Job Description Position Summary: Sapient Logic is seeking a DDIL Subject Matter Expert (Infrastructure Engineer/Architect) to support a Government mission customer in Charleston, SC or Reston, VA. This full-time, on-site role will guide architecture for secure mission services operating under denied, disrupted, intermittent, or limited connectivity. The engineer will design resilient identity, authorization, and data protection capabilities that support disconnected operation and safe reconnection to enterprise services. Responsibilities: Develop DDIL strategies, architectural approaches, and implementation roadmaps for mission applications and supporting security services. Work with mission owners to define operational scenarios, connectivity constraints, mission priorities, and acceptable levels of degraded service. Translate those scenarios into requirements for local autonomy, bandwidth use, latency, outage duration, synchronization, and recovery. Define which identity, authorization, directory, credential, and data protection capabilities must remain available without enterprise reachback. Architect local identity and attribute services, including virtual directories and approved caching of security information. Establish approaches for cached attribute freshness, credential expiration, revocation awareness, authorization policy updates, and operation when authoritative sources cannot be reached. Evaluate access control tradeoffs, including when services should deny access, permit bounded local operation, or require additional safeguards. Design synchronization and reconnection approaches that address conflicting updates, stale identity data, audit records, and restoration of enterprise consistency. Define dependencies among applications, identity providers, policy services, directories, encryption services, and key management infrastructure. Assess data placement, replication, and protection requirements across connected and disconnected environments, including approved cross-domain interfaces. Develop architecture diagrams, interface requirements, alternatives analyses, risk assessments, and phased implementation recommendations. Support agreements and approval documentation governing the caching and use of identity and security attributes. Guide prototypes and demonstrations that validate architectural assumptions under representative network impairments. Define measurable acceptance criteria and help teams evaluate mission continuity, security behavior, and recovery during connectivity loss and restoration. Coordinate with Government stakeholders, mission partners, security personnel, and engineering teams to resolve architectural gaps and guide implementation. Required Qualifications: Demonstrated subject matter expertise designing, evaluating, or fielding systems that operate with denied, disrupted, intermittent, or limited connectivity. Experience developing mission or enterprise architectures that support disconnected operation, local processing, and eventual synchronization with authoritative services. Ability to translate operational constraints into technical requirements, architectural decisions, and testable performance criteria. Understanding of distributed systems concepts, including consistency, replication, caching, conflict resolution, and failure recovery. Experience addressing identity, authentication, authorization, or credential dependencies when enterprise services are unavailable. Understanding of the security implications of stale attributes, delayed revocation information, expired credentials, and unavailable policy or key services. Experience assessing bandwidth, latency, packet loss, and network availability constraints and their effects on application and service behavior. Experience developing technical strategies, architecture documentation, alternatives analyses, and implementation roadmaps. Ability to explain architectural tradeoffs and residual risks to Government decision-makers and provide actionable guidance to engineering teams. Experience working across mission, cybersecurity, infrastructure, and application development stakeholders. Experience deploying localized Policy Enforcement Points (PEPs) and lightweight Policy Decision Points (PDPs) on edge compute appliances and dismounted kits. Experience conducting modeling, simulation, and hardware-in-the-loop (HWIL) testing to replicate tactical link degradation, electronic warfare (EW) effects, and packet-loss profiles. Active DoD Top Secret/Sensitive Compartmented Information (TS/SCI) Clearance with the ability to obtain a Counterintelligence (CI) Polygraph is required. U.S. Citizenship is required. Desired Qualifications: Prior experience supporting the Intelligence Community. Bachelor's or Master's degree. Operational DDIL experience: Experience supporting deployed, tactical, expeditionary, edge, or other mission environments with constrained reachback. Identity services: Experience with Identity, Credential, and Access Management (ICAM), virtual directories, identity federation, and local identity and attribute caching. Authorization design: Experience with attribute-based access control, local policy enforcement, bounded offline access, and synchronization of authorization policies. Data protection: Familiarity with Trusted Data Format (TDF), data tagging, encryption, and access enforcement when central services are unavailable. Key and certificate services: Experience addressing Public Key Infrastructure (PKI), certificate validation, credential renewal, and key availability in disconnected environments. Distributed applications: Experience with store-and-forward messaging, durable queues, retry behavior, duplicate handling, and reconciliation after reconnection. Cross-domain environments: Experience defining approved identity and data exchanges across security domains and mission partner boundaries. Cloud and edge platforms: Familiarity with Amazon Web Services (AWS), Kubernetes, Red Hat OpenShift, and deployment patterns spanning enterprise and local infrastructure. Validation and experimentation: Experience using network impairment testing, fault injection, or operational demonstrations to assess degraded-mode behavior. Zero Trust: Experience adapting identity, device, application, and data security controls to environments where continuous enterprise connectivity cannot be assumed. Segmentation: Experience implementing software-defined micro-segmentation, overlay networks, and dynamic perimeter controls across non-standard transport channels (e.g., HF/VHF/UHF, SATCOM, mesh radios, 5G tactical bubbles). Job Type:Full-time Benefits:401(k) 401(k) matching Dental insurance Employee assistance program Flexible spending account Health insurance Health savings account Life insurance Paid time off Parental leave Professional development assistance Retirement plan Vision insurance Schedule: 8-hour shift Monday to Friday Day shift Ability to work additional hours as needed to support mission requirements Work Location: On-site - Charleston, SC or Reston, VA (Washington, DC metro) Security Clearance: Active TS/SCI clearance required Salary: $145,000-$198,000
11/14/2026
Full time
Job Description Position Summary: Sapient Logic is seeking a DDIL Subject Matter Expert (Infrastructure Engineer/Architect) to support a Government mission customer in Charleston, SC or Reston, VA. This full-time, on-site role will guide architecture for secure mission services operating under denied, disrupted, intermittent, or limited connectivity. The engineer will design resilient identity, authorization, and data protection capabilities that support disconnected operation and safe reconnection to enterprise services. Responsibilities: Develop DDIL strategies, architectural approaches, and implementation roadmaps for mission applications and supporting security services. Work with mission owners to define operational scenarios, connectivity constraints, mission priorities, and acceptable levels of degraded service. Translate those scenarios into requirements for local autonomy, bandwidth use, latency, outage duration, synchronization, and recovery. Define which identity, authorization, directory, credential, and data protection capabilities must remain available without enterprise reachback. Architect local identity and attribute services, including virtual directories and approved caching of security information. Establish approaches for cached attribute freshness, credential expiration, revocation awareness, authorization policy updates, and operation when authoritative sources cannot be reached. Evaluate access control tradeoffs, including when services should deny access, permit bounded local operation, or require additional safeguards. Design synchronization and reconnection approaches that address conflicting updates, stale identity data, audit records, and restoration of enterprise consistency. Define dependencies among applications, identity providers, policy services, directories, encryption services, and key management infrastructure. Assess data placement, replication, and protection requirements across connected and disconnected environments, including approved cross-domain interfaces. Develop architecture diagrams, interface requirements, alternatives analyses, risk assessments, and phased implementation recommendations. Support agreements and approval documentation governing the caching and use of identity and security attributes. Guide prototypes and demonstrations that validate architectural assumptions under representative network impairments. Define measurable acceptance criteria and help teams evaluate mission continuity, security behavior, and recovery during connectivity loss and restoration. Coordinate with Government stakeholders, mission partners, security personnel, and engineering teams to resolve architectural gaps and guide implementation. Required Qualifications: Demonstrated subject matter expertise designing, evaluating, or fielding systems that operate with denied, disrupted, intermittent, or limited connectivity. Experience developing mission or enterprise architectures that support disconnected operation, local processing, and eventual synchronization with authoritative services. Ability to translate operational constraints into technical requirements, architectural decisions, and testable performance criteria. Understanding of distributed systems concepts, including consistency, replication, caching, conflict resolution, and failure recovery. Experience addressing identity, authentication, authorization, or credential dependencies when enterprise services are unavailable. Understanding of the security implications of stale attributes, delayed revocation information, expired credentials, and unavailable policy or key services. Experience assessing bandwidth, latency, packet loss, and network availability constraints and their effects on application and service behavior. Experience developing technical strategies, architecture documentation, alternatives analyses, and implementation roadmaps. Ability to explain architectural tradeoffs and residual risks to Government decision-makers and provide actionable guidance to engineering teams. Experience working across mission, cybersecurity, infrastructure, and application development stakeholders. Experience deploying localized Policy Enforcement Points (PEPs) and lightweight Policy Decision Points (PDPs) on edge compute appliances and dismounted kits. Experience conducting modeling, simulation, and hardware-in-the-loop (HWIL) testing to replicate tactical link degradation, electronic warfare (EW) effects, and packet-loss profiles. Active DoD Top Secret/Sensitive Compartmented Information (TS/SCI) Clearance with the ability to obtain a Counterintelligence (CI) Polygraph is required. U.S. Citizenship is required. Desired Qualifications: Prior experience supporting the Intelligence Community. Bachelor's or Master's degree. Operational DDIL experience: Experience supporting deployed, tactical, expeditionary, edge, or other mission environments with constrained reachback. Identity services: Experience with Identity, Credential, and Access Management (ICAM), virtual directories, identity federation, and local identity and attribute caching. Authorization design: Experience with attribute-based access control, local policy enforcement, bounded offline access, and synchronization of authorization policies. Data protection: Familiarity with Trusted Data Format (TDF), data tagging, encryption, and access enforcement when central services are unavailable. Key and certificate services: Experience addressing Public Key Infrastructure (PKI), certificate validation, credential renewal, and key availability in disconnected environments. Distributed applications: Experience with store-and-forward messaging, durable queues, retry behavior, duplicate handling, and reconciliation after reconnection. Cross-domain environments: Experience defining approved identity and data exchanges across security domains and mission partner boundaries. Cloud and edge platforms: Familiarity with Amazon Web Services (AWS), Kubernetes, Red Hat OpenShift, and deployment patterns spanning enterprise and local infrastructure. Validation and experimentation: Experience using network impairment testing, fault injection, or operational demonstrations to assess degraded-mode behavior. Zero Trust: Experience adapting identity, device, application, and data security controls to environments where continuous enterprise connectivity cannot be assumed. Segmentation: Experience implementing software-defined micro-segmentation, overlay networks, and dynamic perimeter controls across non-standard transport channels (e.g., HF/VHF/UHF, SATCOM, mesh radios, 5G tactical bubbles). Job Type:Full-time Benefits:401(k) 401(k) matching Dental insurance Employee assistance program Flexible spending account Health insurance Health savings account Life insurance Paid time off Parental leave Professional development assistance Retirement plan Vision insurance Schedule: 8-hour shift Monday to Friday Day shift Ability to work additional hours as needed to support mission requirements Work Location: On-site - Charleston, SC or Reston, VA (Washington, DC metro) Security Clearance: Active TS/SCI clearance required Salary: $145,000-$198,000
Company Overview: Integrated Data Services (IDS) is a leading provider of custom software products and Government financial management services. IDS was founded in 1997 in El Segundo, CA, and since that time has seen tremendous growth and success. Currently, IDS has offices supporting customers nationwide. By providing customers with fast, efficient and reliable information systems and support services, IDS has become a preferred provider of financial and programmatic systems, services and solutions across a wide variety of government agencies. Position Description: IDS is seeking a Senior Software Engineer to build and sustain enterprise applications that Department of Defense (DoD)/Department of War (DoW) personnel depend on daily for program and financial management activities. Our stack includes Java and Spring Boot on the back end, Angular on the front end, and Oracle underneath, with applications deployed to government-approved cloud environments (such as AWS GovCloud) through automated pipelines that meet DoD/DoW security requirements. We place greater emphasis on an engineer's problem-solving approach, technical judgment, and ability to understand systems end-to-end than on experience with any specific set of frameworks or tools. Successful engineers in this role can quickly assess unfamiliar code, develop a clear understanding of how components interact from the database through the user interface, and design solutions that are reliable, maintainable, and scalable over time. We expect engineers to use AI-enabled tools effectively while remaining accountable for the quality, security, and performance of their work. Technical depth is important, but so are adaptability, sound judgment, clear communication, and disciplined engineering practices. You will work as part of a product team supporting an established enterprise application that DoD/DoW organizations rely on to manage program and financial data at scale. The role includes sustaining and enhancing capabilities customers depend on today, modernizing the underlying technology, and developing new functionality. You will regularly work within an existing codebase and exercise sound technical judgment when determining whether existing solutions should be improved, refactored, replaced, or retained. The ability to thoughtfully evaluate and evolve established systems is as important as the ability to design and build new capabilities. Responsibilities include, but are not limited to, the following: Own application capabilities from concept through production, including requirements analysis, solution design, API development, implementation, testing, deployment, verification, and sustainment. Use AI development tools where they improve efficiency across coding, testing, schema changes, documentation, and deployment activities, while remaining fully accountable for the correctness, security, and maintainability of all delivered work. Model data as part of feature design by designing tables, keys, constraints, and indexes that efficiently and securely support applications and APIs, and evolve existing schemas as requirements change. Write SQL directly against Oracle and understand database execution and performance implications. Contribute to Angular front-end work as features require, whether or not it is your primary specialty. Own your changes through the pipeline, including build, security scanning, testing, deployment, and verification in the target environment. Write clean, well-tested code, clearly explain technical approaches for peer review, and provide substantive and constructive reviews of others' work. Investigate defects efficiently to identify root causes rather than stopping at the first plausible explanation. Participate in architecture and design decisions, and advocate for technically sound approaches supported by clear rationale. Knowledge and Skills: Demonstrated depth in relational databases, including designing schemas and writing, reading, and reasoning about non-trivial SQL, preferably in Oracle environments. Working familiarity with a modern front-end framework, such as Angular or React. Experience delivering software through CI/CD into a cloud environment using a mainstream toolchain, such as GitLab CI, GitHub Actions, Jenkins, Azure DevOps, Bitbucket Pipelines, or equivalent. Recent hands-on experience with a modern Java LTS release (21 or 25). What Distinguishes Strong Candidates You may not have experience in every area listed below. These qualifications are intended to provide insight into the technical and operational environment in which you will work and the capabilities that can contribute to success in this role. Data access breadth - Experience working with both JPA/Hibernate and JDBC-based approaches, with the ability to determine when each is appropriate; familiarity with schema migration tools such as Flyway or Liquibase. Cloud and operations - Experience with AWS services such as ECS/Fargate, RDS, S3, and IAM; container build and runtime environments; and infrastructure as code. Pipeline and supply chain - Experience with static analysis and dependency scanning tools such as SonarQube, Fortify, Trivy, or Snyk; artifact promotion and provenance; and pipeline development within a modern CI/CD platform. Security engineering - Experience with PKI and certificate management, TLS configuration, secrets management, FIPS-validated cryptography, and secure software development under DoD/DoW requirements. Regulated delivery - Experience delivering software in environments governed by STIGs, RMF, ATO processes, or similar security and compliance frameworks. Domain - Experience with federal financial management, Planning, Programming, Budgeting, and Execution (PPBE), or DoD/DoW systems acquisition. AI-assisted development - Demonstrated experience using AI-enabled development tools in production software environments, combined with the judgment to validate outputs, recognize limitations, and determine when independent technical analysis is required. Education and Work Experience: This position requires seven (7) or more years of professional software development experience, with substantial hands-on experience in Java and Spring Boot. This position requires a minimum of a Bachelor's degree from an accredited college or university in data science, computer science, software engineering, information systems, mathematics, or a closely related technical discipline. Experience in lieu of education may be considered if the individual has eleven (11) or more years of relevant technical training or professional work experience. Physical & Mental Qualifications: Must be able to sit, type, hear, see, and speak for extended periods of time. Must consistently work and type on a computer for prolonged periods of time. Must be able to able to communicate accurate information and ideas effectively so others can understand. Must be able to lift/carry at least 15 lbs. May be required to move about inside an office to access file cabinets, office supplies, equipment, and other work-related resources, etc. Security Clearance: Applicants selected for employment will be subject to a Federal background investigation and must meet additional eligibility requirements for access to classified information or materials. Active Secret clearance preferred; ability to obtain and maintain Secret clearance is required for this role. Travel: Some travel may be required. Hours: Normal work schedule hours may vary, Monday through Friday. May be required to work additional hours and/or weekends, as needed, to meet deadlines or to fulfill travel obligations. Salary Range: $140,000 - $160,000 per year The estimated salary range listed is a good faith determination of potential base compensation that may be offered to a successful applicant for this position at the time of this job posting and may be modified in the future. The disclosed salary range estimate has not been adjusted for the applicable geographic differential associated with the location at which the position may be filled. When determining an applicant's compensation, various factors are taken into consideration including, but not limited to: geographic location, relevant prior work experience, relevant training, special skills/competencies, education, clearance, licenses/certifications, labor categories/contract rates and other business needs. Please note: All candidates being considered for this position will be required to complete a technical assessment designed to evaluate their engineering and coding skills. The assessment may include general coding exercises, code testing and debugging, problem-solving, ability to follow technical requirements, and attention to detail. The assessment is expected to take approximately 60 minutes to complete. It is being administered for candidate evaluation purposes only, and any code or work product submitted as part of the assessment will not be used for business or production purposes. If you require a reasonable accommodation to complete the assessment, please notify our Human Resources team in advance so we can support your request. IDS offers a robust benefits package including employer paid health, dental, vision, disability, AD&D and life insurance plans for eligible employees. IDS also offers a variety of elective plans to eligible employees including flexible spending accounts, voluntary life insurance and supplemental insurance plans. Benefits become effective the first of the month following the start date of employment unless starting on the 1st of the month, in which case benefits are effective immediately upon the eligible employee's start date. IDS offers eligible employees eleven (11) paid holidays, generous PTO accruals starting at three (3) weeks per year, as well as a 401(k) safe harbor contribution upon eligibility. IDS also offers generous employee referral bonuses . click apply for full job details
11/14/2026
Full time
Company Overview: Integrated Data Services (IDS) is a leading provider of custom software products and Government financial management services. IDS was founded in 1997 in El Segundo, CA, and since that time has seen tremendous growth and success. Currently, IDS has offices supporting customers nationwide. By providing customers with fast, efficient and reliable information systems and support services, IDS has become a preferred provider of financial and programmatic systems, services and solutions across a wide variety of government agencies. Position Description: IDS is seeking a Senior Software Engineer to build and sustain enterprise applications that Department of Defense (DoD)/Department of War (DoW) personnel depend on daily for program and financial management activities. Our stack includes Java and Spring Boot on the back end, Angular on the front end, and Oracle underneath, with applications deployed to government-approved cloud environments (such as AWS GovCloud) through automated pipelines that meet DoD/DoW security requirements. We place greater emphasis on an engineer's problem-solving approach, technical judgment, and ability to understand systems end-to-end than on experience with any specific set of frameworks or tools. Successful engineers in this role can quickly assess unfamiliar code, develop a clear understanding of how components interact from the database through the user interface, and design solutions that are reliable, maintainable, and scalable over time. We expect engineers to use AI-enabled tools effectively while remaining accountable for the quality, security, and performance of their work. Technical depth is important, but so are adaptability, sound judgment, clear communication, and disciplined engineering practices. You will work as part of a product team supporting an established enterprise application that DoD/DoW organizations rely on to manage program and financial data at scale. The role includes sustaining and enhancing capabilities customers depend on today, modernizing the underlying technology, and developing new functionality. You will regularly work within an existing codebase and exercise sound technical judgment when determining whether existing solutions should be improved, refactored, replaced, or retained. The ability to thoughtfully evaluate and evolve established systems is as important as the ability to design and build new capabilities. Responsibilities include, but are not limited to, the following: Own application capabilities from concept through production, including requirements analysis, solution design, API development, implementation, testing, deployment, verification, and sustainment. Use AI development tools where they improve efficiency across coding, testing, schema changes, documentation, and deployment activities, while remaining fully accountable for the correctness, security, and maintainability of all delivered work. Model data as part of feature design by designing tables, keys, constraints, and indexes that efficiently and securely support applications and APIs, and evolve existing schemas as requirements change. Write SQL directly against Oracle and understand database execution and performance implications. Contribute to Angular front-end work as features require, whether or not it is your primary specialty. Own your changes through the pipeline, including build, security scanning, testing, deployment, and verification in the target environment. Write clean, well-tested code, clearly explain technical approaches for peer review, and provide substantive and constructive reviews of others' work. Investigate defects efficiently to identify root causes rather than stopping at the first plausible explanation. Participate in architecture and design decisions, and advocate for technically sound approaches supported by clear rationale. Knowledge and Skills: Demonstrated depth in relational databases, including designing schemas and writing, reading, and reasoning about non-trivial SQL, preferably in Oracle environments. Working familiarity with a modern front-end framework, such as Angular or React. Experience delivering software through CI/CD into a cloud environment using a mainstream toolchain, such as GitLab CI, GitHub Actions, Jenkins, Azure DevOps, Bitbucket Pipelines, or equivalent. Recent hands-on experience with a modern Java LTS release (21 or 25). What Distinguishes Strong Candidates You may not have experience in every area listed below. These qualifications are intended to provide insight into the technical and operational environment in which you will work and the capabilities that can contribute to success in this role. Data access breadth - Experience working with both JPA/Hibernate and JDBC-based approaches, with the ability to determine when each is appropriate; familiarity with schema migration tools such as Flyway or Liquibase. Cloud and operations - Experience with AWS services such as ECS/Fargate, RDS, S3, and IAM; container build and runtime environments; and infrastructure as code. Pipeline and supply chain - Experience with static analysis and dependency scanning tools such as SonarQube, Fortify, Trivy, or Snyk; artifact promotion and provenance; and pipeline development within a modern CI/CD platform. Security engineering - Experience with PKI and certificate management, TLS configuration, secrets management, FIPS-validated cryptography, and secure software development under DoD/DoW requirements. Regulated delivery - Experience delivering software in environments governed by STIGs, RMF, ATO processes, or similar security and compliance frameworks. Domain - Experience with federal financial management, Planning, Programming, Budgeting, and Execution (PPBE), or DoD/DoW systems acquisition. AI-assisted development - Demonstrated experience using AI-enabled development tools in production software environments, combined with the judgment to validate outputs, recognize limitations, and determine when independent technical analysis is required. Education and Work Experience: This position requires seven (7) or more years of professional software development experience, with substantial hands-on experience in Java and Spring Boot. This position requires a minimum of a Bachelor's degree from an accredited college or university in data science, computer science, software engineering, information systems, mathematics, or a closely related technical discipline. Experience in lieu of education may be considered if the individual has eleven (11) or more years of relevant technical training or professional work experience. Physical & Mental Qualifications: Must be able to sit, type, hear, see, and speak for extended periods of time. Must consistently work and type on a computer for prolonged periods of time. Must be able to able to communicate accurate information and ideas effectively so others can understand. Must be able to lift/carry at least 15 lbs. May be required to move about inside an office to access file cabinets, office supplies, equipment, and other work-related resources, etc. Security Clearance: Applicants selected for employment will be subject to a Federal background investigation and must meet additional eligibility requirements for access to classified information or materials. Active Secret clearance preferred; ability to obtain and maintain Secret clearance is required for this role. Travel: Some travel may be required. Hours: Normal work schedule hours may vary, Monday through Friday. May be required to work additional hours and/or weekends, as needed, to meet deadlines or to fulfill travel obligations. Salary Range: $140,000 - $160,000 per year The estimated salary range listed is a good faith determination of potential base compensation that may be offered to a successful applicant for this position at the time of this job posting and may be modified in the future. The disclosed salary range estimate has not been adjusted for the applicable geographic differential associated with the location at which the position may be filled. When determining an applicant's compensation, various factors are taken into consideration including, but not limited to: geographic location, relevant prior work experience, relevant training, special skills/competencies, education, clearance, licenses/certifications, labor categories/contract rates and other business needs. Please note: All candidates being considered for this position will be required to complete a technical assessment designed to evaluate their engineering and coding skills. The assessment may include general coding exercises, code testing and debugging, problem-solving, ability to follow technical requirements, and attention to detail. The assessment is expected to take approximately 60 minutes to complete. It is being administered for candidate evaluation purposes only, and any code or work product submitted as part of the assessment will not be used for business or production purposes. If you require a reasonable accommodation to complete the assessment, please notify our Human Resources team in advance so we can support your request. IDS offers a robust benefits package including employer paid health, dental, vision, disability, AD&D and life insurance plans for eligible employees. IDS also offers a variety of elective plans to eligible employees including flexible spending accounts, voluntary life insurance and supplemental insurance plans. Benefits become effective the first of the month following the start date of employment unless starting on the 1st of the month, in which case benefits are effective immediately upon the eligible employee's start date. IDS offers eligible employees eleven (11) paid holidays, generous PTO accruals starting at three (3) weeks per year, as well as a 401(k) safe harbor contribution upon eligibility. IDS also offers generous employee referral bonuses . click apply for full job details
Principal Java & GCP Solution Architect Principal Java and GCP Solution Architect who can bring both deep technical expertise and thought leadership to complex client engagements. This role requires a hands-on architect who can design modern Java microservices, shape cloud-native strategy on GCP, guide engineering teams, and serve as a trusted technical voice with senior client stakeholders. This is not a documentation-only architecture position-the successful candidate must remain close to implementation and be able to turn architectural direction into practical delivery outcomes. Join our growing Detroit-area team in a strategic Principal Java & GCP Solution Architect role. You'll work a hybrid / onsite /remote combin while remaining available for onsite collaboration as needed with clients, delivery teams, and technical leadership across the local Michigan area. What You Will Do Lead the architecture, design, and implementation of modern Java-based applications using cloud-native and microservices patterns. Translate business requirements into practical architectural blueprints aligned with enterprise standards and long-term strategy. Provide technical thought leadership across ongoing and future client engagements. Assess existing application landscapes and recommend modernization, migration, and optimization strategies. Design secure, scalable, resilient, observable, and high-performing distributed systems. Define application, integration, API, data, deployment, and operational architecture. Establish API-first strategies using REST, GraphQL, gRPC, and event-driven patterns. Design asynchronous and event-driven solutions using technologies such as Kafka or RabbitMQ. Guide engineering teams in the use of Java 11+, Spring Boot, microservices, containers, Kubernetes, and cloud-native design patterns. Lead architecture reviews, technical assessments, proofs of concept, and technology evaluations. Establish reusable architecture standards, reference patterns, engineering guidelines, and technical governance. Collaborate with developers, DevOps engineers, QA teams, security teams, product leaders, and business stakeholders. Provide technical guidance throughout design, development, testing, deployment, and production support. Guide containerization and orchestration strategies using Docker and Kubernetes, preferably Google Kubernetes Engine. Define CI/CD, GitOps, and infrastructure-as-code approaches using tools such as Jenkins, ArgoCD, Git, and Terraform. Design observability frameworks covering logs, metrics, traces, alerts, dashboards, and production diagnostics. Evaluate emerging technologies and determine where they can provide practical business and engineering value. Mentor senior developers, technical leads, and architects. Present architecture recommendations, trade-offs, risks, and decisions to senior technical and business stakeholders. Identify technical risks, dependencies, architectural gaps, and remediation strategies. Ensure architectural decisions support maintainability, security, performance, scalability, reliability, and cost efficiency. Required Qualifications Extensive experience designing and delivering enterprise Java applications. Deep expertise in Java 11 or later and Spring Boot. Proven experience architecting microservices and distributed systems. Strong production-level architecture experience with Google Cloud Platform. Experience designing and deploying applications using GCP cloud-native services. Strong hands-on knowledge of Docker and Kubernetes. Experience with Google Kubernetes Engine or comparable enterprise Kubernetes platforms. Strong understanding of RESTful APIs and API-first architecture. Experience with one or more additional integration patterns or technologies: GraphQL gRPC Event-driven architecture Asynchronous messaging Experience with Kafka, RabbitMQ, or comparable messaging technologies. Strong knowledge of scalability, resilience, fault tolerance, performance, security, and observability. Experience with SQL and NoSQL databases, including distributed-system data modeling. Experience with MongoDB, Cassandra, or comparable NoSQL platforms. Knowledge of API gateways and service-mesh technologies. Experience with Istio, Linkerd, or comparable service-mesh platforms. Experience with CI/CD and DevOps toolchains. Working knowledge of Jenkins, GitOps, ArgoCD, Terraform, or comparable tools. Strong experience designing logging, monitoring, metrics, and distributed-tracing solutions. Experience with one or more of the following: OpenTelemetry Prometheus Grafana ELK Stack Dynatrace Jaeger Zipkin Proven architecture-governance and technical-leadership experience. Strong client-facing communication and presentation skills. Ability to explain complex technical concepts, options, risks, and trade-offs to both technical and nontechnical audiences. Demonstrated ability to influence technical strategy and guide teams without relying solely on formal authority. Preferred Qualifications Experience leading complex cloud-modernization or monolith-to-microservices programs. Experience supporting multiple enterprise or client engagements. Consulting or systems-integration experience. GCP Professional Cloud Architect certification. Experience establishing enterprise architecture standards or cloud-native reference architectures. Experience designing highly available, high-volume, or mission-critical platforms. Experience conducting architecture assessments and technology-selection initiatives. Experience mentoring architects and senior engineers. Public speaking, technical writing, internal technology leadership, or architecture-community participation. Ideal Candidate The ideal candidate is more than a senior Java developer who has moved into architecture. You have personally owned architecture decisions for complex enterprise platforms and can explain how those decisions improved business, delivery, reliability, or operational outcomes. You remain technically close enough to implementation to guide developers, review designs, evaluate code-level implications, troubleshoot difficult issues, and challenge assumptions. At the same time, you are comfortable presenting to senior client stakeholders and influencing long-term technology strategy. You know how to introduce modern technologies thoughtfully. You evaluate business value, operational complexity, risk, scalability, and long-term maintainability rather than adopting tools simply because they are new. What Success Looks Like Success in this role includes: Building credibility as a trusted technical advisor Improving the quality and consistency of architectural decisions Establishing reusable Java and GCP architecture patterns Helping teams deliver scalable and reliable cloud-native solutions Identifying architecture risks before they become delivery or production issues Strengthening engineering practices across client engagements Contributing technical expertise that expands and deepens client relationships What Makes HTC A Great Place To Build Your Future HTC Global Services wants you to join our team. Come build new things with us and advance your career. At HTC Global, you'll collaborate with experts, work alongside clients, and be part of high-performing teams driving success together. You'll have long-term opportunities to grow your career and develop skills in the latest emerging technologies. At HTC Global Services, our employees have access to a comprehensive benefits package. Benefits can include Group Health (Medical, Dental, and Vision), Paid Time Off, Paid Holidays, 401(k) matching, Group Life and Disability insurance, Professional Development opportunities, Wellness programs, and a variety of other perks. Our success as a company is built on inclusion and diversity. HTC Global Services is committed to providing a workplace free from discrimination and harassment, where every employee is treated with dignity and respect. We celebrate differences and believe that diverse cultures, perspectives, and skills drive innovation and success. HTC is an Equal Opportunity Employer and a proud National Minority Supplier. We seek to empower each individual, fostering an environment where everyone feels valued, included, and respected.
11/14/2026
Full time
Principal Java & GCP Solution Architect Principal Java and GCP Solution Architect who can bring both deep technical expertise and thought leadership to complex client engagements. This role requires a hands-on architect who can design modern Java microservices, shape cloud-native strategy on GCP, guide engineering teams, and serve as a trusted technical voice with senior client stakeholders. This is not a documentation-only architecture position-the successful candidate must remain close to implementation and be able to turn architectural direction into practical delivery outcomes. Join our growing Detroit-area team in a strategic Principal Java & GCP Solution Architect role. You'll work a hybrid / onsite /remote combin while remaining available for onsite collaboration as needed with clients, delivery teams, and technical leadership across the local Michigan area. What You Will Do Lead the architecture, design, and implementation of modern Java-based applications using cloud-native and microservices patterns. Translate business requirements into practical architectural blueprints aligned with enterprise standards and long-term strategy. Provide technical thought leadership across ongoing and future client engagements. Assess existing application landscapes and recommend modernization, migration, and optimization strategies. Design secure, scalable, resilient, observable, and high-performing distributed systems. Define application, integration, API, data, deployment, and operational architecture. Establish API-first strategies using REST, GraphQL, gRPC, and event-driven patterns. Design asynchronous and event-driven solutions using technologies such as Kafka or RabbitMQ. Guide engineering teams in the use of Java 11+, Spring Boot, microservices, containers, Kubernetes, and cloud-native design patterns. Lead architecture reviews, technical assessments, proofs of concept, and technology evaluations. Establish reusable architecture standards, reference patterns, engineering guidelines, and technical governance. Collaborate with developers, DevOps engineers, QA teams, security teams, product leaders, and business stakeholders. Provide technical guidance throughout design, development, testing, deployment, and production support. Guide containerization and orchestration strategies using Docker and Kubernetes, preferably Google Kubernetes Engine. Define CI/CD, GitOps, and infrastructure-as-code approaches using tools such as Jenkins, ArgoCD, Git, and Terraform. Design observability frameworks covering logs, metrics, traces, alerts, dashboards, and production diagnostics. Evaluate emerging technologies and determine where they can provide practical business and engineering value. Mentor senior developers, technical leads, and architects. Present architecture recommendations, trade-offs, risks, and decisions to senior technical and business stakeholders. Identify technical risks, dependencies, architectural gaps, and remediation strategies. Ensure architectural decisions support maintainability, security, performance, scalability, reliability, and cost efficiency. Required Qualifications Extensive experience designing and delivering enterprise Java applications. Deep expertise in Java 11 or later and Spring Boot. Proven experience architecting microservices and distributed systems. Strong production-level architecture experience with Google Cloud Platform. Experience designing and deploying applications using GCP cloud-native services. Strong hands-on knowledge of Docker and Kubernetes. Experience with Google Kubernetes Engine or comparable enterprise Kubernetes platforms. Strong understanding of RESTful APIs and API-first architecture. Experience with one or more additional integration patterns or technologies: GraphQL gRPC Event-driven architecture Asynchronous messaging Experience with Kafka, RabbitMQ, or comparable messaging technologies. Strong knowledge of scalability, resilience, fault tolerance, performance, security, and observability. Experience with SQL and NoSQL databases, including distributed-system data modeling. Experience with MongoDB, Cassandra, or comparable NoSQL platforms. Knowledge of API gateways and service-mesh technologies. Experience with Istio, Linkerd, or comparable service-mesh platforms. Experience with CI/CD and DevOps toolchains. Working knowledge of Jenkins, GitOps, ArgoCD, Terraform, or comparable tools. Strong experience designing logging, monitoring, metrics, and distributed-tracing solutions. Experience with one or more of the following: OpenTelemetry Prometheus Grafana ELK Stack Dynatrace Jaeger Zipkin Proven architecture-governance and technical-leadership experience. Strong client-facing communication and presentation skills. Ability to explain complex technical concepts, options, risks, and trade-offs to both technical and nontechnical audiences. Demonstrated ability to influence technical strategy and guide teams without relying solely on formal authority. Preferred Qualifications Experience leading complex cloud-modernization or monolith-to-microservices programs. Experience supporting multiple enterprise or client engagements. Consulting or systems-integration experience. GCP Professional Cloud Architect certification. Experience establishing enterprise architecture standards or cloud-native reference architectures. Experience designing highly available, high-volume, or mission-critical platforms. Experience conducting architecture assessments and technology-selection initiatives. Experience mentoring architects and senior engineers. Public speaking, technical writing, internal technology leadership, or architecture-community participation. Ideal Candidate The ideal candidate is more than a senior Java developer who has moved into architecture. You have personally owned architecture decisions for complex enterprise platforms and can explain how those decisions improved business, delivery, reliability, or operational outcomes. You remain technically close enough to implementation to guide developers, review designs, evaluate code-level implications, troubleshoot difficult issues, and challenge assumptions. At the same time, you are comfortable presenting to senior client stakeholders and influencing long-term technology strategy. You know how to introduce modern technologies thoughtfully. You evaluate business value, operational complexity, risk, scalability, and long-term maintainability rather than adopting tools simply because they are new. What Success Looks Like Success in this role includes: Building credibility as a trusted technical advisor Improving the quality and consistency of architectural decisions Establishing reusable Java and GCP architecture patterns Helping teams deliver scalable and reliable cloud-native solutions Identifying architecture risks before they become delivery or production issues Strengthening engineering practices across client engagements Contributing technical expertise that expands and deepens client relationships What Makes HTC A Great Place To Build Your Future HTC Global Services wants you to join our team. Come build new things with us and advance your career. At HTC Global, you'll collaborate with experts, work alongside clients, and be part of high-performing teams driving success together. You'll have long-term opportunities to grow your career and develop skills in the latest emerging technologies. At HTC Global Services, our employees have access to a comprehensive benefits package. Benefits can include Group Health (Medical, Dental, and Vision), Paid Time Off, Paid Holidays, 401(k) matching, Group Life and Disability insurance, Professional Development opportunities, Wellness programs, and a variety of other perks. Our success as a company is built on inclusion and diversity. HTC Global Services is committed to providing a workplace free from discrimination and harassment, where every employee is treated with dignity and respect. We celebrate differences and believe that diverse cultures, perspectives, and skills drive innovation and success. HTC is an Equal Opportunity Employer and a proud National Minority Supplier. We seek to empower each individual, fostering an environment where everyone feels valued, included, and respected.
