Network Security Architect Lead - Principal

Amentum•Fort Meade, MD

10d•$240,000 - $310,000•Onsite

About The Position

Amentum is seeking a Network Security Architect Lead, Principal to support DISA at Fort Meade, Maryland. The role serves as the technical authority for designing, engineering, and evolving enterprise IT network infrastructure for mission-critical defense and intelligence work. It leads the definition of secure network boundaries, zero-trust architectures, and security integration across complex enterprise environments, while guiding a network security engineering team and collaborating with integrated technical teams. The position focuses on secure, resilient, high-performance enterprise networks, including Cisco routing and switching and Palo Alto perimeter and boundary defenses. It also leads security engineering for the Risk Management Framework (RMF) Assessment and Authorization process, supports compliance with DISA STIGs and NIST SP 800-53, and helps secure and maintain an Authority to Operate. The role produces technical architecture artifacts, leads reviews and briefings, assesses vulnerabilities and threats, establishes configuration baselines, and supports site deployments and network upgrades. The work is performed daily in a SCIF and may also require periods in a datacenter. The schedule is eight hours per day, Monday through Friday, with the ability to support non-standard hours for maintenance windows, deployment surges, and emergency incident response. Travel may be up to 10%. An active Top Secret clearance with SCI eligibility is required.

Requirements

At least 15 years of experience in network engineering, security architecture, or systems integration, primarily designing large-scale secure enterprise networks.
At least seven years of dedicated senior network security engineering experience, including at least three years as a principal architect or technical lead overseeing security engineering teams.
Bachelor’s degree in Network Engineering, Computer Science, Information Technology, Cybersecurity, Systems Engineering, or a related technical field; equivalent or additional experience may substitute for a degree.
Extensive experience designing and maintaining high-performance networks using Cisco routing and switching platforms, such as Nexus, Catalyst, and ISR/ASR series, across enterprise and datacenter enclaves.
Hands-on experience engineering, configuring, and managing Palo Alto NGFWs, including Panorama, App-ID, User-ID, and advanced threat prevention profiles.
Experience with RMF and designing network architectures to meet NIST SP 800-53 controls and DISA STIGs for a government ATO.
Active DoD 8140/8570.01-M IAM Level III or IAT Level III certification, such as CISSP, CISM, or CompTIA CASP+; the posting also specifies DoD 8570 IASAE III certification as required.
Cisco Certified Internetwork Expert (CCIE) – Security certification.
Experience as a Lead Architect or Principal Engineer on high-consequence DISA or DoD programs.
HAIPE configuration and management experience.
Ability to produce complex architectural artifacts, including HLDs, LLDs, Visio network diagrams, and detailed Network Bills of Materials.
Strong communication, leadership, and technical presentation skills, including experience defending complex network security designs before DISA Technical Control Boards and senior leadership.
Ability to work non-standard hours for maintenance windows, deployment surges, and emergency incident response architectures.
Ability to travel up to 10%.
Active Top Secret clearance with SCI eligibility.
Compliance with company drug and alcohol policies and successful completion of the drug screening process are conditions of employment.

Nice To Haves

Palo Alto Networks Certified Network Security Engineer (PCNSE).
Palo Alto Networks Certified Network Security Consultant (PCNSC).
F5 Certified Administrator BIG-IP.
Experience with software-defined networking technologies such as Cisco SD-Access or Cisco SD-WAN.

Responsibilities

Serve as the principal technical authority for secure design, engineering, and evolution of enterprise IT network infrastructure.
Architect and engineer high-performance, resilient network transport solutions using enterprise Cisco routing and switching platforms across multiple sites.
Design, deploy, and govern perimeter and boundary defense systems using Palo Alto NGFWs, including threat prevention, SSL decryption, and security policy management.
Lead security engineering for the RMF Assessment and Authorization process and ensure designs comply with DISA STIGs and support an active ATO.
Define architectural standards, blueprints, and TTPs for secure network integration, data flow segregation, and cross-domain solutions.
Set technical and daily priorities for the network security engineering team; provide mentorship, design standards, and escalation support for complex network anomalies.
Translate operational requirements and DISA security mandates into technical specifications, low-level network designs, and security architecture diagrams.
Organize and lead architecture reviews, change control assessments, and security posture briefings with program leadership and DISA technical authorities.
Collaborate with Systems Engineers, Cloud Architects, and Project Managers to design secure interfaces and schedule authorized service interruptions for network upgrades.
Conduct vulnerability assessments and threat modeling, identify potential exploit vectors, and engineer mitigations.
Establish baseline configurations and configuration control templates for network and security hardware in alignment with configuration management policies.
Lead technical site surveys, assess infrastructure readiness, produce Network Bills of Materials, and assist with migration schedules for enterprise deployments.
Support non-standard hours for scheduled maintenance windows, deployment surges, and emergency incident response architectures.
Travel up to 10%.
Comply with applicable safety, quality, operational, environmental, and company policies and procedures.