Principal Network Security Engineer

Global Enterprise Services•Fort Meade, MD

10d•Hybrid

About The Position

GES is seeking a Principal Network Security Engineer to design, engineer, and implement enterprise network security capabilities across a large, distributed network environment. The role advances network security architecture through strategic design and implementation efforts that improve the security posture, segmentation, access control, and resiliency of the enterprise network. It provides engineering support across planning, designing, and evaluating network security components; developing architecture specifications; assessing needs; recommending technologies; and directing installation, configuration, testing, and tuning of security infrastructure. The successful candidate serves as a senior technical authority and subject matter expert. They assess existing security architecture, define the required controls and segmentation model, create implementation plans that account for risk and rollback, and direct engineers delivering the work on aggressive timelines. The position communicates architecture recommendations, plans, risks, dependencies, and status to government, program, cybersecurity, and technical leadership, stakeholders, and approval boards. The role requires five days in the office until acclimated, after which one remote day may be possible. An active Secret clearance is required.

Requirements

Bachelor’s degree or equivalent experience and 12 or more years of prior relevant experience, or a master’s degree and 10 or more years of experience; specific experience, education, and training may be considered in lieu of a degree.
Significant experience designing and implementing network security architecture in complex, large-scale enterprise environments.
Experience as a senior technical lead directing network and security engineers, administrators, analysts, or implementation resources.
Experience leading security engineering projects from planning through implementation, including requirements analysis, dependency management, risk reduction, contingency planning, execution oversight, validation, and operational transition.
Hands-on engineering experience with next-generation firewalls, intrusion detection and prevention systems, proxies and TLS inspection, VPN and encryption services, and network access control platforms.
Experience with network segmentation or comparable secure connectivity efforts, including data-flow analysis, firewall and ACL policy review, routing changes, security-zone design, stakeholder coordination, and implementation planning.
Strong working knowledge of TCP/IP, routing protocols, switching, VLANs, DNS/DHCP/IPAM, NAT, QoS, and software-defined and cloud-connected network environments.
Hands-on experience with at least two of the following technologies: Palo Alto, Cisco, Aruba, Dell, Infoblox, and Brocade.
Working knowledge of Federal Government application, server, and network security requirements such as NIST, FedRAMP, FISMA, RMF, DISA STIGs, and DoD cybersecurity requirements.
Ability to organize work, track details, manage competing priorities, meet aggressive schedules, and drive complex technical efforts to completion with accountability.
Experience documenting security and network designs, implementation plans, risks, dependencies, and technical recommendations using Visio, PowerPoint, Cameo, or similar tools.
Excellent written and verbal communication skills, including experience briefing technical leadership, cybersecurity authorities, stakeholders, and approval boards.
Current IAT Level II or higher certification, such as Security+ or CISSP.
Active DoD Secret clearance.

Nice To Haves

CISSP, Palo Alto PCNSE, Cisco CCNP Security, or equivalent advanced security certification.
Experience implementing Comply-to-Connect, 802.1X, or comparable network access control and device-posture enforcement at enterprise scale.
Experience with zero-trust architecture, micro-segmentation, SASE, or secure cloud connectivity designs.
Experience integrating network security platforms with SIEM, SOAR, ITSM, and analytics tooling.
Experience with security automation and infrastructure-as-code using Python, Ansible, REST APIs, or similar, including automated firewall policy management.
Experience with certificate and PKI management, encrypted-traffic inspection, and key management in enterprise environments.
Experience supporting RMF, eMASS, continuous monitoring, and audit or inspection activities.
Experience with Jira, Confluence, or other project and knowledge-management tools used to coordinate technical work across distributed engineering teams.
Experience developing repeatable engineering execution frameworks, implementation playbooks, migration runbooks, technical standards, and risk-reduction processes.

Responsibilities

Design, engineer, and implement enterprise network security architecture spanning next-generation firewalls, intrusion detection and prevention, web and TLS proxies, VPN and encryption services, network access control, DNS security, and east-west security controls.
Evaluate existing network security architecture, identify gaps and opportunities, estimate level of effort, assess implementation risk, and develop engineering plans to strengthen enterprise security capabilities.
Lead network segmentation and secure connectivity efforts, including data-flow mapping, security-zone and enclave design, firewall rule-set and ACL review, routing and policy coordination, cutover sequencing, validation, and stakeholder approval.
Design and implement network access control and device-posture enforcement, including identity and device authentication, posture assessment, policy enforcement points, remediation workflows, and phased rollout.
Advance zero-trust-aligned networking, micro-segmentation, least-privilege access policies, and encrypted-transport strategies.
Specify network security architecture, evaluate and recommend technologies, and conduct needs assessments to inform design and investment decisions.
Engineer secure connectivity across on-premises, cloud, and remote environments, including IPsec and TLS VPN, secure cloud interconnects, and perimeter and boundary protection.
Tune and optimize security controls to reduce false positives, close coverage gaps, and improve detection and enforcement without degrading network performance or availability.
Drive security engineering projects from concept through implementation, including architecture evaluation, requirements analysis, dependency identification, design coordination, planning, execution, validation, and transition to operations.
Develop and manage implementation plans, schedules, cutover strategies, contingency plans, rollback procedures, validation steps, stakeholder communications, and change documentation for mission-critical security changes.
Coordinate change windows, maintenance activities, test validation, and rollback procedures for high-impact security policy and infrastructure changes.
Partner with network architecture, cybersecurity, operations, project management, and technical subject matter experts to resolve blockers, manage dependencies, and reduce delivery risk.
Support accreditation and compliance activities, including security control implementation, STIG application, vulnerability remediation, POA&M support, and authorization artifacts.
Serve as senior technical authority for network security design decisions, providing technical direction, mentoring, and day-to-day guidance to engineers, administrators, and analysts.
Organize technical priorities, track concurrent efforts, manage competing demands, and maintain accountability against aggressive schedules.
Provide technical information and recommendations to government stakeholders and approval authorities.
Improve engineering processes, documentation standards, implementation playbooks, migration runbooks, technical standards, and execution models.
Develop and maintain architecture and logical/physical design diagrams; data-flow diagrams, security-zone models, and segmentation designs; firewall standards, rule-set baselines, and ACL documentation; port, protocol, and services requirements; implementation, cutover, rollback, contingency, test, and validation plans; risk, dependency, and decision registers; security control and accreditation artifacts; technical standards, playbooks, runbooks, SOPs, and as-built and operations-transition documentation.