Job Description Position Summary: Sapient Logic is seeking a Systems Software Engineer to support a Government mission customer in Charleston, SC or Reston, VA. This full-time, on-site role requires strong systems programming and database engineering expertise. The engineer will analyze and modify database engine internals, network protocols, and core services to support secure mission applications and integrations. Responsibilities: Develop, maintain, test, and deploy secure, scalable applications and services using C, C++, Rust, Go, Java, Python, or Node.js. Apply systems programming principles, particularly in C, C++, and Rust, to develop performant and reliable software components. Develop software supporting process creation, monitoring, control, and inter-process communication. Build concurrent and multithreaded applications using appropriate synchronization, signal handling, memory management, and resource-control techniques. Design, implement, and troubleshoot networked applications using sockets, client-server architectures, and applicable network protocols. Analyze database engine source code, communication protocols, request and response formats, serialization, and packet layouts to support development and integration. Trace requests through database engine code to identify processing logic, integration points, and the effects of proposed modifications. Develop relational data-storage solutions using Structured Query Language (SQL), including data modeling, query development, performance tuning, and access control. Develop and integrate graph database solutions supporting relationship-based data modeling, analysis, and retrieval. Work across relational databases, graph databases, object storage, and search/indexing engines, including technologies such as PostgreSQL, Redis, RxDB, Neo4j, Amazon S3, and Elasticsearch. Refactor and modernize existing services, including transitioning functionality from Python to other implementation languages where appropriate. Develop and maintain Infrastructure as Code (IaC) to provision, configure, and manage infrastructure through repeatable, version-controlled workflows. Deploy, monitor, and troubleshoot cloud-hosted software, including dependencies on compute, storage, networking, identity, and security services. Integrate applications with identity providers to support authentication, authorization, federation, single sign-on, and identity-aware access control. Implement OpenID Connect (OIDC) integrations, including token validation, claims processing, client registration, redirect flows, session management, and secure API access. Incorporate Zero Trust Architecture principles into software designs, including interactions among policy decision, administration, information, and enforcement components. Collaborate with cybersecurity, infrastructure, data, and mission stakeholders to integrate security controls, cryptographic protections, logging, monitoring, and auditability throughout the software development lifecycle. Produce and maintain software designs, interface specifications, deployment procedures, configuration baselines, security implementation details, and operational support materials. Required Qualifications: Bachelor's degree in a quantitative field such as engineering or mathematics is required. Relevant fields include Electrical Engineering, Computer Engineering, Computer Science, Information Technology, and Information Systems. 10 years of professional software engineering experience (typical). Prior experience supporting the Intelligence Community. Experience applying programming concepts in a professional or academic setting. Experience applying modern software development methodologies, such as Agile, DevOps, or DevSecOps, in a professional or academic setting. Hands-on systems programming experience in one or more of C, C++, or Rust, with the ability to work across additional languages and runtimes as needed. Experience with operating-system interfaces, process management, inter-process communication, concurrency, and multithreaded application development. Understanding of synchronization primitives, signal handling, memory management, and resource management. Experience developing or troubleshooting socket-based applications and client-server communications. Experience with database engine internals, network protocol development, or comparable source-code and low-level systems analysis. Ability to navigate unfamiliar source code, trace execution and data flows, and assess how changes affect performance, interoperability, concurrency, and security. Experience with relational database design, SQL, query optimization, and database access controls. Understanding of graph database concepts and their application to relationship-based data. Experience developing infrastructure automation and deploying or supporting software in cloud environments. Experience integrating applications with identity services using OIDC and applying authentication and authorization controls. Understanding of Zero Trust Architecture concepts, including Policy Decision Points (PDPs), Policy Administration Points (PAPs), Policy Information Points (PIPs), and Policy Enforcement Points (PEPs). Strong troubleshooting, technical documentation, and collaboration skills. Agile Developer certification or Certified Scrum Developer certification. CompTIA Security+ or higher-level cybersecurity certification. Active DoD Top Secret/Sensitive Compartmented Information (TS/SCI) Clearance with the ability to obtain a Counterintelligence (CI) Polygraph is required. U.S. Citizenship is required. Candidates who meet the qualifications above do not need experience with every technology listed under desired qualifications. Depth in systems programming and database engineering, paired with the ability to learn adjacent technologies, is what matters most. Desired Qualifications: Advanced education: Master's degree in a quantitative field such as engineering or mathematics. Relevant fields include Electrical Engineering, Computer Engineering, Computer Science, Information Technology, and Information Systems. Database engineering: Experience with PostgreSQL and Neo4j, including database design, administration, performance optimization, and application integration. Protocol engineering: Experience interpreting packet captures, working with binary message formats, developing protocol parsers, or modifying database clients, drivers, extensions, or engine code. Infrastructure automation: Experience using Terraform and Ansible for cloud infrastructure provisioning, configuration management, and application deployment. Cloud and platform engineering: Experience deploying and maintaining applications and infrastructure in Amazon Web Services (AWS), including AWS GovCloud, Kubernetes, Red Hat OpenShift, and environments subject to Department of Defense Impact Level 5 requirements. Identity platforms: Experience with PingFederate, Keycloak, Radiant Logic, SailPoint, Secret Server, or Okta; experience migrating identity providers and adapting application code is especially useful. Public Key Infrastructure (PKI): Experience implementing certificate lifecycle management, key management, certificate validation, and cryptographic service integrations. Cryptographic interfaces: Experience using PKCS to integrate applications with cryptographic tokens, Hardware Security Modules (HSMs), or other secure key-storage mechanisms. Modern cryptography: Experience implementing, evaluating, or integrating cryptographic algorithms, including Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). Data protection and service integration: Experience with Trusted Data Format (TDF), Go-based security services, enterprise service integration, or serialization technologies such as Protocol Buffers. Job Type: Full-time Benefits:401(k) 401(k) matching Dental insurance Employee assistance program Flexible spending account Health insurance Health savings account Life insurance Paid time off Parental leave Professional development assistance Retirement plan Vision insurance Schedule: 8-hour shift Monday to Friday Day shift Ability to work additional hours as needed to support mission requirements Work Location: On-site - Charleston, SC or Reston, VA (Washington, DC metro) Security Clearance: Active TS/SCI clearance required Salary: $160,000-$215,000
11/14/2026
Full time
Job Description Position Summary: Sapient Logic is seeking a Systems Software Engineer to support a Government mission customer in Charleston, SC or Reston, VA. This full-time, on-site role requires strong systems programming and database engineering expertise. The engineer will analyze and modify database engine internals, network protocols, and core services to support secure mission applications and integrations. Responsibilities: Develop, maintain, test, and deploy secure, scalable applications and services using C, C++, Rust, Go, Java, Python, or Node.js. Apply systems programming principles, particularly in C, C++, and Rust, to develop performant and reliable software components. Develop software supporting process creation, monitoring, control, and inter-process communication. Build concurrent and multithreaded applications using appropriate synchronization, signal handling, memory management, and resource-control techniques. Design, implement, and troubleshoot networked applications using sockets, client-server architectures, and applicable network protocols. Analyze database engine source code, communication protocols, request and response formats, serialization, and packet layouts to support development and integration. Trace requests through database engine code to identify processing logic, integration points, and the effects of proposed modifications. Develop relational data-storage solutions using Structured Query Language (SQL), including data modeling, query development, performance tuning, and access control. Develop and integrate graph database solutions supporting relationship-based data modeling, analysis, and retrieval. Work across relational databases, graph databases, object storage, and search/indexing engines, including technologies such as PostgreSQL, Redis, RxDB, Neo4j, Amazon S3, and Elasticsearch. Refactor and modernize existing services, including transitioning functionality from Python to other implementation languages where appropriate. Develop and maintain Infrastructure as Code (IaC) to provision, configure, and manage infrastructure through repeatable, version-controlled workflows. Deploy, monitor, and troubleshoot cloud-hosted software, including dependencies on compute, storage, networking, identity, and security services. Integrate applications with identity providers to support authentication, authorization, federation, single sign-on, and identity-aware access control. Implement OpenID Connect (OIDC) integrations, including token validation, claims processing, client registration, redirect flows, session management, and secure API access. Incorporate Zero Trust Architecture principles into software designs, including interactions among policy decision, administration, information, and enforcement components. Collaborate with cybersecurity, infrastructure, data, and mission stakeholders to integrate security controls, cryptographic protections, logging, monitoring, and auditability throughout the software development lifecycle. Produce and maintain software designs, interface specifications, deployment procedures, configuration baselines, security implementation details, and operational support materials. Required Qualifications: Bachelor's degree in a quantitative field such as engineering or mathematics is required. Relevant fields include Electrical Engineering, Computer Engineering, Computer Science, Information Technology, and Information Systems. 10 years of professional software engineering experience (typical). Prior experience supporting the Intelligence Community. Experience applying programming concepts in a professional or academic setting. Experience applying modern software development methodologies, such as Agile, DevOps, or DevSecOps, in a professional or academic setting. Hands-on systems programming experience in one or more of C, C++, or Rust, with the ability to work across additional languages and runtimes as needed. Experience with operating-system interfaces, process management, inter-process communication, concurrency, and multithreaded application development. Understanding of synchronization primitives, signal handling, memory management, and resource management. Experience developing or troubleshooting socket-based applications and client-server communications. Experience with database engine internals, network protocol development, or comparable source-code and low-level systems analysis. Ability to navigate unfamiliar source code, trace execution and data flows, and assess how changes affect performance, interoperability, concurrency, and security. Experience with relational database design, SQL, query optimization, and database access controls. Understanding of graph database concepts and their application to relationship-based data. Experience developing infrastructure automation and deploying or supporting software in cloud environments. Experience integrating applications with identity services using OIDC and applying authentication and authorization controls. Understanding of Zero Trust Architecture concepts, including Policy Decision Points (PDPs), Policy Administration Points (PAPs), Policy Information Points (PIPs), and Policy Enforcement Points (PEPs). Strong troubleshooting, technical documentation, and collaboration skills. Agile Developer certification or Certified Scrum Developer certification. CompTIA Security+ or higher-level cybersecurity certification. Active DoD Top Secret/Sensitive Compartmented Information (TS/SCI) Clearance with the ability to obtain a Counterintelligence (CI) Polygraph is required. U.S. Citizenship is required. Candidates who meet the qualifications above do not need experience with every technology listed under desired qualifications. Depth in systems programming and database engineering, paired with the ability to learn adjacent technologies, is what matters most. Desired Qualifications: Advanced education: Master's degree in a quantitative field such as engineering or mathematics. Relevant fields include Electrical Engineering, Computer Engineering, Computer Science, Information Technology, and Information Systems. Database engineering: Experience with PostgreSQL and Neo4j, including database design, administration, performance optimization, and application integration. Protocol engineering: Experience interpreting packet captures, working with binary message formats, developing protocol parsers, or modifying database clients, drivers, extensions, or engine code. Infrastructure automation: Experience using Terraform and Ansible for cloud infrastructure provisioning, configuration management, and application deployment. Cloud and platform engineering: Experience deploying and maintaining applications and infrastructure in Amazon Web Services (AWS), including AWS GovCloud, Kubernetes, Red Hat OpenShift, and environments subject to Department of Defense Impact Level 5 requirements. Identity platforms: Experience with PingFederate, Keycloak, Radiant Logic, SailPoint, Secret Server, or Okta; experience migrating identity providers and adapting application code is especially useful. Public Key Infrastructure (PKI): Experience implementing certificate lifecycle management, key management, certificate validation, and cryptographic service integrations. Cryptographic interfaces: Experience using PKCS to integrate applications with cryptographic tokens, Hardware Security Modules (HSMs), or other secure key-storage mechanisms. Modern cryptography: Experience implementing, evaluating, or integrating cryptographic algorithms, including Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). Data protection and service integration: Experience with Trusted Data Format (TDF), Go-based security services, enterprise service integration, or serialization technologies such as Protocol Buffers. Job Type: Full-time Benefits:401(k) 401(k) matching Dental insurance Employee assistance program Flexible spending account Health insurance Health savings account Life insurance Paid time off Parental leave Professional development assistance Retirement plan Vision insurance Schedule: 8-hour shift Monday to Friday Day shift Ability to work additional hours as needed to support mission requirements Work Location: On-site - Charleston, SC or Reston, VA (Washington, DC metro) Security Clearance: Active TS/SCI clearance required Salary: $160,000-$215,000
