Active Directory Administrator | 12788

CTI Consulting • New York, NY

8d

About The Position

CTI Staffing is partnering with a leading financial information and technology organization to hire an Active Directory Administrator with security experience for its infrastructure team in New York, NY. The team operates a large, multi-forest identity environment supporting a global workforce. The role is responsible for keeping the environment healthy, secure, and recoverable, and extending it into the cloud using Microsoft Entra ID.

The administrator will manage Active Directory Domain Services across forests, domains, and sites; maintain domain controllers, Group Policy, DNS integration, and replication; and lead security assessments and hardening. The position also manages privileged access controls, AD CS and PKI, forest recovery planning, and hybrid identity services including Entra ID. PowerShell automation, reporting, and collaboration with security teams on incidents and audits are part of the role.

Success is defined by taking ownership of day-to-day AD operations and prioritizing hardening work within three months; enforcing measurable Tier 0 boundaries, LAPS, and LDAP signing and reducing attack paths within six months; and documenting and testing forest recovery and disaster recovery procedures.

Requirements

• Proven enterprise Active Directory administration experience, including forest and domain architecture, domain controllers, replication, and DNS.
• Hands-on experience with Group Policy, sites and services, trusts, and multi-forest environments.
• Strong PowerShell scripting skills for administration and reporting.
• Experience with Active Directory security assessments and hardening, including Tier 0 and privileged access models.
• Working knowledge of Kerberos and NTLM, LDAP signing, and channel binding.
• Experience with LAPS, gMSA, delegation, and ACLs.
• AD CS and PKI experience, plus forest recovery and disaster recovery experience.
• Experience with Microsoft Entra ID, Entra Connect, Conditional Access, MFA, and PIM.

Nice To Haves

• Microsoft Identity and Access Administrator, Security Operations Analyst, or Azure Security Engineer certification.
• Experience with identity threat detection and security monitoring tools.
• Experience in a regulated industry with strict access controls.
• Experience identifying attack paths and privilege escalation using assessment tooling.
• Experience documenting standards, procedures, and architecture diagrams.

Responsibilities

• Administer Active Directory Domain Services across forests, domains, and sites.
• Manage domain controllers, Group Policy, DNS integration, and replication health.
• Conduct Active Directory security assessments and complete hardening work.
• Implement and enforce Tier 0 and privileged access models.
• Configure and monitor Kerberos, NTLM, LDAP signing, and channel binding.
• Deploy and manage LAPS and gMSA, and review delegation and ACLs to enforce least privilege.
• Identify and remediate attack paths and privilege escalation risks.
• Administer AD CS and PKI services, and plan and test forest recovery.
• Manage Entra ID, Entra Connect, Conditional Access, MFA, and PIM across the hybrid environment.
• Automate administration and reporting with PowerShell.
• Partner with security teams on incidents and audits.
• Document and test forest recovery and disaster recovery procedures.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed