Network Security Engineer (Firewall & Vulnerability Management)

Peraton•Washington, DC

2d•$135,000 - $216,000•Hybrid

About The Position

Peraton is hiring an experienced, hands-on Network Security Engineer to execute cybersecurity improvement initiatives for Federal Strategic Cyber programs. The role supports a hybrid Microsoft, AWS, and Azure federal enterprise environment and is project-driven, focused on engineering and implementation rather than traditional security assessment, advisory, compliance, or steady-state security operations. The engineer serves as the dedicated technical resource responsible for ten security improvement projects spanning vulnerability management, endpoint protection, patch management, firewall and network security, identity and access management, and security governance. The engineer owns technical deliverables from assessment and solution design through implementation, testing, validation, documentation, and completion. The customer retains responsibility for risk acceptance and policy approvals; the engineer executes approved technical security improvements. Work is governed by federal cybersecurity requirements, including IRS Publication 1075, NIST SP 800-53 Revision 5, and the NIST Risk Management Framework. The position is hybrid in Washington, DC, with on-site work Monday through Wednesday and up to two remote days per week. A Tier 2 Public Trust background investigation is required, and candidates must be U.S. citizens.

Requirements

Bachelor's degree and 12 years of relevant experience; an additional 4 years of experience may substitute for the bachelor's degree.
At least 5 years of hands-on enterprise cybersecurity experience, including vulnerability assessment, endpoint security, system hardening, and penetration testing.
Demonstrated hands-on experience configuring, implementing, hardening, troubleshooting, and validating enterprise security technologies and controls.
Ability to independently execute technical security improvement initiatives from assessment and design through implementation, validation, and documentation.
Experience performing security configuration changes and remediation in production enterprise environments.
Hands-on enterprise firewall configuration and implementation with Check Point, Palo Alto Networks, or Cisco; ability to apply firewall engineering expertise to the customer's Check Point environment.
Experience personally configuring, modifying, implementing, troubleshooting, and validating firewall policies, rules, access controls, and hardening measures in production using formal change-management procedures.
Hands-on Microsoft Defender endpoint protection configuration, policy implementation, and tuning for Windows and macOS.
Hands-on Tenable Nessus scan configuration, credentialed scanning, troubleshooting, and optimization.
Experience with MECM, Ivanti, and Jamf for endpoint management, patch deployment, configuration management, and automation.
Experience with Microsoft Entra ID and Active Directory security controls, including Conditional Access, PIM, MFA, and identity security.
Experience identifying, prioritizing, and directly remediating enterprise security vulnerabilities; developing remediation governance frameworks, patching workflows, ownership models, and escalation procedures.
Experience implementing and validating security hardening and remediation changes.
Knowledge of formal change-management processes, including testing, implementation, rollback planning, and documentation.
Experience developing technical runbooks, SOPs, and secure configuration documentation.
Working knowledge of NIST SP 800-53 Revision 5, NIST RMF, Zero Trust principles, and IRS Publication 1075.
Experience with at least one of Microsoft Sentinel, Varonis, or Splunk.
Hands-on scripting experience with one or more of Python, PowerShell, or C#.
Experience analyzing and implementing configurations involving firewall rules, network segmentation, DNS, routing, and cloud networking.
Experience supporting security engineering in hybrid on-premises and AWS/Azure environments, including troubleshooting and remediating network and cloud security weaknesses.
Experience configuring Conditional Access; familiarity with PIM and privileged access controls; experience assessing and improving MFA enforcement and identity security.
Must be a U.S. citizen and meet Tier 2 Public Trust background investigation requirements.
Must be able to work on-site in Washington, DC, Monday through Wednesday, with up to two remote workdays per week.
Must be able to work independently, manage multiple technical deliverables, and communicate effectively with technical and customer stakeholders.
Strong technical writing and documentation skills.

Nice To Haves

Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a closely related technical discipline.
One or more certifications: CISSP, OSCP, GIAC, CEH, CompTIA Security+, Microsoft Certified: Azure Security Engineer Associate (AZ-500), AWS Certified Security – Specialty, or CISM.
Cybersecurity engineering experience supporting federal agencies or environments governed by IRS Publication 1075.
Experience supporting SOC operations, incident response, penetration testing, or red team exercises.
Residency in the Washington, DC metropolitan area.
Direct experience configuring and implementing security controls in Check Point firewall environments.

Responsibilities

Conduct authenticated and unauthenticated vulnerability assessments across enterprise servers, endpoints, network devices, SQL Server, VDI, and AWS/Azure workloads.
Implement and validate technical remediation, secure configuration changes, system hardening, and vulnerability resolution.
Develop risk-based vulnerability prioritization using CVSS ratings, asset criticality, and exploitability.
Establish vulnerability remediation governance, including ownership models, SLA targets, closure standards, and escalation workflows; deliver a formal governance plan within the first 60 days.
Reduce vulnerability backlogs through root cause analysis, targeted remediation plans, direct technical remediation, and burn-down tracking.
Configure, tune, and optimize Tenable Nessus scanning policies and infrastructure; troubleshoot credentialed-scan failures and address coverage gaps.
Correlate vulnerability findings with Microsoft Sentinel, Varonis, and Splunk; validate results, identify discrepancies, suppress false positives, and improve scanning and reporting.
Develop dashboards and metrics for technical and executive audiences, including MTTR, vulnerability aging, patch compliance, and security exceptions.
Configure and optimize patch management solutions using MECM, Ivanti, and Jamf; design patch deployment rings, maintenance windows, and automated workflows.
Develop and execute risk-based Windows and Linux server patching plans and implement endpoint and server hardening measures.
Prepare, submit, and track change requests with implementation, testing, validation, and rollback documentation; update continuity and disaster recovery documentation related to patching.
Configure, implement, troubleshoot, and harden firewall policies in the customer's Check Point environment, and apply firewall engineering experience with Check Point, Palo Alto Networks, or Cisco.
Remediate firewall misconfigurations, overly permissive rules, deprecated objects, and unnecessary access permissions through approved change-control procedures.
Configure, implement, and tune Microsoft Defender policies for Windows and macOS endpoints in alignment with NIST SP 800-53 Revision 5.
Assess, troubleshoot, and improve firewall rules and ACLs, NAT, DNS, network segmentation and routing, VPNs, proxy services, and IPS/IDS.
Review AWS and Azure cloud security posture and implement approved configuration improvements.
Assess ZTNA gateway configurations and recommend and implement appropriate security enhancements.
Configure and improve Microsoft Entra ID and Active Directory controls, including Conditional Access, PIM, MFA, and identity security configurations.
Support penetration testing and red team exercises, validate findings, and perform technical remediation.
Prepare formal Security Assessment Reports documenting risks, remediation, and remaining security considerations.
Develop and maintain engineering runbooks, playbooks, SOPs, secure configuration baselines, implementation and validation procedures, and knowledge-transfer documentation.
Prepare weekly project status reports and monthly patch compliance and vulnerability management reports.
Provide critical vulnerability notifications within customer-defined SLAs and document security changes, remediation outcomes, and deliverables for operational continuity and audit readiness.