – Mandatory (expert-level, deep hands-on delivery)
Public Key Infrastructure (PKI) and Certificate Services – AD CS CA hierarchy, templates, enrollment, revocation and certificate lifecycle; CA database and private-key backup, CA recovery/restore and CRL/AIA continuity.
Active Directory Federation Services (ADFS) – federation design, relying-party trusts, claims, SSO and migration to Microsoft Entra ID; ADFS configuration and token-signing certificate backup, farm recovery and high availability.
Active Directory – AD DS design, operations, troubleshooting, Group Policy, DNS and modernization; system-state backup, authoritative/non-authoritative restore and AD forest recovery.
Tier 2 – Required working knowledge
Windows Server Security – Windows Server hardening, Kerberos/NTLM, tiering and privileged access; secure backup and recovery of Tier 0 servers.
Windows Client Security – Windows client hardening, security baselines and credential protection; recovery of BitLocker keys and client security configuration.
Distributed File System (DFS) – DFS Namespaces and DFS Replication design, health and troubleshooting; DFS-N configuration backup and DFS-R database/content recovery.
Microsoft Entra Enterprise Apps & SSO – enterprise application integration, SAML/OIDC SSO and app migration from ADFS to Entra ID; backup and restore of app/SSO configuration and signing-certificate rollover.
Networking – networking fundamentals for identity services (DNS, name resolution, ports/firewalling, load balancing, proxies); DNS zone backup and recovery.
Core Must-have Skills
strong on-premises experience is a must
Mandatory: expert-level depth in at least 2 of the 3 Tier 1 skills
Expert-level Public Key Infrastructure (PKI) / Active Directory Certificate Services (AD CS), including design, migration, certificate lifecycle, templates, enrollment, governance and troubleshooting, including backup and recovery.
Expert-level Active Directory Federation Services (ADFS), including federation design, SSO/enterprise application integration, troubleshooting and migration to Microsoft Entra ID, including backup and recovery.
Strong Active Directory Domain Services and Windows Server Security knowledge, including DNS, Group Policy, Kerberos/NTLM and security hardening, including backup and recovery.
And
Strong Windows Client Security knowledge.
Ability to operate confidently across on-premises and hybrid identity environments.
Proven experience planning and executing backup, restore and disaster recovery for AD, AD CS and ADFS.
Additional Skills – Strongly Preferred
Microsoft Entra External ID (B2B) scenarios.
PowerShell scripting and automation for AD, AD CS and ADFS operations and reporting.
Better to Have
Microsoft Defender for Identity, Microsoft Sentinel, Entra ID Protection / Conditional Access, privileged access and identity governance.
Microsoft Entra Connect / Cloud Sync and hybrid identity fundamentals.
Delivery Accreditations
Active accreditation (or readiness to accredit within the first [XXX] months) in: Active Directory Certificate Services Assessment; Onboarding Accelerator – Deployment and Migration Assistance for AD CS (Base / Add-On); Technical Blocker Mitigation – AD CS; Show Technical Ability – AD CS; Active Directory Federation Services Assessment.
Architecture Service – Data Security is a plus.
Security & High-Security Environment Requirements
Proven experience in environments with high security, compliance, confidentiality or regulated customer requirements (public sector, critical infrastructure, defense, financial services).
Ability to follow strict confidentiality expectations and demonstrate professionalism, integrity, reliability and accountability.
Where customer engagements require it, the candidate must be able to meet applicable security screening, background check or clearance requirements.
Fluent English, spoken and written, is mandatory.
Fluent Swedish or Finnish is strongly recommended. Additional Nordic languages are a plus.
Based in Sweden; ability to work onsite as required for customer delivery, workshops or high-security engagements.
Flexibility to travel within the Nordics as needed.
Core Qualifications & Capabilities
L4 – Senior CE or above in customer-facing technical delivery or advisory roles with enterprise customers.
Strong troubleshooting and problem-solving skills in critical identity, authentication, federation and certificate situations.
Excellent communication, presentation and stakeholder engagement skills.
Strong balance between deep technical expertise and business understanding.
Strong ownership mindset, delivery discipline and ability to contribute to team knowledge and repeatable IP.
What Makes This Role Unique
Deep specialist role focused on PKI / AD CS and ADFS, among the highest-demand on-premises identity offerings in Nordic EDE delivery.
Combines assessment, design, migration, hands-on delivery and customer advisory in high-security Nordic environments.
Opportunity to expand into adjacent areas such as Entra ID modernization, Defender for Identity and Sentinel.
Location
SWE Work-at-Home
Language Requirements
Time Type
