Senior Systems and Security Administrator

The O\\'Neil Search Group; New York (NY); On-site; USD 140,000 - 190,000; Full time

Job summary

The ONeil Search Group is seeking a senior technology security professional to support multiple offices in New York, DC, and Los Angeles. You will partner with the CIO to mature controls, manage identity systems, and oversee endpoint, network, and cloud security programs.

You will lead incident response activities, vulnerability management, patching, disaster recovery planning, and documentation while driving automation and AI-tool governance across the environment.

Responsibilities

• Work as part of the Firm's technology group supporting our New York, Washington, DC, and Los Angeles offices, partnering day to day with information security, systems and infrastructure, and end-user support colleagues, and serving as senior technical escalation for the support team.
• Partner closely with the Chief Information Officer on the hardening and maturation of systems across the technology stack, identifying gaps and bringing forward improvements to configuration, resilience, and control coverage.
• Identity and access: Administer Microsoft Entra ID - identity lifecycle, conditional access, multifactor and passwordless authentication, privileged access, and single sign-on - and provision, modify, and revoke access under the Firm's access control standards.
• Microsoft 365 and endpoints: Administer Exchange Online, SharePoint, OneDrive, Teams, and Purview; manage the Windows endpoint estate through Intune and Autopatch, including compliance policies, configuration profiles, security baselines, application deployment, and Cloud PC provisioning.
• Network: Administer Cisco Meraki across three offices - firewall policy, VLAN segmentation, wireless, and VPN - together with the Firm's cloud-delivered web security platform.
• Security operations: Operate SentinelOne EDR, Microsoft Defender, and the Firm's data loss prevention and device controls; triage and investigate alerts alongside the Firm's managed SOC provider and elevate under the Incident Response Plan.
• Incident response: Serve on the Security Incident Response Team, performing containment, eradication, and recovery under the direction of the Incident Response Technical Lead, and contribute to root cause analysis.
• Vulnerability and patch management: Remediate findings within defined service levels; manage patching across endpoints, servers, and network firmware; support annual third-party penetration testing and the remediation that follows.
• Change and configuration management: Prepare, document, test, and implement changes to production systems, network devices, and firewalls, with approval obtained before implementation; maintain hardening standards and configuration baselines.
• Backup and recovery: Maintain backup configuration and monitoring, investigate and resolve failures, execute authorized restores, and participate in annual restoration testing.
• Disaster recovery: Serve as alternate Technical Recovery Lead, maintaining and executing system recovery runbooks and participating in the annual combined business continuity and disaster recovery exercise.
• Asset and media management: Maintain the inventory of endpoints, mobile devices, network hardware, and software licensing, and handle media in accordance with classification, retention, and destruction requirements.
• Cryptographic key custody: Serve as a key manager for the Firm's encryption and credential management platforms.
• Security program support: Support the Firm's ISO/IEC 27001 certification program, internal audit, and client security assessments by gathering evidence and remediating findings.
• Support the Firm's legal and business platforms in partnership with their owners and vendors, alongside other application and systems support personnel.
• Automation: Alongside the Firm's Technology Solutions Engineer, take ownership of the Firm's existing automations and build new ones - using PowerShell, Microsoft Graph, Intune and Entra configuration, and platform-native workflows - to bring efficiency and consistency to provisioning and deprovisioning, configuration, reporting, evidence collection, and routine maintenance. Document what you build so it can be supported by others.
• AI-enabled tooling: Administer and secure the Firm's approved AI platforms, applying the same identity, data protection, and logging controls that govern the rest of the environment, and help evaluate new capabilities and the controls they require. Act as an informed advocate for responsible AI use, helping colleagues understand what the tooling can do while ensuring appropriate human oversight.
• Develop and document technical processes, procedures, and runbooks, and keep system documentation current as the environment changes.

Job description

Responsibilities:

• Work as part of the Firm's technology group supporting our New York, Washington, DC, and Los Angeles offices, partnering day to day with information security, systems and infrastructure, and end-user support colleagues, and serving as senior technical escalation for the support team.
• Partner closely with the Chief Information Officer on the hardening and maturation of systems across the technology stack, identifying gaps and bringing forward improvements to configuration, resilience, and control coverage.
• Identity and access: Administer Microsoft Entra ID - identity lifecycle, conditional access, multifactor and passwordless authentication, privileged access, and single sign-on - and provision, modify, and revoke access under the Firm's access control standards.
• Microsoft 365 and endpoints: Administer Exchange Online, SharePoint, OneDrive, Teams, and Purview; manage the Windows endpoint estate through Intune and Autopatch, including compliance policies, configuration profiles, security baselines, application deployment, and Cloud PC provisioning.
• Network: Administer Cisco Meraki across three offices - firewall policy, VLAN segmentation, wireless, and VPN - together with the Firm's cloud-delivered web security platform.
• Security operations: Operate SentinelOne EDR, Microsoft Defender, and the Firm's data loss prevention and device controls; triage and investigate alerts alongside the Firm's managed SOC provider and elevate under the Incident Response Plan.
• Incident response: Serve on the Security Incident Response Team, performing containment, eradication, and recovery under the direction of the Incident Response Technical Lead, and contribute to root cause analysis.
• Vulnerability and patch management: Remediate findings within defined service levels; manage patching across endpoints, servers, and network firmware; support annual third-party penetration testing and the remediation that follows.
• Change and configuration management: Prepare, document, test, and implement changes to production systems, network devices, and firewalls, with approval obtained before implementation; maintain hardening standards and configuration baselines.
• Backup and recovery: Maintain backup configuration and monitoring, investigate and resolve failures, execute authorized restores, and participate in annual restoration testing.
• Disaster recovery: Serve as alternate Technical Recovery Lead, maintaining and executing system recovery runbooks and participating in the annual combined business continuity and disaster recovery exercise.
• Asset and media management: Maintain the inventory of endpoints, mobile devices, network hardware, and software licensing, and handle media in accordance with classification, retention, and destruction requirements.
• Cryptographic key custody: Serve as a key manager for the Firm's encryption and credential management platforms.
• Security program support: Support the Firm's ISO/IEC 27001 certification program, internal audit, and client security assessments by gathering evidence and remediating findings.
• Support the Firm's legal and business platforms in partnership with their owners and vendors, alongside other application and systems support personnel.
• Automation: Alongside the Firm's Technology Solutions Engineer, take ownership of the Firm's existing automations and build new ones - using PowerShell, Microsoft Graph, Intune and Entra configuration, and platform-native workflows - to bring efficiency and consistency to provisioning and deprovisioning, configuration, reporting, evidence collection, and routine maintenance. Document what you build so it can be supported by others.
• AI-enabled tooling: Administer and secure the Firm's approved AI platforms, applying the same identity, data protection, and logging controls that govern the rest of the environment, and help evaluate new capabilities and the controls they require. Act as an informed advocate for responsible AI use, helping colleagues understand what the tooling can do while ensuring appropriate human oversight.
• Develop and document technical processes, procedures, and runbooks, and keep system documentation current as the environment changes.