Active Directory Administrator | 12788

About This Opportunity

CTI Staffing is partnering with a leading financial information and technology organization to find an Active Directory Administrator with security experience for their infrastructure team based in New York, NY.

The team runs a large, multi-forest identity environment that supports a global workforce. This role keeps it healthy, locked down, and recoverable, and extends it cleanly into the cloud with Microsoft Entra ID.

What You’ll Do

• Administer Active Directory Domain Services across forests, domains, and sites
  
  


• Own domain controllers, Group Policy, DNS integration, and replication health
  
  


• Run AD security assessments and drive hardening work to completion
  
  


• Implement and enforce Tier 0 and privileged access models
  
  


• Configure and monitor Kerberos, NTLM, LDAP signing, and channel binding
  
  


• Deploy and manage LAPS and gMSA, and review delegation and ACLs for least privilege
  
  


• Find and close attack paths and privilege escalation risks
  
  


• Administer AD CS and PKI services, and plan and test forest recovery
  
  


• Manage Entra ID, Entra Connect, Conditional Access, MFA, and PIM across the hybrid environment
  
  


• Automate administration and reporting with PowerShell, and partner with security teams on incidents and audits
  
  

Requirements

What You Bring

Must-Have:

• Proven enterprise Active Directory administration, including forest and domain architecture, domain controllers, replication, and DNS
  
  


• Hands-on Group Policy, sites and services, trusts, and multi-forest experience
  
  


• Strong PowerShell scripting for administration and reporting
  
  


• AD security assessment and hardening, including Tier 0 and privileged access models
  
  


• Working knowledge of Kerberos and NTLM, LDAP signing, and channel binding
  
  


• Experience with LAPS, gMSA, delegation, and ACLs
  
  


• AD CS and PKI experience, plus forest recovery and disaster recovery
  
  


• Microsoft Entra ID, Entra Connect, Conditional Access, MFA, and PIM
  
  

Nice-to-Have:

• Microsoft Identity and Access Administrator, Security Operations Analyst, or Azure Security Engineer certification
  
  


• Identity threat detection and security monitoring tools
  
  


• Experience in a regulated industry with strict access controls
  
  


• Experience identifying attack paths and privilege escalation with assessment tooling
  
  


• Documentation of standards, procedures, and architecture diagrams
  
  

Technical Environment:

• Active Directory Domain Services, Group Policy, AD CS and PKI, DNS
  
  


• Microsoft Entra ID and Entra Connect, Conditional Access, PIM
  
  


• PowerShell automation
  
  

What Success Looks Like:

• Within 3 months, you own day-to-day AD operations and have a prioritized hardening backlog
  
  


• Within 6 months, Tier 0 boundaries, LAPS, and LDAP signing are enforced and measurable attack paths are reduced
  
  


• Forest recovery and DR procedures are documented and tested