Active Directory Security Engineer

Duration of Project: 6-9 months
Location/Address:
Onsite daily. Office locations consist of the following addresses in NYC:

Multiple Locations (Client has 3 in NY)
Lexington Avenue or
Park Avenue or
3rd Avenue

Position Overview We are seeking an Active Directory Administrator with security experience to design, operate, harden, and protect our enterprise identity infrastructure. The ideal candidate combines deep Active Directory expertise with a strong security mindset, including assessing and reducing attack paths, enforcing privileged access controls, and supporting hybrid identity in Microsoft Entra ID.

Key Responsibilities
Administer and maintain Active Directory Domain Services across forests, domains, and sites.
Design and maintain forest and domain architecture, domain controllers, Group Policy, and AD replication.
Manage DNS integration with AD, sites and services, trusts, and multi-forest environments.
Perform AD security assessments and implement hardening measures.
Implement and enforce Tier 0 and privileged access models.
Configure and monitor Kerberos and NTLM authentication, LDAP signing, and channel binding.
Deploy and manage LAPS and gMSA accounts.
Review and manage delegation and ACLs to enforce least privilege.
Identify and remediate attack paths and privilege escalation risks.
Administer AD CS and PKI services.
Plan and execute forest recovery and disaster recovery procedures.
Manage Microsoft Entra ID, Entra Connect, and hybrid identity synchronization.
Implement and maintain Conditional Access, MFA, and PIM policies.
Automate administrative tasks and reporting using PowerShell.
Partner with security, infrastructure, and operations teams on identity-related incidents and audits.
Document standards, procedures, and architecture diagrams.

Required Qualifications
Proven experience administering Active Directory in an enterprise environment.
Hands-on experience with Active Directory / AD DS and Forest / Domain Architecture.
Experience with Domain Controllers, Group Policy / GPO, and AD Replication.
Experience with DNS / Sites and Services and Trusts / Multi-Forest environments.
Strong PowerShell scripting skills.
Experience with AD Security Assessment / Hardening.
Working knowledge of Tier 0 / Privileged Access models.
Understanding of Kerberos / NTLM authentication.
Experience with LDAP Signing / Channel Binding.
Experience with LAPS / gMSA.
Experience with Delegation / ACLs.
Experience with Authentication Hardening.
Knowledge of Attack Paths / Privilege Escalation and how to mitigate them.
Experience with AD CS / PKI.
Experience with Forest Recovery / Disaster Recovery.
Experience with Microsoft Entra ID, Entra Connect, and Hybrid Identity.
Experience with Conditional Access, MFA, and PIM.

Preferred Qualifications
Relevant certifications such as Microsoft Certified: Identity and Access Administrator Associate, Microsoft Certified: Security Operations Analyst Associate, or Microsoft Certified: Azure Security Engineer Associate.
Experience with identity threat detection tools and security monitoring.
Experience in regulated industries with strict access control requirements.

Physical Requirements
Ability to sit and work at a computer for extended periods, typically 6 to 8 hours per day.
Ability to use a keyboard, mouse, and monitor for repetitive tasks.
Ability to lift and carry up to 25 pounds, such as laptops, network equipment, or hardware components.
Ability to occasionally access server rooms or data center environments, which may require standing, bending, or climbing stairs.
Visual acuity sufficient to read small text on screens, cabling labels, and hardware indicators.

Note: Reasonable accommodations are available to qualified individuals with disabilities. Please contact Human Resources to request an accommodation.
Interview Process No AI tools or assistants are permitted during any part of the interview process. This includes live interviews, technical assessments, and written exercises. Candidates must answer all questions using their own knowledge and experience.

Nesco Resource offers a comprehensive benefits package for our associates, which includes a MEC (Minimum Essential Coverage) plan that encompasses Medical, Vision, Dental, 401K, and EAP (Employee Assistance Program) services.

Nesco Resource provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws.