Principal Network Access Control (NAC) Engineer

P W Communications Inc•Fort Meade, MD

16h•$132,000 - $138,000•Hybrid

About The Position

PW Communications is hiring a Principal Network Access Control (NAC) Engineer to support the Defense Information Systems Agency (DISA) Defense Enclave Services (DES) contract. The DES team develops and deploys operational capabilities in an integrated, modernized enterprise environment supporting DISA and Fourth Estate Agencies. The position is based in Fort Meade, Maryland, and is hybrid with telework potential. U.S. citizenship and an active Secret security clearance are required. The engineer will provide senior technical leadership in modernizing a large, geographically distributed enterprise wireless environment. The work focuses on migrating Aruba wireless controllers to centralized cloud-hosted infrastructure, deploying Aruba Central, improving wireless resiliency, and standardizing wireless security and access-control capabilities. The engineer will work with cloud, network, cybersecurity, identity management, and monitoring teams. The role spans architecture, implementation, integration, testing, migration, documentation, and transition to operations. It includes technical direction and mentoring for other engineering personnel, development of repeatable deployment standards, and support for production migrations and operational handoff.

Requirements

Bachelor's degree with at least 12 years of relevant experience, or master's degree with at least 10 years of relevant experience; additional relevant experience, education, or training may be considered in lieu of a degree.
IAT Level II certification.
Significant hands-on experience engineering, implementing, and supporting enterprise Aruba wireless infrastructure, including controllers, access points, and centralized management platforms.
Experience with Aruba Central, including configuration management, controller integration, and enterprise wireless deployments.
Strong knowledge of enterprise wireless networking, including 802.11 standards, RF fundamentals, WLAN architecture, VLANs, routing, and switching.
Experience implementing and troubleshooting wireless controller redundancy, high availability, failover, and network resiliency.
Experience with wireless security and authentication, including WPA2/WPA3, 802.1X, RADIUS, and enterprise NAC platforms.
Experience integrating wireless infrastructure with enterprise DNS, DHCP, NTP, routing, and monitoring services.
Experience developing and executing engineering designs, implementation plans, migration procedures, test plans, and production deployments.
Strong troubleshooting and analytical skills to resolve complex wireless connectivity, authentication, and network performance issues.
Strong written and verbal communication skills, including technical guidance and engineering documentation.
U.S. citizenship and an active Secret security clearance.
Must meet applicable cybersecurity workforce qualification requirements for the assigned position.

Nice To Haves

Experience migrating Aruba wireless controllers to cloud-hosted or centrally managed environments.
Experience with Aruba Central on-premises or cloud-managed Aruba deployments.
Experience implementing VRRP, controller preemption, and Layer 2/Layer 3 failover architectures.
Experience with bridge-mode, tunnel-mode, campus, and remote wireless architectures.
Experience integrating Cisco ISE and Aruba ClearPass with enterprise wireless infrastructure.
Experience integrating wireless authentication with Microsoft Entra ID, Active Directory, and PKI.
Experience implementing WPA3, WIDS/WIPS, PPSK/IPSK, and wireless security standards.
Experience integrating Aruba Central with ScienceLogic SL1 or comparable monitoring platforms.
Experience designing secure guest wireless networks with isolated internet connectivity.
Experience with wireless RF optimization, 5 GHz deployments, and high-density environments.
Experience with Python, REST APIs, Ansible, or similar network automation technologies.
Experience supporting security authorization activities, configuration hardening, and compliance assessments.
Experience supporting geographically distributed enterprise networks.
Relevant certifications such as Aruba Certified Mobility Professional (ACMP), Aruba Certified Design Professional (ACDP), Aruba Certified Mobility Expert (ACMX), Cisco CCNP Enterprise, or CISSP.
Certification in one or more listed IAT Level II credentials: CASP+ CE, CCNA-Security, CCNP Security, CCSP, CISA, CISSP or CISSP Associate, CND, CySA+, GCED, GCIH, GICSP, GSEC, Security+ CE, or SSCP.

Responsibilities

Design, engineer, and implement migration of existing Aruba wireless controllers to centralized cloud-hosted infrastructure.
Deploy and configure Aruba Central for centralized wireless management, standardized configuration, monitoring, and operational visibility.
Develop controller migration strategies, implementation procedures, validation plans, and rollback processes.
Standardize NTP configurations across wireless controllers, access points, and supporting network infrastructure.
Establish wireless deployment standards, including bridge versus tunnel mode and campus versus remote architectures, and develop site deployment playbooks.
Coordinate cloud integration requirements, including connectivity, routing, security, and availability.
Design and implement Layer 2 and Layer 3 redundancy to improve wireless availability and continuity.
Configure and validate controller failover, preemption, recovery, VRRP, virtual IP addressing, and high-availability configurations.
Evaluate and optimize DHCP, GRE tunnels, routing, and wireless traffic forwarding across centralized and distributed environments.
Plan and execute failover and recovery testing, and troubleshoot complex controller, routing, and wireless connectivity issues.
Design and implement wireless security standards, including WPA3, WIDS, and identity-based access controls.
Configure wireless security policies through Aruba Central and validate their deployment to controllers and access points.
Assess hardware compatibility and develop WPA3 adoption strategies, including transition-mode considerations.
Standardize wireless settings such as 5 GHz operation, authentication, and security configurations.
Integrate wireless infrastructure with Cisco ISE, Aruba ClearPass, and enterprise identity services; configure and troubleshoot 802.1X, RADIUS, EAP-TLS, certificate-based authentication, and wireless access policies.
Coordinate identity-based policy integration with Microsoft Entra ID, VPN infrastructure, and firewall enforcement.
Integrate Aruba Central with ScienceLogic SL1 for wireless monitoring, alerting, device discovery, and performance visibility; coordinate APIs, monitoring policies, and dashboards.
Validate controller status, access point availability, authentication health, and wireless performance monitoring.
Support integration with enterprise DNS, DHCP, NTP, routing, and security infrastructure, and identify opportunities to automate wireless configuration, monitoring, and troubleshooting.
Develop secure guest wireless architecture, including segmentation and internet connectivity options; evaluate temporary credentials, PPSK, and IPSK authentication.
Support guest wireless security requirements, implementation planning, authorization documentation, technical assessments, configuration validation, and infrastructure approvals.
Serve as a senior subject matter expert for Aruba wireless infrastructure and centralized management, providing technical direction, mentoring, and engineering guidance.
Lead technical design reviews, implementation planning, integration testing, and troubleshooting; identify technical risks, dependencies, and operational impacts.
Establish repeatable engineering standards and implementation procedures, and support production migration, validation, and transition to operations.
Develop and maintain architecture and cloud-integration diagrams; Aruba Central and controller configuration standards; migration procedures; redundancy and failover designs; wireless security and WPA3 standards; NAC and authentication documentation; connectivity, routing, and data-flow diagrams; monitoring integration requirements; guest wireless documentation; test and rollback plans; operating procedures; migration playbooks; and as-built and operations-transition documentation.