Active Directory Administrator | 12788

CTI Consulting • New York, NY

9d

About The Position

CTI Staffing is partnering with a leading financial information and technology organization to hire an Active Directory Administrator with security experience for its infrastructure team in New York, NY. The team operates a large, multi-forest identity environment supporting a global workforce. The role is responsible for keeping the environment healthy, secure, and recoverable, and extending it into the cloud with Microsoft Entra ID.

The administrator will manage Active Directory Domain Services across forests, domains, and sites; maintain domain controllers, Group Policy, DNS integration, and replication; and lead security assessments and hardening. The role also covers privileged access controls, authentication protocols, LAPS and gMSA, delegation and ACL reviews, attack-path reduction, AD CS and PKI, forest recovery, and hybrid identity services including Entra ID and Entra Connect. PowerShell automation, reporting, and collaboration with security teams on incidents and audits are part of the work.

Success includes taking ownership of day-to-day AD operations and establishing a prioritized hardening backlog within three months. Within six months, Tier 0 boundaries, LAPS, and LDAP signing should be enforced and measurable attack paths reduced. Forest recovery and disaster recovery procedures are to be documented and tested.

Requirements

• Proven enterprise Active Directory administration, including forest and domain architecture, domain controllers, replication, and DNS.
• Hands-on experience with Group Policy, sites and services, trusts, and multi-forest environments.
• Strong PowerShell scripting skills for administration and reporting.
• Experience with Active Directory security assessment and hardening, including Tier 0 and privileged access models.
• Working knowledge of Kerberos and NTLM, LDAP signing, and channel binding.
• Experience with LAPS, gMSA, delegation, and ACLs.
• AD CS and PKI experience, plus forest recovery and disaster recovery experience.
• Experience with Microsoft Entra ID, Entra Connect, Conditional Access, MFA, and PIM.

Nice To Haves

• Microsoft Identity and Access Administrator, Security Operations Analyst, or Azure Security Engineer certification.
• Experience with identity threat detection and security monitoring tools.
• Experience in a regulated industry with strict access controls.
• Experience identifying attack paths and privilege-escalation risks using assessment tooling.
• Experience documenting standards, procedures, and architecture diagrams.

Responsibilities

• Administer Active Directory Domain Services across forests, domains, and sites.
• Own domain controllers, Group Policy, DNS integration, and replication health.
• Conduct Active Directory security assessments and drive hardening work to completion.
• Implement and enforce Tier 0 and privileged access models.
• Configure and monitor Kerberos, NTLM, LDAP signing, and channel binding.
• Deploy and manage LAPS and gMSA, and review delegation and ACLs for least privilege.
• Identify and close attack paths and privilege-escalation risks.
• Administer AD CS and PKI services, and plan and test forest recovery.
• Manage Entra ID, Entra Connect, Conditional Access, MFA, and PIM across the hybrid environment.
• Automate administration and reporting with PowerShell.
• Partner with security teams on incidents and audits.
• Document and test forest recovery and disaster recovery procedures.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed