System Security Engineer

The New York City Department of Investigation (DOI) is one of the oldest law enforcement agencies in the country; its mission is to combat municipal corruption. DOI serves the people of New York City by acting as an independent and nonpartisan watchdog for New York City government, City agencies, and City employees, vendors with City contracts, individuals and entities that receive City funds.

The Information Technology Unit of the NYC Department of Investigation is currently seeking a highly skilled, motivated and hands-on System Security Engineer to manage and secure our environment, including Active Directory, Windows Servers, Exchange (on-prem and Online), Microsoft 365, AirWatch MDM, and file shares.

This role supports system stability and cybersecurity readiness, emphasizing automation, practical risk management, prioritization, and collaboration, ensuring our core systems remain secure, efficient, and compliant within a small but capable IT team.

Key Responsibilities - Active Directory Administration: Manage user accounts, permissions, and Group Policy Objects (GPOs); secure and monitor domain controllers. - Exchange Management: Administer Exchange on-premises and Exchange Online hybrid environments, managing mail flow, mailbox provisioning, spam filtering, and secure mail routing. - Security & Compliance: Apply Microsoft and CIS hardening baselines; enforce consistent GPO and Exchange security configurations; monitor logs for anomalies. -Patch & Configuration Management: Implement and manage regular patching schedules for Windows Servers, Exchange systems, and related components. - Monitoring & Response: Leverage Proofpoint, Varonis, Adaudit, SIEM, Endpoint Manager, and AirWatch MDM to monitor user activity, device compliance, system configurations, and mail flow. Investigate alerts and anomalies related to AD, Exchange, and endpoints to detect and respond promptly to potential security incidents. - File Share Management: Maintain secure access controls and auditing for on-prem file shares; monitor for data access anomalies using Varonis. - Certificates & PKI: Manage digital certificates, renewals, and certificate authorities (CAs) for servers, internal services, and authentication. - Backup & Recovery: Ensure reliable backups for AD, Exchange, file shares, and critical servers; test restoration procedures regularly. - Automation & Documentation: Develop PowerShell scripts to automate patching, mailbox management, and security reporting; maintain accurate operational documentation. -Collaboration: Work cross-functionally with IT support and network teams to maintain a secure, resilient infrastructure.

If selected, the candidate will be fingerprinted and undergo a background investigation. In addition, because the position has a law enforcement and/or investigative function, the candidate's consumer credit history will be reviewed during the background investigation, as permitted by NYC Administrative Code 8-107(24)(b)(2)(A).

SPECIAL INVESTIGATOR (COMPUTER - 31128