Senior WAN Encryption Engineer & Architect

Virginia Tech Applied Research Corporation•Arlington, VA

1d•Onsite

About The Position

VT-ARC is seeking a senior secure transport and WAN encryption subject matter expert to lead secure transport architecture, WAN encryption integration, CSfC-aware solution planning, commercial encryption evaluation, Type 1 inline encryption integration, and crypto modernization for mission-critical programs in secure zero-trust environments. The role determines where encryption should be deployed, which approach is appropriate for each transport or enclave, and how secure paths should be engineered, validated, documented, transitioned, and sustained. The position supports enterprise and mission networks across WAN, LAN, private and commercial transport, cloud interconnect, satellite communications, classified and multi-enclave environments, and air-gapped networks. It integrates Type 1/HAIPE solutions, CSfC-aligned commercial architectures, COTS IPsec/MACsec/TLS approaches, PKI-enabled transport, cloud and carrier connectivity, and mission communications. The role coordinates closely with program leadership, operations, and mission stakeholders and serves as the primary technical point of accountability for network encryption decisions across relevant engineering, security, COMSEC, and operations teams. This is a network architecture and integration role, not a cryptographic algorithm-design or key-manager role. The position is expected to be fully onsite in Arlington, Virginia, with travel of up to 10% potentially required. An active Top Secret/SCI clearance and U.S. citizenship are required. Salary range is $225,000–$275,000 annually.

Requirements

Active Top Secret/SCI clearance and U.S. citizenship.
Senior-level experience as a WAN engineer, network engineer, secure transport engineer, network architect, mission communications engineer, or equivalent supporting classified, DoD, IC, federal, or high-assurance enterprise networks.
Strong understanding of WAN architecture, routing, switching, segmentation, transport diversity, carrier services, high availability, failover, monitoring, path validation, and network troubleshooting.
Demonstrated experience integrating encryption or secure transport capabilities—including Type 1, HAIPE, inline encryption, COMSEC-dependent transport, CSfC-aligned architectures, or commercial network encryption—in classified or high-assurance environments.
Deep awareness of commercial crypto and secure transport solutions, including COTS IPsec VPN, MACsec, TLS, PKI/certificate authorities, authentication, software and hardware encryption, MDM/EUD dependencies, secure voice/VoIP, firewall/VPN platforms, SD-WAN security, SASE/SSE, cloud interconnect security, and managed carrier transport.
Working knowledge of CSfC concepts, including Capability Packages, component categories, layered commercial solutions, NIAP/Common Criteria, FIPS-validated cryptography, CNSA/CNSA 2.0 awareness, and registration/accreditation dependencies.
Ability to assess Type 1, CSfC, COTS commercial encryption, IPsec/MACsec/TLS overlays, cloud-native controls, and hybrid approaches based on classification, mission requirements, threat and risk, performance, supportability, accreditation, lifecycle, and cost/schedule tradeoffs.
Working knowledge of A-side/B-side design, red/black separation, crypto boundary placement, management paths, keying dependencies, enclave separation, and encrypted transport integration.
Experience supporting global or multi-site enterprise networks across WAN, LAN, MPLS, SD-WAN, private transport, commercial internet, classified enclaves, cloud connectivity, mission networks, or air-gapped environments.
Ability to coordinate complex technical dependencies among COMSEC, KMI, PKI, network engineering, cybersecurity, systems engineering, infrastructure, operations, vendors, integrators, and mission stakeholders.
Experience supporting RMF, ATO, STIG, security control implementation, continuous monitoring, or equivalent cybersecurity compliance activities for network infrastructure.
Ability to produce architecture and connection diagrams, implementation guides, migration plans, test procedures, validation artifacts, technical decision records, and operational handoff materials.

Nice To Haves

Hands-on experience with CSfC solution planning, integration, evidence development, compliance checklist support, or work with a CSfC Trusted Integrator, government customer, or commercial component ecosystem.
Experience with NSA Type 1 inline encryptors, HAIPE environments, TACLANE or equivalent controlled cryptographic equipment, or modernization from Type 1-only designs toward commercial or hybrid secure transport solutions where appropriate.
Familiarity with CSfC Capability Packages and annexes such as Multi-Site Connectivity, Mobile Access, Campus WLAN, Data at Rest, Enterprise Gray, Key Management, Symmetric Key Management, Continuous Monitoring, Tactical, and WIDS/WIPS.
Experience evaluating commercial network and security products for secure transport use cases, including enterprise VPN, firewall, SD-WAN, MACsec, TLS gateway/proxy, PKI/CA, authentication, MDM, EUD, VoIP, cloud networking, SASE/SSE, and monitoring/management platforms.
Experience with NIAP, Common Criteria, FIPS 140 validation, CNSA/CNSA 2.0, approved protection profiles, supply-chain considerations, and vendor sustainment requirements.
Experience integrating encryption with MPLS, carrier Ethernet, SD-WAN, commercial internet, satellite, tactical transport, cloud interconnect, unified communications, mission partner networks, or cross-domain-adjacent architectures.
Experience with packet capture, path validation, MTU analysis, crypto troubleshooting, network performance analysis, failover testing, telemetry, logging, monitoring, and operational acceptance testing.
Familiarity with Zero Trust principles, defense-in-depth network design, secure enclave integration, network segmentation, identity-aware access, and continuous monitoring.
Professional certifications such as CCNP, CCIE, JNCIP, JNCIE, Security+, CISSP, GSEC, GCIA, GDSA, SANS/GIAC credentials, cloud networking/security certifications, INCOSE CSEP/ESEP, or equivalent technical credentials.

Responsibilities

Serve as the senior SME for secure WAN encryption, secure transport architecture, network crypto placement, and encrypted mission communications integration.
Lead architecture input and engineering decisions on encryption across enterprise WANs, classified enclaves, cloud interconnects, commercial and private transport, SATCOM, and air-gapped environments.
Evaluate and recommend Type 1/HAIPE, CSfC-aligned layered commercial solutions, COTS IPsec VPN, MACsec, TLS-protected services, PKI-enabled transport, SD-WAN security, commercial firewall/VPN platforms, and hybrid architectures.
Translate mission requirements, classification constraints, network topology, routing domains, enclave boundaries, keying dependencies, and operational needs into secure transport designs.
Engineer A-side/B-side designs, red/black separation, crypto boundary placement, management and monitoring paths, failover, high availability, MTU, path diversity, latency, and troubleshooting approaches.
Support CSfC-aware architecture planning, including Capability Package concepts, commercial component categories, layered-solution dependencies, registration and evidence considerations, and RMF/ATO alignment.
Assess commercial encryption and secure transport products for operational fit, scalability, management, interoperability, vendor supportability, certification posture, and accreditation dependencies.
Coordinate technical dependencies among COMSEC, KMI, PKI, identity, WAN, LAN, cloud, UC, cybersecurity, infrastructure, systems engineering, operations, and mission teams.
Develop secure WAN encryption architectures, implementation and migration plans, connection diagrams, cutover runbooks, test procedures, configuration records, verification artifacts, and operational handoff documentation.
Support lab validation, proof-of-concept work, integration events, site deployments, cutovers, path validation, packet capture analysis, failover testing, troubleshooting, operational acceptance testing, and transition to operations.
Plan crypto modernization by assessing existing encrypted transport designs, identifying gaps, evaluating commercial and government-approved options, and developing migration strategies.
Ensure secure transport designs support applicable DoD, NSA, CNSS, RMF, ATO, STIG, COMSEC, and program security requirements.
Mentor network and mission communications teams on encryption integration dependencies, commercial solution tradeoffs, secure transport design, CSfC considerations, and operational impacts.