Job Description Title - Cybersecurity Engineer - (Hardware/Embedded security) Location - Pittsburgh Pennsylvania (only onsite) Job Description: Must have qualifications: Minimum 4+ years of experience in threat modeling and hardware security testing. Strong understanding of hardware security technologies such as TrustZone, HSM, TPM, Secure Elements, and related security architectures. Knowledge of cybersecurity standards and protocols including IEC 62443, UL 2900, IEC 15118, SAE J21434, PKCS, Matter, OCPP, and EV charging security. Experience developing scripts and automation using tools such as OpenOCD and programming languages such as Python or Java. Strong understanding of networking fundamentals, network protocols, authentication, and identity management. Ability to analyze complex security concepts and apply them to embedded products and cybersecurity assessments. Bachelor's degree in Computer Security, Computer Science, Electrical Engineering, or a related field with a cybersecurity focus. Preferred Qualifications: Knowledge of hardware supplier risk assessment methodologies. Understanding of hardware attack techniques such as side-channel attacks and fault injection attacks . Strong knowledge of embedded systems security, computer security technologies, symmetric and asymmetric cryptography, PKI, X.509 certificates, and PKCS standards. Experience with AI and AI-based tools used in cybersecurity applications. Familiarity with secure firmware development, secure provisioning, and hardware security validation methodologies. Skills & Keywords Hardware Security, Embedded Security, Threat Modeling, Secure Boot, Hardware Root of Trust, TPM, HSM, TrustZone, Secure Elements, Penetration Testing, OpenOCD, Python, Java, Cryptography, PKI, X.509, IEC 62443, UL 2900, SAE J21434, IEC 15118, OCPP, Matter, Firmware Security, Side-Channel Analysis, Fault Injection, Cybersecurity Testing, Risk Assessment, Networking, Authentication, Identity Management. Responsibilities: Perform hardware and embedded product threat modeling, identify hardware security requirements, and conduct penetration testing and risk assessments. Review security features and datasheets of chipsets used in residential and industrial embedded devices and recommend appropriate hardware platforms. Participate in architectural reviews involving Hardware Root of Trust, bootloaders, secure boot, certificate/key storage, and related security components. Set up security testing tools, perform hardware security assessments, and recommend mitigation strategies to product development teams. Automate hardware security testing processes, including secure boot and secure firmware upgrade validation. Develop tools, scripts, and automation frameworks to improve security testing efficiency and scalability. Support cybersecurity assessments, product reviews, and security validation activities. Manage laboratory environments and contribute to small-scale research and development projects
11/14/2026
Full time
Job Description Title - Cybersecurity Engineer - (Hardware/Embedded security) Location - Pittsburgh Pennsylvania (only onsite) Job Description: Must have qualifications: Minimum 4+ years of experience in threat modeling and hardware security testing. Strong understanding of hardware security technologies such as TrustZone, HSM, TPM, Secure Elements, and related security architectures. Knowledge of cybersecurity standards and protocols including IEC 62443, UL 2900, IEC 15118, SAE J21434, PKCS, Matter, OCPP, and EV charging security. Experience developing scripts and automation using tools such as OpenOCD and programming languages such as Python or Java. Strong understanding of networking fundamentals, network protocols, authentication, and identity management. Ability to analyze complex security concepts and apply them to embedded products and cybersecurity assessments. Bachelor's degree in Computer Security, Computer Science, Electrical Engineering, or a related field with a cybersecurity focus. Preferred Qualifications: Knowledge of hardware supplier risk assessment methodologies. Understanding of hardware attack techniques such as side-channel attacks and fault injection attacks . Strong knowledge of embedded systems security, computer security technologies, symmetric and asymmetric cryptography, PKI, X.509 certificates, and PKCS standards. Experience with AI and AI-based tools used in cybersecurity applications. Familiarity with secure firmware development, secure provisioning, and hardware security validation methodologies. Skills & Keywords Hardware Security, Embedded Security, Threat Modeling, Secure Boot, Hardware Root of Trust, TPM, HSM, TrustZone, Secure Elements, Penetration Testing, OpenOCD, Python, Java, Cryptography, PKI, X.509, IEC 62443, UL 2900, SAE J21434, IEC 15118, OCPP, Matter, Firmware Security, Side-Channel Analysis, Fault Injection, Cybersecurity Testing, Risk Assessment, Networking, Authentication, Identity Management. Responsibilities: Perform hardware and embedded product threat modeling, identify hardware security requirements, and conduct penetration testing and risk assessments. Review security features and datasheets of chipsets used in residential and industrial embedded devices and recommend appropriate hardware platforms. Participate in architectural reviews involving Hardware Root of Trust, bootloaders, secure boot, certificate/key storage, and related security components. Set up security testing tools, perform hardware security assessments, and recommend mitigation strategies to product development teams. Automate hardware security testing processes, including secure boot and secure firmware upgrade validation. Develop tools, scripts, and automation frameworks to improve security testing efficiency and scalability. Support cybersecurity assessments, product reviews, and security validation activities. Manage laboratory environments and contribute to small-scale research and development projects
Job Description Network Security Engineer - Senior Cisco Identity Services Engine (ISE) Engineer Location: Washington, DC (Onsite) Type: Full-Time Required Experience 10-15 years of Network/Security Engineering experience. Strong hands-on experience with Cisco ISE 3.x in large enterprise environments. Experience with Cisco ISE upgrades, patching, troubleshooting, administration, and multi-node deployments . Strong knowledge of 802.1X, RADIUS, EAP/EAP-TLS, NAC, AAA, Authentication & Authorization Policies . Experience with Active Directory integration, Security Groups, and Identity Sources . Strong understanding of PKI and Certificate Management , including server certificates, CA chains, certificate renewals, thumbprints, and certificate-based authentication. Experience with Cisco ISE vulnerability remediation, security patching, and production support . Hands-on experience with packet captures, ISE logs, authentication troubleshooting, and root cause analysis . Experience integrating Cisco ISE with: Cisco Catalyst Meraki Firewalls F5 DNS Splunk/SIEM platforms ServiceNow & Change Management Experience creating and managing ServiceNow Change Requests . Ability to write implementation, validation, rollback, and risk assessment plans. Experience executing: ISE upgrades and patching Certificate renewals DNS changes Policy updates Security group changes New integrations Infrastructure migrations Incident & Support Experience Strong troubleshooting experience across: Endpoint Switch/AP ISE Active Directory Authorization Policy Network Access Experience with major incidents, RCA, and Cisco TAC case management. Ability to diagnose authentication, authorization, certificate, and connectivity issues. Infrastructure & Automation Experience with: Cisco ISE migrations and node deployments High Availability (HA) environments Splunk monitoring and alerting ServiceNow integrations Preferred experience with: Python Ansible Terraform REST APIs CI/CD Automation Preferred Qualifications CCNP Enterprise / CCNP Security or equivalent. Experience with Cisco Catalyst, Meraki, Enterprise Wireless, Active Directory, PKI, Splunk, and ServiceNow. Experience in highly regulated enterprise environments.
11/14/2026
Full time
Job Description Network Security Engineer - Senior Cisco Identity Services Engine (ISE) Engineer Location: Washington, DC (Onsite) Type: Full-Time Required Experience 10-15 years of Network/Security Engineering experience. Strong hands-on experience with Cisco ISE 3.x in large enterprise environments. Experience with Cisco ISE upgrades, patching, troubleshooting, administration, and multi-node deployments . Strong knowledge of 802.1X, RADIUS, EAP/EAP-TLS, NAC, AAA, Authentication & Authorization Policies . Experience with Active Directory integration, Security Groups, and Identity Sources . Strong understanding of PKI and Certificate Management , including server certificates, CA chains, certificate renewals, thumbprints, and certificate-based authentication. Experience with Cisco ISE vulnerability remediation, security patching, and production support . Hands-on experience with packet captures, ISE logs, authentication troubleshooting, and root cause analysis . Experience integrating Cisco ISE with: Cisco Catalyst Meraki Firewalls F5 DNS Splunk/SIEM platforms ServiceNow & Change Management Experience creating and managing ServiceNow Change Requests . Ability to write implementation, validation, rollback, and risk assessment plans. Experience executing: ISE upgrades and patching Certificate renewals DNS changes Policy updates Security group changes New integrations Infrastructure migrations Incident & Support Experience Strong troubleshooting experience across: Endpoint Switch/AP ISE Active Directory Authorization Policy Network Access Experience with major incidents, RCA, and Cisco TAC case management. Ability to diagnose authentication, authorization, certificate, and connectivity issues. Infrastructure & Automation Experience with: Cisco ISE migrations and node deployments High Availability (HA) environments Splunk monitoring and alerting ServiceNow integrations Preferred experience with: Python Ansible Terraform REST APIs CI/CD Automation Preferred Qualifications CCNP Enterprise / CCNP Security or equivalent. Experience with Cisco Catalyst, Meraki, Enterprise Wireless, Active Directory, PKI, Splunk, and ServiceNow. Experience in highly regulated enterprise environments.
Job Description Azure/Terraform Engineer Job Description We are seeking a hands-on Azure/Terraform Engineer to support enterprise cloud infrastructure development and application migrations from GCP to Azure within a healthcare environment. This role will focus on building secure Azure infrastructure, developing reusable Terraform modules, configuring networking and application security, and leading migrations through production cutover and GCP decommissioning. Key Responsibilities Develop and maintain reusable Terraform modules for Azure infrastructure, including AKS, networking, Key Vault, ACR, PostgreSQL, and storage services. Lead hands-on application and infrastructure migrations from GCP to Azure. Configure Azure Application Gateway, WAF v2, and AKS ingress using AGIC. Implement secure cloud infrastructure, least-privilege RBAC, and access controls. Refactor and optimize existing Terraform configurations, including state management and infrastructure imports. Troubleshoot infrastructure, networking, and security issues. Required Qualifications 5+ years of Infrastructure as Code experience, including 3+ years developing reusable Terraform modules. 3+ years of hands-on Azure experience with services such as AKS, VNets, Key Vault, ACR, PostgreSQL, and Azure Storage. 2+ years of experience configuring Azure Application Gateway and WAF v2. Direct experience migrating applications and infrastructure from GCP to Azure. Strong understanding of Terraform state management, cloud networking, RBAC, and security best practices. Preferred Qualifications Experience with GCP services, enterprise Terraform module libraries, and NextGen Networks. Familiarity with Venafi/PKI certificate management and Prisma Cloud remediation.
11/14/2026
Full time
Job Description Azure/Terraform Engineer Job Description We are seeking a hands-on Azure/Terraform Engineer to support enterprise cloud infrastructure development and application migrations from GCP to Azure within a healthcare environment. This role will focus on building secure Azure infrastructure, developing reusable Terraform modules, configuring networking and application security, and leading migrations through production cutover and GCP decommissioning. Key Responsibilities Develop and maintain reusable Terraform modules for Azure infrastructure, including AKS, networking, Key Vault, ACR, PostgreSQL, and storage services. Lead hands-on application and infrastructure migrations from GCP to Azure. Configure Azure Application Gateway, WAF v2, and AKS ingress using AGIC. Implement secure cloud infrastructure, least-privilege RBAC, and access controls. Refactor and optimize existing Terraform configurations, including state management and infrastructure imports. Troubleshoot infrastructure, networking, and security issues. Required Qualifications 5+ years of Infrastructure as Code experience, including 3+ years developing reusable Terraform modules. 3+ years of hands-on Azure experience with services such as AKS, VNets, Key Vault, ACR, PostgreSQL, and Azure Storage. 2+ years of experience configuring Azure Application Gateway and WAF v2. Direct experience migrating applications and infrastructure from GCP to Azure. Strong understanding of Terraform state management, cloud networking, RBAC, and security best practices. Preferred Qualifications Experience with GCP services, enterprise Terraform module libraries, and NextGen Networks. Familiarity with Venafi/PKI certificate management and Prisma Cloud remediation.
