Active Directory Administrator | 12788

About This Opportunity CTI Staffing is partnering with a leading financial information and technology organization to find an Active Directory Administrator with security experience for their infrastructure team based in New York, NY. The team runs a large, multi-forest identity environment that supports a global workforce.

This role keeps it healthy, locked down, and recoverable, and extends it cleanly into the cloud with Microsoft Entra ID. What You’ll Do Administer Active Directory Domain Services across forests, domains, and sites Own domain controllers, Group Policy, DNS integration, and replication health Run AD security assessments and drive hardening work to completion Implement and enforce Tier 0 and privileged access models Configure and monitor Kerberos, NTLM, LDAP signing, and channel binding Deploy and manage LAPS and gMSA, and review delegation and ACLs for least privilege Find and close attack paths and privilege escalation risks Administer AD CS and PKI services, and plan and test forest recovery Manage Entra ID, Entra Connect, Conditional Access, MFA, and PIM across the hybrid environment Automate administration and reporting with Power.

Shell, and partner with security teams on incidents and audits Requirements What You Bring Must-Have: Proven enterprise Active Directory administration, including forest and domain architecture, domain controllers, replication, and DNS Hands-on Group Policy, sites and services, trusts, and multi-forest experience Strong Power.

Shell scripting for administration and reporting AD security assessment and hardening, including Tier 0 and privileged access models Working knowledge of Kerberos and NTLM, LDAP signing, and channel binding Experience with LAPS, gMSA, delegation, and ACLs AD CS and PKI experience, plus forest recovery and disaster recovery Microsoft Entra ID, Entra Connect, Conditional Access, MFA, and PIM Nice-to-Have: Microsoft Identity and Access Administrator, Security Operations Analyst, or Azure Security Engineer certification Identity threat detection and security monitoring tools Experience in a regulated industry with strict access controls Experience identifying attack paths and privilege escalation with assessment tooling Documentation of standards, procedures, and architecture diagrams Technical Environment: Active Directory Domain Services, Group Policy, AD CS and PKI, DNS Microsoft Entra ID and Entra Connect, Conditional Access, PIM Power.

Shell automation What Success Looks Like: Within 3 months, you own day-to-day AD operations and have a prioritized hardening backlog Within 6 months, Tier 0 boundaries, LAPS, and LDAP signing are enforced and measurable attack paths are reduced Forest recovery and DR procedures are documented and tested