Principal Network Security Engineer

P W Communications Inc•Fort Meade, MD

6d•$132,000 - $138,000•Hybrid

About The Position

PW Communications is seeking an experienced Principal Network Security Engineer to support the Defense Information Systems Agency (DISA) Defense Enclave Services (DES) contract. The DES team develops and deploys operational capabilities in an integrated, modernized enterprise environment, supporting modernization for DISA and Fourth Estate Agencies. The role designs, engineers, and implements enterprise network security capabilities across a large, distributed network, advancing security architecture, segmentation, access control, and resilience. The engineer provides network security engineering support across planning, design, evaluation, and implementation. This includes specifying network security architecture, assessing needs, recommending technologies, and directing installation, configuration, testing, and tuning of security infrastructure. As a technical leader and subject matter expert, the engineer assesses existing architecture, defines appropriate controls and segmentation, develops practical implementation plans with risk and rollback provisions, and directs engineering staff delivering work under aggressive timelines. The position influences strategic technical solutions and standards, resolves highly complex engineering problems, and communicates recommendations, plans, risks, dependencies, and status to government, program, cybersecurity, technical leadership, stakeholders, and approval boards. It also supports compliance and accreditation activities and maintains the technical documentation needed for engineering, operations, and authorization.

Requirements

Bachelor's degree or equivalent experience and 12 or more years of relevant experience, or a master's degree with 10 or more years of experience; specific experience, education, and training may be considered in lieu of a degree.
Significant experience designing and implementing network security architecture in complex, large-scale enterprise environments.
Experience as a senior technical lead directing network and security engineers, administrators, analysts, or implementation resources.
Experience leading security engineering projects from planning through implementation, including requirements analysis, dependency management, risk reduction, contingency planning, execution oversight, validation, and operational transition.
Hands-on engineering experience with next-generation firewalls, intrusion detection and prevention systems, proxies and TLS inspection, VPN and encryption services, and network access control platforms.
Experience with network segmentation or similar secure connectivity efforts, including data-flow analysis, firewall and ACL policy review, routing changes, security-zone design, stakeholder coordination, and implementation planning.
Working knowledge of TCP/IP, routing protocols, switching, VLANs, DNS/DHCP/IPAM, NAT, QoS, and software-defined and cloud-connected network environments.
Hands-on experience with at least two of the following technologies: Palo Alto, Cisco, Aruba, Dell, Infoblox, and Brocade.
Working knowledge of federal government application, server, and network security requirements such as NIST, FedRAMP, FISMA, RMF, DISA STIGs, and DoD cybersecurity requirements.
Ability to organize work, track details, manage competing priorities, meet aggressive schedules, and drive complex technical efforts to completion with accountability.
Experience documenting security and network designs, implementation plans, risks, dependencies, and technical recommendations using tools such as Visio, PowerPoint, Cameo, or similar.
Excellent written and verbal communication skills, including experience briefing technical leadership, cybersecurity authorities, stakeholders, and approval boards.
Current IAT Level II or higher certification, such as Security+ or CISSP.
Active DoD Secret clearance.
U.S. citizenship.

Nice To Haves

CISSP, Palo Alto PCNSE, Cisco CCNP Security, or equivalent advanced security certification.
Experience implementing Comply-to-Connect, 802.1X, or comparable enterprise-scale network access control and device-posture enforcement.
Experience with zero-trust architecture, micro-segmentation, SASE, or secure cloud connectivity designs.
Experience integrating network security platforms with SIEM, SOAR, ITSM, and analytics tools.
Experience with security automation and infrastructure-as-code using Python, Ansible, REST APIs, or similar, including automated firewall policy management.
Experience with certificate and PKI management, encrypted-traffic inspection, and key management in enterprise environments.
Experience supporting RMF, eMASS, continuous monitoring, and audit or inspection activities.
Experience with Jira, Confluence, or other project and knowledge-management tools used to coordinate technical work across distributed engineering teams.
Experience developing repeatable engineering execution frameworks, implementation playbooks, migration runbooks, technical standards, and risk-reduction processes.
Certification in one or more listed IAT Level II credentials: CASP+ CE, CCNA-Security, CCNP Security, CCSP, CISA, CISSP or Associate, CND, CySA+, GCED, GCIH, GICSP, GSEC, Security+ CE, or SSCP.

Responsibilities

Design, engineer, and implement enterprise network security architecture spanning next-generation firewalls, intrusion detection and prevention, web and TLS proxies, VPN and encryption services, network access control, DNS security, and east-west controls.
Assess the current network security architecture, identify gaps and opportunities, estimate effort, evaluate implementation risk, and develop engineering plans.
Lead network segmentation and secure connectivity efforts, including data-flow mapping, security-zone and enclave design, firewall and ACL review, routing and policy coordination, cutover sequencing, validation, and stakeholder approval.
Design and implement network access control and device-posture enforcement, including identity and device authentication, posture assessment, policy enforcement, remediation workflows, and phased rollout.
Advance zero-trust-aligned networking, micro-segmentation, least-privilege access policies, and encrypted-transport strategies.
Specify network security architecture, assess needs, and evaluate and recommend technologies to inform design and investment decisions.
Engineer secure connectivity among on-premises, cloud, and remote environments, including IPsec and TLS VPN, secure cloud interconnects, and boundary protection.
Tune security controls to reduce false positives, close coverage gaps, and improve detection and enforcement without degrading performance or availability.
Drive security engineering projects from concept through implementation, including requirements analysis, dependency identification, design coordination, planning, execution, validation, and transition to operations.
Develop and manage implementation schedules, cutover strategies, contingency and rollback procedures, validation steps, stakeholder communications, and change documentation.
Coordinate change windows, maintenance activities, testing, and rollback for high-impact security policy and infrastructure changes.
Partner with network architecture, cybersecurity, operations, project management, and technical subject matter experts to resolve blockers, manage dependencies, and reduce delivery risk.
Support accreditation and compliance, including security control implementation, STIG application, vulnerability remediation, POA&M support, and authorization artifacts.
Serve as the senior technical authority for network security design, providing direction, mentoring, and day-to-day guidance to engineers, administrators, and analysts.
Organize technical priorities, manage concurrent efforts and competing demands, and maintain accountability against aggressive schedules.
Communicate technical recommendations to government stakeholders and approval authorities.
Improve engineering processes, documentation standards, playbooks, runbooks, technical standards, and execution models to accelerate delivery and improve operational handoff.
Develop and maintain architecture and design diagrams, data-flow diagrams, security-zone and segmentation designs, firewall standards and baselines, ACL documentation, port/protocol/service requirements, implementation and cutover plans, validation plans, risk and dependency registers, accreditation artifacts, standards, playbooks, runbooks, operating procedures, and as-built and transition documentation.