Job Description Role Overview: The Vice President, Workforce Identity and Directory Services, serves as the primary owner of all Active Directory-related infrastructure and strategy. This role leads the design, governance, and modernization of the enterprise identity platform across on-premises, hybrid, and cloud environments. The VP is responsible for developing long-term technology roadmaps, driving security best practices, and partnering with Security, Infrastructure, and Application teams to deliver scalable, resilient identity services aligned with business objectives. Key Responsibilities: Serve as the primary owner and point of contact for all Active Directory infrastructure, strategy, and operations across on-premises and cloud environments. Lead and execute a long-term technology roadmap to modernize the Active Directory environment, including forest and domain consolidation, AD tiering model implementation, strategic reduction and decommissioning of on-premises domain controllers, and accelerating workload migration from on-premises AD to Microsoft Entra ID. Architect and govern enterprise Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), DNS, and DHCP, PKI, ensuring high availability, disaster recovery readiness, and security at scale. Drive the adoption and optimization of Microsoft Entra ID security features, including Conditional Access, Identity Protection, Identity Governance, Workload Identities, and Entra Permissions Management. Govern Entra ID external collaboration and application identity, including cross-tenant access policies, B2B guest account lifecycle, app registration and enterprise application management, API permission and consent policy governance, and service principal security and credential rotation. Manage hybrid Active Directory environments, including Azure AD Connect / Cloud Sync configuration, seamless SSO, pass-through authentication, and directory synchronization health monitoring. Design and enforce Group Policy architecture at scale, including GPO lifecycle management, security baselines, and policy inheritance strategies across complex OU structures. Establish and enforce identity security best practices, policies, and standards across the organization in alignment with zero trust principles and AD tiering models (Enhanced Security Admin Environment). Oversee Kerberos, NTLM, LDAP, and certificate-based authentication protocols, driving migration away from legacy protocols toward modern authentication standards. Lead AD Forest and domain trust management, replication topology optimization, Sites and Services configuration, and schema extension governance. Partner with Security, Compliance, and Risk teams to ensure identity infrastructure meets regulatory and audit requirements, including SOX, NIST, and industry-specific mandates. Oversee incident response, disaster recovery, and root cause analysis for identity-related security events, AD replication failures, and service disruptions. Evaluate emerging identity technologies and industry trends including passwordless authentication, decentralized identity, and AI-driven threat detection to inform strategic planning and investment decisions. Required Qualifications: 10+ years of progressive experience in IT infrastructure with a focus on Active Directory and identity management, including at least 5 years in an architect or senior engineering capacity. Deep knowledge of Microsoft 365 from an identity and access management perspective, including Exchange Online, SharePoint Online, and Teams integration with Entra ID, M365 group and license management, app consent frameworks, service principals, and Microsoft 365 Defender for identity-related threat detection. Deep fluency in authentication and federation protocols, including SAML, OAuth 2.0, OpenID Connect, WS-Federation, Kerberos, LDAP, and NTLM, with a track record of migrating environments away from legacy protocols. Experience implementing passwordless authentication strategies, including FIDO2, Windows Hello for Business, and certificate-based authentication via PKI. Hands-on experience with Active Directory security assessment and hardening tools such as BloodHound, PingCastle, and Purple Knight for attack path analysis and security posture evaluation. Knowledge of service account governance, including Group Managed Service Accounts (gMSA), and endpoint security tooling such as LAPS. Proficiency with PowerShell, Terraform, DSC, and Microsoft Graph API for identity infrastructure automation, reporting, and configuration drift detection. Working knowledge of NIST, SOX, or other regulatory compliance frameworks as they relate to identity management and PKI governance. Microsoft certifications such as Microsoft Certified: Identity and Access Administrator Associate, Azure Solutions Architect Expert, or Cybersecurity Architect Expert. Proven track record of building, mentoring, and managing high-performing identity engineering teams. Excellent communication and stakeholder management skills, to include translating complex identity concepts for non-technical audiences and influence at all levels of the organization. Preferred Qualifications: Identity architecture and strategic technology vision Enterprise security and zero trust mindset Deep technical problem solving across complex, multi-forest AD environments Stakeholder management and executive communication Strong ownership, accountability, and bias toward action Experience in financial services, private equity, or other highly regulated industries.
11/14/2026
Full time
Job Description Role Overview: The Vice President, Workforce Identity and Directory Services, serves as the primary owner of all Active Directory-related infrastructure and strategy. This role leads the design, governance, and modernization of the enterprise identity platform across on-premises, hybrid, and cloud environments. The VP is responsible for developing long-term technology roadmaps, driving security best practices, and partnering with Security, Infrastructure, and Application teams to deliver scalable, resilient identity services aligned with business objectives. Key Responsibilities: Serve as the primary owner and point of contact for all Active Directory infrastructure, strategy, and operations across on-premises and cloud environments. Lead and execute a long-term technology roadmap to modernize the Active Directory environment, including forest and domain consolidation, AD tiering model implementation, strategic reduction and decommissioning of on-premises domain controllers, and accelerating workload migration from on-premises AD to Microsoft Entra ID. Architect and govern enterprise Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), DNS, and DHCP, PKI, ensuring high availability, disaster recovery readiness, and security at scale. Drive the adoption and optimization of Microsoft Entra ID security features, including Conditional Access, Identity Protection, Identity Governance, Workload Identities, and Entra Permissions Management. Govern Entra ID external collaboration and application identity, including cross-tenant access policies, B2B guest account lifecycle, app registration and enterprise application management, API permission and consent policy governance, and service principal security and credential rotation. Manage hybrid Active Directory environments, including Azure AD Connect / Cloud Sync configuration, seamless SSO, pass-through authentication, and directory synchronization health monitoring. Design and enforce Group Policy architecture at scale, including GPO lifecycle management, security baselines, and policy inheritance strategies across complex OU structures. Establish and enforce identity security best practices, policies, and standards across the organization in alignment with zero trust principles and AD tiering models (Enhanced Security Admin Environment). Oversee Kerberos, NTLM, LDAP, and certificate-based authentication protocols, driving migration away from legacy protocols toward modern authentication standards. Lead AD Forest and domain trust management, replication topology optimization, Sites and Services configuration, and schema extension governance. Partner with Security, Compliance, and Risk teams to ensure identity infrastructure meets regulatory and audit requirements, including SOX, NIST, and industry-specific mandates. Oversee incident response, disaster recovery, and root cause analysis for identity-related security events, AD replication failures, and service disruptions. Evaluate emerging identity technologies and industry trends including passwordless authentication, decentralized identity, and AI-driven threat detection to inform strategic planning and investment decisions. Required Qualifications: 10+ years of progressive experience in IT infrastructure with a focus on Active Directory and identity management, including at least 5 years in an architect or senior engineering capacity. Deep knowledge of Microsoft 365 from an identity and access management perspective, including Exchange Online, SharePoint Online, and Teams integration with Entra ID, M365 group and license management, app consent frameworks, service principals, and Microsoft 365 Defender for identity-related threat detection. Deep fluency in authentication and federation protocols, including SAML, OAuth 2.0, OpenID Connect, WS-Federation, Kerberos, LDAP, and NTLM, with a track record of migrating environments away from legacy protocols. Experience implementing passwordless authentication strategies, including FIDO2, Windows Hello for Business, and certificate-based authentication via PKI. Hands-on experience with Active Directory security assessment and hardening tools such as BloodHound, PingCastle, and Purple Knight for attack path analysis and security posture evaluation. Knowledge of service account governance, including Group Managed Service Accounts (gMSA), and endpoint security tooling such as LAPS. Proficiency with PowerShell, Terraform, DSC, and Microsoft Graph API for identity infrastructure automation, reporting, and configuration drift detection. Working knowledge of NIST, SOX, or other regulatory compliance frameworks as they relate to identity management and PKI governance. Microsoft certifications such as Microsoft Certified: Identity and Access Administrator Associate, Azure Solutions Architect Expert, or Cybersecurity Architect Expert. Proven track record of building, mentoring, and managing high-performing identity engineering teams. Excellent communication and stakeholder management skills, to include translating complex identity concepts for non-technical audiences and influence at all levels of the organization. Preferred Qualifications: Identity architecture and strategic technology vision Enterprise security and zero trust mindset Deep technical problem solving across complex, multi-forest AD environments Stakeholder management and executive communication Strong ownership, accountability, and bias toward action Experience in financial services, private equity, or other highly regulated industries.
The Senior Data Engineer designs, implements, and operates secure data platforms that support defense intelligence analysis. In this role you architect how data is stored, accessed, and integrated, optimize throughput and query performance, and work closely with analysts to deliver reliable data pipelines. You will also manage Linux and Windows servers, virtualized compute and storage, and backup and recovery within an on-site, classified environment. Responsibilities Design and operate data management systems to support intelligence and defense analysis Define how data is stored, accessed, integrated, and managed across platforms Collaborate with analysts and data users to create and maintain optimal data architectures Plan, design, and tune systems for high data throughput and efficient queries Select and support backend database and storage technologies for mission needs Implement and enforce security baselines on Linux and Windows servers Manage virtualized compute and storage environments using Citrix or VMware ESXi Oversee backup, recovery, and system restoration for critical mission data Required Skills Data architecture design Database performance tuning Linux server administration Windows server administration VMware ESXi administration Citrix virtualization Security hardening and compliance Backup and disaster recovery LDAP and PKI management Defense and intelligence data workflows
11/08/2026
Full time
The Senior Data Engineer designs, implements, and operates secure data platforms that support defense intelligence analysis. In this role you architect how data is stored, accessed, and integrated, optimize throughput and query performance, and work closely with analysts to deliver reliable data pipelines. You will also manage Linux and Windows servers, virtualized compute and storage, and backup and recovery within an on-site, classified environment. Responsibilities Design and operate data management systems to support intelligence and defense analysis Define how data is stored, accessed, integrated, and managed across platforms Collaborate with analysts and data users to create and maintain optimal data architectures Plan, design, and tune systems for high data throughput and efficient queries Select and support backend database and storage technologies for mission needs Implement and enforce security baselines on Linux and Windows servers Manage virtualized compute and storage environments using Citrix or VMware ESXi Oversee backup, recovery, and system restoration for critical mission data Required Skills Data architecture design Database performance tuning Linux server administration Windows server administration VMware ESXi administration Citrix virtualization Security hardening and compliance Backup and disaster recovery LDAP and PKI management Defense and intelligence data workflows
Job Description Job Description Overview We are seeking a CSfC Senior Network Engineer to join our team supporting Network Enterprise Technology Command (NETCOM) in Honolulu, HI. TekSynap is a fast growing high-tech company that understands both the pace of technology today and the need to have a comprehensive well planned information management environment. "Technology moving at the speed of thought" embodies these principles - the need to nimbly utilize the best that information technology offers to meet the business needs of our Federal Government customers. We offer our full-time employees a competitive benefits package to include health, dental, vision, 401K, life insurance, short-term and long-term disability plans, vacation time and holidays. Visit us at . Apply now to explore jobs with us! The safety and health of our employees is of the utmost importance. Employees are required to comply with any vaccination requirements mandated by contract, applicable law or regulation. By applying to a role at TekSynap you are providing consent to receive text messages regarding your interview and employment status. If at any time you would like to opt out of text messaging, respond "STOP". As part of the application process, you agree that TekSynap Corporation may retain and use your name, e-mail, and contact information for purposes related to employment consideration. Responsibilities RESPONSIBILITIES Assists the PM in the day-to-day management of leading Network Engineers. Must have an in-depth understanding of advanced networking O&M Commercial Solutions for Classified (CSfC) concepts and processes and experience applying these with little to no guidance. Must be able to provide guidance to others. Must be able to perform successfully in complex, unstructured situations. Must be proficient in multivendor networking environments in configuring firewalls, Intrusion Prevention/Detection systems, VPN gateways, routers, and switches (Cisco, Aruba, Juniper, Cisco ASA, etc.) Be able to develop and modify system scripts. Write standardized system documentation, including configuration guides, test procedures, test results, and training materials. Provide onsite training to technical and non-technical users on the daily use, management, and troubleshooting of the solution after installation. Support all Cross-Domain solution requirements Collaborate with other operations departments to design approved infrastructure Serve as the escalation contact during large outages for Tier 2 and 3 systems. Author network Engineering Design Packages to include detailed implementation project plans and procedures. Configures network, software, and hardware components to meet NSA CSfC, NIAP, and DoD requirements Performs network design and systems integration Designs, develops, implements, tests, and maintains complex secure communications networks Configuring/managing PKI Certificate Authorities for CSfC solutions Familiarity with Certificate Authority configuration (ISC CertAgent/MS Windows Server/Red Hat Certificate systems) Document configuration, test procedure, results, and training materials Preparing test reports and configuration documentation according to customer standards. Providing customer on-site training on solution daily use, management, and troubleshooting Provide tier 2 and 3 support as part of a technical team. Identify and recommend hardware and support solutions based on research and analysis of new technologies, interfacing with customers and vendors. Enhance department and organization reputation by accepting ownership for accomplishing new and different requests; exploring opportunities to add value to the company. Apply DoD STIGs and IAVAs Perform special projects and other duties as assigned. REQUIRED QUALIFICATIONS Top Secret OR Higher OR Secret Clearance level with completed T5 investigation Active Professional Network certification (CCNP-Security, CCNA, HPE Aruba Networking Certified Professional - Switching, etc.) Must have experience with one or more networking vendors: Cisco, Aruba, Juniper, etc. One of the following DoD8140 Certifications : SecurityX/CASP+ CCNA CCNP Security CCSP (Certified Cloud Security Professional) GCED (GIAC Certified Enterprise Defender) GCIA (GIAC Certified Intrusion Analyst) GCLD (GIAC Cloud Security Essentials) GDSA (GIAC Defensible Security Architecture) GFACT (GIAC Foundational Cybersecurity Technologies) 10 or more years of experience in engineering MA/MS= 10 years; BS=12 years Qualifications WORK ENVIRONMENT AND PHYSICAL DEMANDS The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of the job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions. Location: Honolulu, HI Type of environment: Office Noise level: Low Work schedule: CONUS Schedule is day shift Monday - Friday. May be requested to work evenings and weekends to meet program and contract needs. Amount of Travel: Less than 20% PHYSICAL DEMANDS The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. While performing the duties of this job, the employee is regularly required to use hands to handle, feel, touch; reach with hands and arms; talk and hear. The employee is regularly required to stand; walk; sit; climb or balance; and stoop, kneel, crouch, or crawl. The employee is regularly required to lift up to 10 pounds. The employee is frequently required to lift up to 25 pounds; and up to 50 pounds. The vision requirements include close vision, distance vision, peripheral vision, depth perception, and ability to adjust focus. WORK AUTHORIZATION/SECURITY CLEARANCE United States Citizenship Top Secret Clearance requirement WAGE INFORMATION Target salary range: $133,000.00 - $165,000.00. The salary range displayed is an estimate only and is not a guarantee of compensation or salary, and will be determined on several factors regarding the individual's particular combination of education, knowledge, skills, competencies and experience, as well as contract parameters and organizational requirements. The displayed salary is one component of the total compensation package for employees. OTHER INFORMATION Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice. TekSynap is a drug-free workplace. We reserve the right to conduct drug testing in accordance with federal, state, and local laws. All employees and candidates may be subject to drug screening if deemed necessary to ensure a safe and compliant working environment. Many positions require specific certifications and/or the ability to obtain a security clearance. Security clearances may only be granted to U.S. citizens. Applicants who accept an offer of employment may be subject to investigations performed by TekSynap and/or the Government to verify the candidate meets the required qualifications and other eligibility requirements. EQUAL EMPLOYMENT OPPORTUNITY In order to provide equal employment and advancement opportunities to all individuals, employment decisions will be based on merit, qualifications, and abilities. TekSynap does not discriminate against any person because of race, color, creed, religion, sex, national origin, disability, age, genetic information or any other characteristic protected by law (referred to as "protected status"). This nondiscrimination policy extends to all terms, conditions, and privileges of employment as well as the use of all company facilities, participation in all company-sponsored activities, and all employment actions such as promotions, compensation, benefits, and termination of employment.
