Network Security Engineer (Firewall & Vulnerability Management)

Peraton•Washington, DC

20h•Hybrid

About The Position

Peraton is hiring an experienced, hands-on Network Security Engineer to execute cybersecurity improvement initiatives for its Federal Strategic Cyber programs. The position is project-driven cybersecurity engineering and implementation—not a traditional assessment, advisory, compliance, or steady-state security operations role. The engineer will serve as the dedicated technical resource responsible for executing ten security improvement projects across vulnerability management, endpoint protection, patch management, firewall and network security, identity and access management, and security governance in a hybrid Microsoft, AWS, and Azure federal enterprise environment. The engineer owns technical deliverables from initial assessment and solution design through implementation, testing, validation, documentation, and completion. Work includes personally configuring, implementing, hardening, troubleshooting, and validating enterprise security technologies; applying approved technical changes; remediating vulnerabilities; optimizing security platforms; and measuring improvements to the organization’s security posture. The customer retains responsibility for risk acceptance and policy approvals, while the engineer executes approved technical improvements. The environment operates under IRS Publication 1075, NIST SP 800-53 Revision 5, and the NIST Risk Management Framework. This position is based in Washington, DC, with a hybrid arrangement requiring on-site work Monday through Wednesday and allowing up to two remote days per week. A Tier 2 Public Trust background investigation is required, and candidates must be U.S. citizens. The target salary range is $135,000–$216,000. Eligible employees may also receive overtime, shift differential, and a discretionary bonus, depending on the position.

Requirements

Bachelor’s degree and 12 years of relevant experience; an additional four years of experience may be substituted for the bachelor’s degree.
At least five years of hands-on enterprise cybersecurity experience, including vulnerability assessment, endpoint security, system hardening, and penetration testing.
Demonstrated experience personally configuring, implementing, hardening, troubleshooting, and validating enterprise security technologies and controls.
Ability to independently execute technical security improvement initiatives from assessment and design through implementation, validation, and documentation.
Experience making security configuration changes and performing remediation in production enterprise environments.
Hands-on enterprise firewall configuration and implementation experience with Check Point, Palo Alto Networks, or Cisco; ability to apply firewall engineering expertise to the customer’s Check Point environment.
Experience configuring, modifying, implementing, troubleshooting, and validating firewall policies, rules, access controls, and security hardening measures in production, using formal change-management procedures.
Hands-on Microsoft Defender configuration, policy implementation, and security tuning for Windows and macOS endpoints.
Hands-on Tenable Nessus vulnerability scan configuration, credentialed scanning, troubleshooting, and optimization.
Experience with MECM, Ivanti, and Jamf for endpoint management, patch deployment, configuration management, and automation.
Experience with Microsoft Entra ID or Active Directory security controls, including Conditional Access, PIM, MFA, and identity security.
Experience identifying, prioritizing, and directly remediating enterprise security vulnerabilities; developing remediation governance frameworks, patching workflows, ownership models, and escalation procedures.
Experience implementing and validating security hardening configurations and remediation changes.
Knowledge of formal change-management processes, including testing, implementation, rollback planning, and documentation.
Experience developing technical runbooks, SOPs, and secure configuration documentation.
Working knowledge of NIST SP 800-53 Revision 5, the NIST Risk Management Framework, Zero Trust principles, and IRS Publication 1075.
Experience with at least one of Microsoft Sentinel, Varonis, or Splunk.
Hands-on scripting experience using one or more of Python, PowerShell, or C#.
Experience analyzing and implementing security configurations involving firewall rules, network segmentation, DNS, routing, and cloud networking.
Experience supporting security engineering in hybrid on-premises and AWS/Azure environments, including troubleshooting and remediating network and cloud security weaknesses.
Experience configuring Conditional Access policies and familiarity with PIM configuration, privileged access controls, MFA enforcement, and identity security configurations.
Must be a U.S. citizen and meet Tier 2 Public Trust background investigation requirements.
Must be able to work on-site in Washington, DC, Monday through Wednesday, with up to two remote workdays per week.
Must be able to work independently, manage multiple technical deliverables, and communicate effectively with technical and customer stakeholders.
Strong technical writing and documentation skills.

