Contract

CTI Consulting; New York (NY); On-site; USD 110,000 - 160,000; Full time

Job summary

CTI Staffing partners with a leading financial information and technology organization to hire an Active Directory Administrator for their infrastructure team based in New York, NY. The role focuses on securing and maintaining a large multi-forest identity environment, extending into the cloud with Microsoft Entra ID.

You will own domain controllers, Group Policy, DNS, and replication health, perform security assessments, and implement Tier 0 and privileged access models while collaborating with

Qualifications

• Enterprise Active Directory administration across forests and domains
• Hands-on Group Policy, sites and services, trusts, multi-forest experience
• Strong PowerShell scripting for admin and reporting
• AD security assessment and hardening including Tier 0 and privileged access models
• Working knowledge of Kerberos, NTLM, LDAP signing, and channel binding
• Experience with LAPS, gMSA, delegation, and ACLs
• AD CS and PKI, plus forest recovery and disaster recovery
• Microsoft Entra ID, Entra Connect, Conditional Access, MFA, and PIM

Responsibilities

• Administer AD DS across forests, domains, and sites
• Own domain controllers, Group Policy, DNS, and replication health
• Run AD security assessments and hardening projects
• Implement and enforce Tier 0 and privileged access models
• Configure and monitor Kerberos, NTLM, LDAP signing, and channel binding
• Deploy and manage LAPS and gMSA, review delegation and ACLs for least privilege
• Manage Entra ID, Entra Connect, Conditional Access, MFA, and PIM in hybrid environments
• Automate administration and reporting with PowerShell, and partner with security teams on incidents and audits
• Plan and test forest recovery and disaster recovery

Skills

Active Directory

Group Policy

PowerShell

AD Security

Tier 0

Privileged Access

Kerberos

NTLM

LDAP Signing

LAPS

gMSA

ACLs

AD CS

PKI

Entra ID

Entra Connect

Conditional Access

MFA

PIM

Tools

PowerShell

Job description

New York, United States

CTI Staffing is partnering with a leading financial information and technology organization to find an Active Directory Administrator with security experience for their infrastructure team based in New York, NY.

The team runs a large, multi-forest identity environment that supports a global workforce. This role keeps it healthy, locked down, and recoverable, and extends it cleanly into the cloud with Microsoft Entra ID.

What You’ll Do

• Administer Active Directory Domain Services across forests, domains, and sites
• Own domain controllers, Group Policy, DNS integration, and replication health
• Run AD security assessments and drive hardening work to completion
• Implement and enforce Tier 0 and privileged access models
• Configure and monitor Kerberos, NTLM, LDAP signing, and channel binding
• Deploy and manage LAPS and gMSA, and review delegation and ACLs for least privilege
• Find and close attack paths and privilege escalation risks
• Administer AD CS and PKI services, and plan and test forest recovery
• Manage Entra ID, Entra Connect, Conditional Access, MFA, and PIM across the hybrid environment
• Automate administration and reporting with PowerShell, and partner with security teams on incidents and audits

Requirements

What You Bring

Must-Have:

• Proven enterprise Active Directory administration, including forest and domain architecture, domain controllers, replication, and DNS
• Hands-on Group Policy, sites and services, trusts, and multi-forest experience
• Strong PowerShell scripting for administration and reporting
• AD security assessment and hardening, including Tier 0 and privileged access models
• Working knowledge of Kerberos and NTLM, LDAP signing, and channel binding
• Experience with LAPS, gMSA, delegation, and ACLs
• AD CS and PKI experience, plus forest recovery and disaster recovery
• Microsoft Entra ID, Entra Connect, Conditional Access, MFA, and PIM

Nice-to-Have:

• Microsoft Identity and Access Administrator, Security Operations Analyst, or Azure Security Engineer certification
• Identity threat detection and security monitoring tools
• Experience in a regulated industry with strict access controls
• Experience identifying attack paths and privilege escalation with assessment tooling
• Documentation of standards, procedures, and architecture diagrams

Technical Environment:

• Active Directory Domain Services, Group Policy, AD CS and PKI, DNS
• Microsoft Entra ID and Entra Connect, Conditional Access, PIM
• PowerShell automation

What Success Looks Like:

• Within 3 months, you own day-to-day AD operations and have a prioritized hardening backlog
• Within 6 months, Tier 0 boundaries, LAPS, and LDAP signing are enforced and measurable attack paths are reduced
• Forest recovery and DR procedures are documented and tested