Principal Network Access Control (NAC) Engineer

Global Enterprise Services•Fort Meade, MD

4d•Hybrid

About The Position

GES is seeking a senior engineer specializing in enterprise wireless infrastructure to design, implement, and modernize a large-scale, geographically distributed wireless network. The role focuses on migrating Aruba wireless controllers to a centralized cloud-hosted environment, implementing Aruba Central, improving wireless resiliency, and standardizing wireless security and access-control capabilities. The engineer will support architecture, implementation, integration, testing, migration, documentation, and transition to operations, while providing technical direction to engineering personnel. The engineer will collaborate with cloud, network, cybersecurity, identity management, and monitoring teams. The position requires extensive Aruba wireless, enterprise networking, wireless security, high availability, and network access control experience. The role is in the office five days per week until acclimated, after which one remote day may be possible. An active Secret clearance is required.

Requirements

Bachelor's degree with 12 or more years of relevant experience, or master's degree with 10 or more years of relevant experience; additional relevant experience, education, or training may be considered in lieu of a degree.
IAT Level II certification.
Significant hands-on experience engineering, implementing, and supporting enterprise Aruba wireless infrastructure, including controllers, access points, and centralized management platforms.
Experience with Aruba Central, including configuration management, controller integration, and enterprise wireless deployments.
Strong knowledge of enterprise wireless networking, including 802.11 standards, RF fundamentals, WLAN architecture, VLANs, routing, and switching.
Experience implementing and troubleshooting wireless controller redundancy, high availability, failover, and network resiliency.
Experience with wireless security and authentication, including WPA2/WPA3, 802.1X, RADIUS, and enterprise NAC platforms.
Experience integrating wireless infrastructure with enterprise networking services, including DNS, DHCP, NTP, routing, and monitoring platforms.
Experience developing engineering designs, implementation plans, migration procedures, test plans, and production deployments.
Strong troubleshooting and analytical skills to resolve complex wireless connectivity, authentication, and network performance issues.
Strong written and verbal communication skills, including providing technical guidance and developing engineering documentation.
U.S. citizenship.
Active Secret clearance.
Must meet applicable cybersecurity workforce qualification requirements for the assigned position.

Nice To Haves

Experience migrating Aruba wireless controllers to cloud-hosted or centrally managed environments.
Experience with Aruba Central On-Premises or cloud-managed Aruba deployments.
Experience implementing VRRP, controller preemption, and Layer 2/Layer 3 failover architectures.
Experience with bridge-mode, tunnel-mode, campus, and remote wireless architectures.
Experience integrating Cisco ISE and Aruba ClearPass with enterprise wireless infrastructure.
Experience integrating wireless authentication with Microsoft Entra ID, Active Directory, and PKI.
Experience implementing WPA3, WIDS/WIPS, PPSK/IPSK, and wireless security standards.
Experience integrating Aruba Central with ScienceLogic SL1 or comparable monitoring platforms.
Experience designing secure guest wireless networks with isolated Internet connectivity.
Experience with wireless RF optimization, 5 GHz deployments, and high-density environments.
Experience with Python, REST APIs, Ansible, or similar network automation technologies.
Experience supporting security authorization activities, configuration hardening, and compliance assessments.
Experience supporting geographically distributed enterprise networks.
Relevant certifications may include Aruba Certified Mobility Professional (ACMP) or equivalent, Aruba Certified Design Professional (ACDP) or equivalent, Aruba Certified Mobility Expert (ACMX) or equivalent, Cisco CCNP Enterprise, or CISSP.

Responsibilities

Design, engineer, and implement migration of existing Aruba wireless controllers to centralized cloud-hosted infrastructure.
Deploy and configure Aruba Central for centralized wireless management, standardized configuration, monitoring, and operational visibility.
Develop controller migration strategies, implementation procedures, validation plans, and rollback processes.
Standardize NTP configurations and establish wireless deployment standards for bridge versus tunnel mode and campus versus remote architectures.
Develop standardized configurations and deployment playbooks for geographically distributed sites.
Coordinate cloud infrastructure integration, including connectivity, routing, security requirements, and availability.
Design and implement Layer 2 and Layer 3 redundancy to improve wireless availability and continuity.
Configure and validate controller failover, preemption, and recovery to preferred controllers; implement and troubleshoot VRRP, virtual IP addressing, and controller high availability.
Evaluate and optimize DHCP, GRE tunnels, routing, and wireless traffic forwarding across centralized and distributed environments.
Develop and execute failover and recovery tests; troubleshoot complex controller, routing, and wireless connectivity issues.
Design and implement wireless security standards, including WPA3, WIDS, and identity-based access controls.
Configure wireless security policies through Aruba Central and validate deployment to controllers and access points.
Evaluate hardware compatibility and develop WPA3 adoption strategies, including transition-mode considerations.
Standardize wireless configurations, including 5 GHz operation, authentication, and security settings.
Integrate wireless infrastructure with Cisco ISE, Aruba ClearPass, and enterprise identity services; configure and troubleshoot 802.1X, RADIUS, EAP-TLS, certificate-based authentication, and wireless access policies.
Coordinate identity-based policy integration with Microsoft Entra ID, VPN infrastructure, and firewall enforcement.
Integrate Aruba Central with ScienceLogic SL1 for monitoring, alerting, device discovery, and performance visibility; coordinate APIs, monitoring policies, and dashboards.
Validate controller status, access point availability, authentication health, and wireless performance monitoring.
Support integration with enterprise DNS, DHCP, NTP, routing, and security infrastructure, and identify automation opportunities.
Develop secure guest wireless architecture, including segmentation and Internet connectivity options; evaluate temporary credentials, PPSK, and IPSK authentication methods.
Support guest wireless security requirements, implementation planning, and authorization documentation; coordinate security assessments, configuration validation, and infrastructure approvals.
Serve as a senior technical subject matter expert and provide technical direction, mentoring, and engineering guidance to network engineering personnel.
Lead technical design reviews, implementation planning, integration testing, and troubleshooting; identify technical risks, dependencies, and operational impacts.
Establish repeatable engineering standards and procedures, and support production migration, validation, and transition to operations.
Develop and maintain architecture diagrams, configuration standards, migration procedures, redundancy and failover designs, security and NAC documentation, connectivity and data-flow diagrams, monitoring requirements, guest wireless documentation, test and rollback plans, playbooks, and as-built and operations transition documentation.