Nice To Haves

Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a closely related technical discipline.
One or more of the following certifications: CISSP, OSCP, GIAC, CEH, CompTIA Security+, Microsoft Certified: Azure Security Engineer Associate (AZ-500), AWS Certified Security – Specialty, or CISM.
Previous cybersecurity engineering experience supporting federal agencies or environments governed by IRS Publication 1075.
Experience supporting SOC operations, incident response, penetration testing, or red-team exercises.
Residency within the Washington, DC metropolitan area.
Direct experience configuring and implementing security controls in Check Point firewall environments.

Responsibilities

Conduct authenticated and unauthenticated vulnerability assessments across enterprise servers, endpoints, network devices, SQL Server, VDI, and AWS/Azure workloads.
Implement and validate technical vulnerability remediation, secure configuration changes, and system hardening.
Develop a risk-based vulnerability prioritization matrix using CVSS ratings, asset criticality, and exploitability.
Establish a vulnerability remediation governance framework with ownership models, SLA targets, closure standards, and escalation workflows; deliver a formal governance plan within the first 60 days.
Reduce the vulnerability backlog through root-cause analysis, targeted remediation plans, direct remediation, and measurable burn-down tracking.
Configure, tune, and optimize Tenable Nessus scanning policies and infrastructure; troubleshoot credentialed scan failures and address coverage gaps.
Correlate vulnerability findings with Microsoft Sentinel, Varonis, and Splunk to validate results, identify discrepancies, and suppress false positives.
Improve vulnerability scanning accuracy, effectiveness, and reporting; develop dashboards and metrics for technical and executive audiences, including MTTR, vulnerability aging, patch compliance, and security exceptions.
Configure, implement, and optimize patch management solutions using MECM, Ivanti, and Jamf; design patch deployment rings, maintenance windows, and automated workflows.
Develop and execute risk-based Windows and Linux server patching plans and implement endpoint and server hardening measures.
Prepare, submit, and track formal change requests, including implementation, testing, validation, and rollback documentation; update business continuity and disaster recovery documentation related to patch management.
Configure, implement, and harden firewall policies, remediating misconfigurations, overly permissive rules, deprecated objects, and unnecessary access through approved change controls.
Assess, configure, implement, troubleshoot, and validate security improvements in the customer’s Check Point firewall environment; apply enterprise firewall engineering experience with Check Point, Palo Alto Networks, or Cisco.
Configure, implement, and tune Microsoft Defender security policies for Windows and macOS endpoints in alignment with NIST SP 800-53 Revision 5.
Assess, troubleshoot, and implement network security improvements involving firewall rules and ACLs, NAT, DNS, segmentation and routing, VPNs, proxy services, and IPS/IDS.
Conduct AWS and Azure cloud security posture reviews and implement approved configuration improvements.
Assess ZTNA gateway configurations and recommend and implement security enhancements.
Configure and improve Microsoft Entra ID and Active Directory security controls, including Conditional Access, PIM, and MFA; remediate identity and access security gaps through approved changes.
Support penetration testing and red-team exercises, validate findings, and implement technical remediation.
Prepare formal Security Assessment Reports documenting risks, remediation measures, and remaining security considerations.
Develop and maintain security engineering runbooks, playbooks, SOPs, secure configuration baselines, implementation and validation procedures, and knowledge-transfer and operational-transition documentation.
Prepare weekly project status reports and monthly patch compliance and vulnerability management reports.
Provide critical vulnerability notifications in accordance with customer-defined SLAs.
Document security configuration changes, remediation outcomes, and technical deliverables to support operational continuity and audit readiness.

Benefits

Medical insurance
Dental insurance
Vision insurance
Life insurance
Health savings account
Short- and long-term disability
Employee assistance program (EAP)
Parental leave
401(k)
Paid time off (PTO) for vacation
Company-paid holidays
Potential overtime, shift differential, and discretionary bonus, depending on the position