Active Directory Administrator | 12788

About This Opportunity

CTI Staffing is partnering with a leading financial information and technology organization to find an Active Directory Administrator with security experience for their infrastructure team based in New York, NY.

The team runs a large, multi-forest identity environment that supports a global workforce. This role keeps it healthy, locked down, and recoverable, and extends it cleanly into the cloud with Microsoft Entra ID.

What You’ll Do

• Administer Active Directory Domain Services across forests, domains, and sites
• Own domain controllers, Group Policy, DNS integration, and replication health
• Run AD security assessments and drive hardening work to completion
• Implement and enforce Tier 0 and privileged access models
• Configure and monitor Kerberos, NTLM, LDAP signing, and channel binding
• Deploy and manage LAPS and gMSA, and review delegation and ACLs for least privilege
• Find and close attack paths and privilege escalation risks
• Administer AD CS and PKI services, and plan and test forest recovery
• Manage Entra ID, Entra Connect, Conditional Access, MFA, and PIM across the hybrid environment
• Automate administration and reporting with PowerShell, and partner with security teams on incidents and audits

Requirements

What You Bring

Must-Have:

• Proven enterprise Active Directory administration, including forest and domain architecture, domain controllers, replication, and DNS
• Hands-on Group Policy, sites and services, trusts, and multi-forest experience
• Strong PowerShell scripting for administration and reporting
• AD security assessment and hardening, including Tier 0 and privileged access models
• Working knowledge of Kerberos and NTLM, LDAP signing, and channel binding
• Experience with LAPS, gMSA, delegation, and ACLs
• AD CS and PKI experience, plus forest recovery and disaster recovery
• Microsoft Entra ID, Entra Connect, Conditional Access, MFA, and PIM

Nice-to-Have:

• Microsoft Identity and Access Administrator, Security Operations Analyst, or Azure Security Engineer certification
• Identity threat detection and security monitoring tools
• Experience in a regulated industry with strict access controls
• Experience identifying attack paths and privilege escalation with assessment tooling
• Documentation of standards, procedures, and architecture diagrams

Technical Environment:

• Active Directory Domain Services, Group Policy, AD CS and PKI, DNS
• Microsoft Entra ID and Entra Connect, Conditional Access, PIM
• PowerShell automation

What Success Looks Like:

• Within 3 months, you own day-to-day AD operations and have a prioritized hardening backlog
• Within 6 months, Tier 0 boundaries, LAPS, and LDAP signing are enforced and measurable attack paths are reduced
• Forest recovery and DR procedures are documented and tested