09/28/2026
Full time
Job Description Job Description Overview We are seeking a CSfC Senior Network Engineer to join our team supporting Network Enterprise Technology Command (NETCOM) in Honolulu, HI. TekSynap is a fast growing high-tech company that understands both the pace of technology today and the need to have a comprehensive well planned information management environment. "Technology moving at the speed of thought" embodies these principles - the need to nimbly utilize the best that information technology offers to meet the business needs of our Federal Government customers. We offer our full-time employees a competitive benefits package to include health, dental, vision, 401K, life insurance, short-term and long-term disability plans, vacation time and holidays. Visit us at . Apply now to explore jobs with us! The safety and health of our employees is of the utmost importance. Employees are required to comply with any vaccination requirements mandated by contract, applicable law or regulation. By applying to a role at TekSynap you are providing consent to receive text messages regarding your interview and employment status. If at any time you would like to opt out of text messaging, respond "STOP". As part of the application process, you agree that TekSynap Corporation may retain and use your name, e-mail, and contact information for purposes related to employment consideration. Responsibilities RESPONSIBILITIES Assists the PM in the day-to-day management of leading Network Engineers. Must have an in-depth understanding of advanced networking O&M Commercial Solutions for Classified (CSfC) concepts and processes and experience applying these with little to no guidance. Must be able to provide guidance to others. Must be able to perform successfully in complex, unstructured situations. Must be proficient in multivendor networking environments in configuring firewalls, Intrusion Prevention/Detection systems, VPN gateways, routers, and switches (Cisco, Aruba, Juniper, Cisco ASA, etc.) Be able to develop and modify system scripts. Write standardized system documentation, including configuration guides, test procedures, test results, and training materials. Provide onsite training to technical and non-technical users on the daily use, management, and troubleshooting of the solution after installation. Support all Cross-Domain solution requirements Collaborate with other operations departments to design approved infrastructure Serve as the escalation contact during large outages for Tier 2 and 3 systems. Author network Engineering Design Packages to include detailed implementation project plans and procedures. Configures network, software, and hardware components to meet NSA CSfC, NIAP, and DoD requirements Performs network design and systems integration Designs, develops, implements, tests, and maintains complex secure communications networks Configuring/managing PKI Certificate Authorities for CSfC solutions Familiarity with Certificate Authority configuration (ISC CertAgent/MS Windows Server/Red Hat Certificate systems) Document configuration, test procedure, results, and training materials Preparing test reports and configuration documentation according to customer standards. Providing customer on-site training on solution daily use, management, and troubleshooting Provide tier 2 and 3 support as part of a technical team. Identify and recommend hardware and support solutions based on research and analysis of new technologies, interfacing with customers and vendors. Enhance department and organization reputation by accepting ownership for accomplishing new and different requests; exploring opportunities to add value to the company. Apply DoD STIGs and IAVAs Perform special projects and other duties as assigned. REQUIRED QUALIFICATIONS Top Secret OR Higher OR Secret Clearance level with completed T5 investigation Active Professional Network certification (CCNP-Security, CCNA, HPE Aruba Networking Certified Professional - Switching, etc.) Must have experience with one or more networking vendors: Cisco, Aruba, Juniper, etc. One of the following DoD8140 Certifications : SecurityX/CASP+ CCNA CCNP Security CCSP (Certified Cloud Security Professional) GCED (GIAC Certified Enterprise Defender) GCIA (GIAC Certified Intrusion Analyst) GCLD (GIAC Cloud Security Essentials) GDSA (GIAC Defensible Security Architecture) GFACT (GIAC Foundational Cybersecurity Technologies) 10 or more years of experience in engineering MA/MS= 10 years; BS=12 years Qualifications WORK ENVIRONMENT AND PHYSICAL DEMANDS The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of the job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions. Location: Honolulu, HI Type of environment: Office Noise level: Low Work schedule: CONUS Schedule is day shift Monday - Friday. May be requested to work evenings and weekends to meet program and contract needs. Amount of Travel: Less than 20% PHYSICAL DEMANDS The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. While performing the duties of this job, the employee is regularly required to use hands to handle, feel, touch; reach with hands and arms; talk and hear. The employee is regularly required to stand; walk; sit; climb or balance; and stoop, kneel, crouch, or crawl. The employee is regularly required to lift up to 10 pounds. The employee is frequently required to lift up to 25 pounds; and up to 50 pounds. The vision requirements include close vision, distance vision, peripheral vision, depth perception, and ability to adjust focus. WORK AUTHORIZATION/SECURITY CLEARANCE United States Citizenship Top Secret Clearance requirement WAGE INFORMATION Target salary range: $133,000.00 - $165,000.00. The salary range displayed is an estimate only and is not a guarantee of compensation or salary, and will be determined on several factors regarding the individual's particular combination of education, knowledge, skills, competencies and experience, as well as contract parameters and organizational requirements. The displayed salary is one component of the total compensation package for employees. OTHER INFORMATION Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice. TekSynap is a drug-free workplace. We reserve the right to conduct drug testing in accordance with federal, state, and local laws. All employees and candidates may be subject to drug screening if deemed necessary to ensure a safe and compliant working environment. Many positions require specific certifications and/or the ability to obtain a security clearance. Security clearances may only be granted to U.S. citizens. Applicants who accept an offer of employment may be subject to investigations performed by TekSynap and/or the Government to verify the candidate meets the required qualifications and other eligibility requirements. EQUAL EMPLOYMENT OPPORTUNITY In order to provide equal employment and advancement opportunities to all individuals, employment decisions will be based on merit, qualifications, and abilities. TekSynap does not discriminate against any person because of race, color, creed, religion, sex, national origin, disability, age, genetic information or any other characteristic protected by law (referred to as "protected status"). This nondiscrimination policy extends to all terms, conditions, and privileges of employment as well as the use of all company facilities, participation in all company-sponsored activities, and all employment actions such as promotions, compensation, benefits, and termination of employment.
Georgia System Operations Corporation
Tucker, Georgia
Job Description Job Description Network Security EngineerEngineer Secure, Resilient Network Services That Support Mission-Critical OperationsGeorgia System Operations Corporation (GSOC) is seeking a Network Security Engineer to design, implement, secure, and operate corporate network services and cybersecurity tools that enable reliable, protected business operations.This hands-on role combines enterprise network engineering and cybersecurity expertise across datacenter, campus, remote-site, internet-edge, and approved cloud environments. The Network Security Engineer helps safeguard availability, performance, secure access, and security visibility while advancing resilient, supportable, and automated network and security services.This opportunity is ideal for an experienced network and security professional who enjoys solving complex technical problems, strengthening controls, supporting incident response, mentoring peers, and collaborating across infrastructure, cybersecurity, application, service desk, and vendor teams. This is an onsite position and it is not eligible for visa sponsorshipWhat You'll DoAs a Network Security Engineer, you will engineer and support the network and network-focused security services that connect and protect enterprise users, systems, and sites.You will:Design, deploy, and support datacenter and campus switching, routing, VLANs, VRFs, high availability, capacity planning, and network segmentation.Administer next-generation firewalls, security zones, NAT, threat-prevention services, firewall policy lifecycle, and least-privilege access controls.Engineer WAN, internet-edge, remote-site, remote-access VPN, and site-to-site VPN connectivity, including integrations with identity, MFA, and device-trust services.Design and support corporate and guest wireless, controllers, access points, RF performance, 802.1X, network access control, device profiling, and secure authentication.Configure load balancers, virtual servers, pools, health monitors, persistence, TLS termination, and high-availability services.Manage the network-facing certificate lifecycle and PKI integrations.Engineer and operate secure web and DNS controls, network detection and response, security logging, SIEM integrations, and security-control health monitoring.Partner with the Security Operations Center on alert tuning, investigations, evidence gathering, and operational security use cases.Support secure DNS, DHCP, and IP address management and maintain telemetry, flow data, logging, alerting, packet analysis, and service dashboards.Maintain secure configuration baselines, backups, firmware and software lifecycle, and remediation of network-device and security-tool vulnerabilities.Automate repeatable work using APIs, scripting, and infrastructure-as-code practices.Develop and test network and security-platform recovery and failover capabilities.Prepare change and rollback plans and provide incident escalation, containment support, root-cause analysis, and vendor coordination. This role also:Works independently within established standards and change processes.Provides technical leadership for projects and mentors peers.Participates in technology evaluations, proof-of-concepts, cross-functional initiatives, backup support, and knowledge transfer. What You BringBachelor's degree in Information Technology, Computer Science, Engineering, Cybersecurity, or a related field. Equivalent combination of education, training, and directly related work experience may be considered.Ideally 5+ years of progressive experience supporting enterprise network and network-security infrastructure, including switching, routing, firewall administration, VPN, wireless, and troubleshooting.Strong knowledge of enterprise LAN/WAN, datacenter switching, routing, firewalls, VPN, wireless, NAC, load balancing, PKI and certificates, DNS, DHCP, IPAM, and secure configuration management.Hands-on experience operating cybersecurity tooling such as secure web and DNS services, network detection and response, vulnerability management, SIEM and logging integrations, and security monitoring.Experience with network and security automation using Python, PowerShell, Ansible, Terraform, APIs, or comparable tools.Working knowledge of NIST CSF, CIS Controls, incident-response practices, and applicable regulatory or industry requirements, including NERC CIP where relevant to the IT environment.Strong analytical, troubleshooting, documentation, communication, collaboration, and customer-service skills. Preferred QualificationsEnterprise Network EngineeringExperience engineering highly available datacenter, campus, WAN, internet-edge, remote-site, wireless, and VPN services.Experience with segmentation, least-privilege access, identity and MFA integrations, device trust, and network access control.Experience with load balancing, TLS termination, application delivery, certificate lifecycle management, and PKI integrations.Network Security & DetectionExperience operating next-generation firewalls, threat-prevention services, secure web or DNS controls, network detection and response, and vulnerability-management processes.Experience integrating network-security telemetry with SIEM, logging, alerting, dashboards, and incident-response workflows.Experience partnering with a SOC on investigation, tuning, containment, evidence, or root-cause activities.Automation, Resilience & OperationsExperience automating network or security operations through scripting, APIs, Ansible, Terraform, or infrastructure as code.Experience developing recovery, failover, configuration-backup, firmware-lifecycle, and vulnerability-remediation practices.Experience preparing changes, rollback plans, technical documentation, performance measures, and vendor-supported resolutions.CertificationsRelevant credentials such as CCNA, CCNP, ACP, PCNSE or equivalent firewall-vendor certification, CWNA, Security+, CISSP, AZ-700, or similar certifications are preferred. Advantages of Working at GSOCWorking at GSOC means more than just a job it's an opportunity to contribute to work that truly matters. Mission-Driven ImpactYour work supports secure, reliable corporate network services and cybersecurity capabilities used across GSOC's enterprise environment. Network Engineering & Cybersecurity DepthApply both network engineering and hands-on security expertise across switching, routing, wireless, firewalls, VPN, application delivery, monitoring, automation, and incident support. Technical Leadership & Continuous ImprovementLead technical projects, mentor peers, evaluate new technologies, automate repeatable work, and strengthen resilience, visibility, and operational supportability. Strong Values and Professional StandardsWork in an environment grounded in accountability, collaboration, integrity, security, compliance, and continuous improvement. Work Environment & BenefitsGSOC offers a professional, collaborative work environment with competitive compensation, comprehensive benefits, and a commitment to creating a respectful and inclusive workplace.Participation in an on-call rotation, emergency support, and scheduled maintenance outside normal business hours is required. Why Join GSOCAt GSOC, you will help engineer the network and security services that enable dependable business operations, secure access, security visibility, and resilient enterprise technology.You'll collaborate across infrastructure, cybersecurity, applications, service desk, and vendor teams while expanding your technical leadership and automation capabilities. Apply TodayIf you're ready to combine enterprise network engineering and cybersecurity expertise in a hands-on role supporting reliable, protected operations, we encourage you to apply. GSOC does not accept unsolicited resumes or candidate submissions from staffing agencies, search firms, or third-party recruiters. Any unsolicited resumes submitted without a valid, executed agreement will become the property of GSOC, and no placement fee will be paid. Job Posted by ApplicantPro
