Principal Network Security Engineer

Global Enterprise Services, LLC•Fort Meade, MD

10h•$160,000 - $175,000•Hybrid

About The Position

GES is seeking an experienced Principal Network Security Engineer to design, engineer, and implement enterprise network security capabilities across a large, distributed network environment. The role advances network security architecture through strategic design and implementation efforts that improve security posture, segmentation, access control, and resiliency. It provides engineering support across planning, designing, and evaluating network security components, specifying architecture, assessing needs, recommending technologies, and directing installation, configuration, testing, and tuning of security infrastructure. The position serves as a technical leader and subject matter expert. The engineer assesses current security architecture, defines enterprise controls and segmentation, develops practical implementation plans with risk and rollback provisions, and directs engineers delivering the work under aggressive timelines. The role communicates with government, program, cybersecurity, and technical leadership; presents recommendations, plans, risks, dependencies, and status; and supports consensus and approval processes. The work encompasses network security architecture and engineering, project execution, technical leadership, accreditation and compliance support, and development of engineering and operational documentation. The position is expected to work in the office five days per week until acclimated, after which one remote day may be possible. An active DoD Secret clearance is required.

Requirements

Bachelor's degree or equivalent experience and 12+ years of prior relevant experience, or a master's degree with 10+ years of experience; specific experience, education, and training may be considered in lieu of a degree.
Significant experience designing and implementing network security architecture in complex, large-scale enterprise environments.
Experience as a senior technical lead directing network and security engineers, administrators, analysts, or implementation resources.
Experience leading security engineering projects from planning through implementation, including requirements analysis, dependency management, risk reduction, contingency planning, execution oversight, validation, and operational transition.
Hands-on engineering experience with next-generation firewalls, intrusion detection and prevention systems, proxies and TLS inspection, VPN and encryption services, and network access control platforms.
Experience with network segmentation or similar secure connectivity efforts, including data-flow analysis, firewall and ACL policy review, routing changes, security-zone design, stakeholder coordination, and implementation planning.
Strong working knowledge of TCP/IP, routing protocols, switching, VLANs, DNS/DHCP/IPAM, NAT, QoS, and software-defined and cloud-connected network environments.
Hands-on experience with two or more of the following technologies: Palo Alto, Cisco, Aruba, Dell, Infoblox, and Brocade.
Working knowledge of Federal Government application, server, and network security requirements such as NIST, FedRAMP, FISMA, RMF, DISA STIGs, and DoD cybersecurity requirements.
Ability to organize work, track details, manage competing priorities, meet aggressive schedules, and drive complex technical efforts to completion with accountability.
Experience documenting security and network designs, implementation plans, risks, dependencies, and technical recommendations using Visio, PowerPoint, Cameo, or similar tools.
Excellent written and verbal communication skills, including experience briefing technical leadership, cybersecurity authorities, stakeholders, and approval boards.
Current IAT Level II or higher certification, such as Security+ or CISSP.
Active DoD Secret clearance.

Nice To Haves

CISSP, Palo Alto PCNSE, Cisco CCNP Security, or equivalent advanced security certification.
Experience implementing Comply-to-Connect, 802.1X, or comparable enterprise-scale network access control and device-posture enforcement.
Experience with zero-trust architecture, micro-segmentation, SASE, or secure cloud connectivity designs.
Experience integrating network security platforms with SIEM, SOAR, ITSM, and analytics tooling.
Experience with security automation and infrastructure-as-code using Python, Ansible, REST APIs, or similar, including automated firewall policy management.
Experience with certificate and PKI management, encrypted-traffic inspection, and key management in enterprise environments.
Experience supporting RMF, eMASS, continuous monitoring, and audit or inspection activities.
Experience with Jira, Confluence, or other project and knowledge-management tools used to coordinate technical work across distributed engineering teams.
Experience developing repeatable engineering execution frameworks, implementation playbooks, migration runbooks, technical standards, and risk-reduction processes.

Responsibilities

Design, engineer, and implement enterprise network security architecture spanning next-generation firewalls, intrusion detection and prevention, web and TLS proxies, VPN and encryption services, network access control, DNS security, and east-west security controls.
Evaluate current network security architecture, identify gaps and improvements, estimate effort, assess implementation risk, and develop engineering plans to strengthen security capabilities.
Lead network segmentation and secure connectivity efforts, including data-flow mapping, security-zone and enclave design, firewall rule-set and ACL review, routing and policy coordination, cutover sequencing, validation, and stakeholder approval.
Design and implement network access control and device-posture enforcement, including identity and device authentication, posture assessment, enforcement points, remediation workflows, and phased rollout.
Advance zero-trust-aligned networking, micro-segmentation, least-privilege access policy, and encrypted-transport strategies.
Specify network security architecture, evaluate and recommend emerging technologies, and perform needs assessments to inform design and investment decisions.
Engineer secure connectivity across on-premises, cloud, and remote environments, including IPsec and TLS VPN, secure cloud interconnects, and perimeter and boundary protection.
Tune and optimize security controls to reduce false positives, close coverage gaps, and improve detection and enforcement without degrading performance or availability.
Drive security engineering projects from concept through implementation, including architecture evaluation, requirements analysis, dependency identification, design coordination, planning, execution, validation, and transition to operations.
Develop and manage implementation plans, schedules, cutover strategies, contingency plans, rollback procedures, validation steps, stakeholder communications, and change documentation.
Coordinate change windows, maintenance activities, test validation, and rollback procedures for high-impact security changes.
Partner with network architecture, cybersecurity, operations, project management, and technical SME teams to resolve blockers, manage dependencies, and reduce delivery risk.
Support accreditation and compliance activities, including security control implementation, STIG application, vulnerability remediation, POA&M support, and authorization artifacts.
Serve as the senior technical authority for network security design decisions, providing technical direction, mentoring, and day-to-day guidance to engineers, administrators, and analysts.
Organize technical priorities, track concurrent efforts, manage competing demands, and maintain accountability against aggressive schedules.
Provide technical information and recommendations to government stakeholders and approval authorities.
Improve engineering processes, documentation standards, implementation playbooks, migration runbooks, technical standards, and execution models.
Develop and maintain network security architecture and design diagrams, data-flow diagrams, security-zone and segmentation designs, firewall standards and ACL documentation, PPS requirements, implementation and cutover plans, test and validation plans, risk and decision registers, accreditation artifacts, technical standards, playbooks, runbooks, SOPs, and operations transition documentation.