09/28/2026
Full time
Job Description Job Description Network Security EngineerEngineer Secure, Resilient Network Services That Support Mission-Critical OperationsGeorgia System Operations Corporation (GSOC) is seeking a Network Security Engineer to design, implement, secure, and operate corporate network services and cybersecurity tools that enable reliable, protected business operations.This hands-on role combines enterprise network engineering and cybersecurity expertise across datacenter, campus, remote-site, internet-edge, and approved cloud environments. The Network Security Engineer helps safeguard availability, performance, secure access, and security visibility while advancing resilient, supportable, and automated network and security services.This opportunity is ideal for an experienced network and security professional who enjoys solving complex technical problems, strengthening controls, supporting incident response, mentoring peers, and collaborating across infrastructure, cybersecurity, application, service desk, and vendor teams. This is an onsite position and it is not eligible for visa sponsorshipWhat You'll DoAs a Network Security Engineer, you will engineer and support the network and network-focused security services that connect and protect enterprise users, systems, and sites.You will:Design, deploy, and support datacenter and campus switching, routing, VLANs, VRFs, high availability, capacity planning, and network segmentation.Administer next-generation firewalls, security zones, NAT, threat-prevention services, firewall policy lifecycle, and least-privilege access controls.Engineer WAN, internet-edge, remote-site, remote-access VPN, and site-to-site VPN connectivity, including integrations with identity, MFA, and device-trust services.Design and support corporate and guest wireless, controllers, access points, RF performance, 802.1X, network access control, device profiling, and secure authentication.Configure load balancers, virtual servers, pools, health monitors, persistence, TLS termination, and high-availability services.Manage the network-facing certificate lifecycle and PKI integrations.Engineer and operate secure web and DNS controls, network detection and response, security logging, SIEM integrations, and security-control health monitoring.Partner with the Security Operations Center on alert tuning, investigations, evidence gathering, and operational security use cases.Support secure DNS, DHCP, and IP address management and maintain telemetry, flow data, logging, alerting, packet analysis, and service dashboards.Maintain secure configuration baselines, backups, firmware and software lifecycle, and remediation of network-device and security-tool vulnerabilities.Automate repeatable work using APIs, scripting, and infrastructure-as-code practices.Develop and test network and security-platform recovery and failover capabilities.Prepare change and rollback plans and provide incident escalation, containment support, root-cause analysis, and vendor coordination. This role also:Works independently within established standards and change processes.Provides technical leadership for projects and mentors peers.Participates in technology evaluations, proof-of-concepts, cross-functional initiatives, backup support, and knowledge transfer. What You BringBachelor's degree in Information Technology, Computer Science, Engineering, Cybersecurity, or a related field. Equivalent combination of education, training, and directly related work experience may be considered.Ideally 5+ years of progressive experience supporting enterprise network and network-security infrastructure, including switching, routing, firewall administration, VPN, wireless, and troubleshooting.Strong knowledge of enterprise LAN/WAN, datacenter switching, routing, firewalls, VPN, wireless, NAC, load balancing, PKI and certificates, DNS, DHCP, IPAM, and secure configuration management.Hands-on experience operating cybersecurity tooling such as secure web and DNS services, network detection and response, vulnerability management, SIEM and logging integrations, and security monitoring.Experience with network and security automation using Python, PowerShell, Ansible, Terraform, APIs, or comparable tools.Working knowledge of NIST CSF, CIS Controls, incident-response practices, and applicable regulatory or industry requirements, including NERC CIP where relevant to the IT environment.Strong analytical, troubleshooting, documentation, communication, collaboration, and customer-service skills. Preferred QualificationsEnterprise Network EngineeringExperience engineering highly available datacenter, campus, WAN, internet-edge, remote-site, wireless, and VPN services.Experience with segmentation, least-privilege access, identity and MFA integrations, device trust, and network access control.Experience with load balancing, TLS termination, application delivery, certificate lifecycle management, and PKI integrations.Network Security & DetectionExperience operating next-generation firewalls, threat-prevention services, secure web or DNS controls, network detection and response, and vulnerability-management processes.Experience integrating network-security telemetry with SIEM, logging, alerting, dashboards, and incident-response workflows.Experience partnering with a SOC on investigation, tuning, containment, evidence, or root-cause activities.Automation, Resilience & OperationsExperience automating network or security operations through scripting, APIs, Ansible, Terraform, or infrastructure as code.Experience developing recovery, failover, configuration-backup, firmware-lifecycle, and vulnerability-remediation practices.Experience preparing changes, rollback plans, technical documentation, performance measures, and vendor-supported resolutions.CertificationsRelevant credentials such as CCNA, CCNP, ACP, PCNSE or equivalent firewall-vendor certification, CWNA, Security+, CISSP, AZ-700, or similar certifications are preferred. Advantages of Working at GSOCWorking at GSOC means more than just a job it's an opportunity to contribute to work that truly matters. Mission-Driven ImpactYour work supports secure, reliable corporate network services and cybersecurity capabilities used across GSOC's enterprise environment. Network Engineering & Cybersecurity DepthApply both network engineering and hands-on security expertise across switching, routing, wireless, firewalls, VPN, application delivery, monitoring, automation, and incident support. Technical Leadership & Continuous ImprovementLead technical projects, mentor peers, evaluate new technologies, automate repeatable work, and strengthen resilience, visibility, and operational supportability. Strong Values and Professional StandardsWork in an environment grounded in accountability, collaboration, integrity, security, compliance, and continuous improvement. Work Environment & BenefitsGSOC offers a professional, collaborative work environment with competitive compensation, comprehensive benefits, and a commitment to creating a respectful and inclusive workplace.Participation in an on-call rotation, emergency support, and scheduled maintenance outside normal business hours is required. Why Join GSOCAt GSOC, you will help engineer the network and security services that enable dependable business operations, secure access, security visibility, and resilient enterprise technology.You'll collaborate across infrastructure, cybersecurity, applications, service desk, and vendor teams while expanding your technical leadership and automation capabilities. Apply TodayIf you're ready to combine enterprise network engineering and cybersecurity expertise in a hands-on role supporting reliable, protected operations, we encourage you to apply. GSOC does not accept unsolicited resumes or candidate submissions from staffing agencies, search firms, or third-party recruiters. Any unsolicited resumes submitted without a valid, executed agreement will become the property of GSOC, and no placement fee will be paid. Job Posted by ApplicantPro
Job Description Job Description Overview WORK ENVIRONMENT The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of the job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions. Location: On-site, DISA Headquarters, 6914 Cooper Ave, Fort Meade, MD 20755 Type of environment: Office - on-site at a Government facility (classified environment) Noise level: Low to Medium Work schedule: Day shift Monday - Friday. May be requested to work evenings and weekends to meet program and contract needs. Amount of Travel: Less than 10%. Occasional travel within the National Capital Region and to up to four (4) conferences per year. WORK AUTHORIZATION/SECURITY CLEARANCE U.S. Citizen Secret Clearance PHYSICAL DEMANDS The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. While performing the duties of this job, the employee is regularly required to use hands to handle, feel, touch; reach with hands and arms; talk and hear. The employee is regularly required to stand; walk; sit; climb or balance; and stoop, kneel, crouch, or crawl. The employee is regularly required to lift up to 10 pounds. The employee is frequently required to lift up to 25 pounds; and up to 50 pounds. The vision requirements include close vision, distance vision, peripheral vision, depth perception, and ability to adjust focus. WAGE INFORMATION Target salary range: $100,000 - $16,000.00/yr. The salary range displayed is an estimate only and is not a guarantee of compensation or salary and will be determined on several factors regarding the individual's particular combination of education, knowledge, skills, competencies and experience, as well as contract parameters and organizational requirements. The displayed salary is one component of the total compensation package for employees. OTHER INFORMATION Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice. TekSynap is a drug-free workplace. We reserve the right to conduct drug testing in accordance with federal, state, and local laws. All employees and candidates may be subject to drug screening if deemed necessary to ensure a safe and compliant working environment. Many positions require specific certifications and/or the ability to obtain a security clearance. Security clearances may only be granted to U.S. citizens. Applicants who accept an offer of employment may be subject to investigations performed by TekSynap and/or the Government to verify the candidate meets the required qualifications and other eligibility requirements. Responsibilities We are seeking a PKI Subject Matter Expert - Cryptographic Modernization (PQC, Algorithm Evolution & NPE) - Key Personnel to join our team supporting the DISA PKI Public Key Enablement (PKE) Engineering Support Task Order (SETI Small Business) in Fort Meade, Maryland. REQUIRED QUALIFICATIONS Ten (10) or more years of hands-on PKI, cryptographic engineering, or cryptographic infrastructure experience, including at least five (5) years in DoD or federal high-security environments. Hands-on, low-level technical proficiency in cryptographic infrastructure and system integration within high-security environments, with demonstrated capability to engineer solutions for complex hardware and legacy software integrations. Demonstrated understanding of the mathematics, protocols, and hardware that drive public key cryptography. Practical, demonstrable knowledge of NIST post-quantum standards (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA) and the engineering steps to migrate production systems to quantum-safe states. Expertise automating certificate lifecycles for Non-Person Entities (routers, firewalls, microservices, Kubernetes) using automated certificate management protocols (ACME, EST). Hands-on experience with Hardware Security Modules (Entrust, Thales, SafeNet), key ceremonies, and HSM lifecycle or refresh activities. Experience with Certificate Authority platforms, preferably Red Hat Certificate System, including CA stand-up, configuration, and certificate profile management across classified and unclassified domains. Working knowledge of DoD PKI policy, DoDI 8520.02, STIG application, and the DoD PKI Authority to Operate (ATO) accreditation process. Familiarity with the DoD PKE custom tool suite (e.g., InstallRoot, FileSigner, CRL Auto Cache, PITT) and software development in C++, C#, Java, Python, or Rust is strongly preferred. Certifications Certification: DoD 8140 Cyber Workforce Qualification Program, IAT Level II, IAT Level III, IAM III or equivalent, required at time of assignment Education Education: Bachelor's degree in Computer Science, Cybersecurity, Mathematics, Engineering, or a related field. Master's degree preferred; equivalent demonstrated technical experience may be considered. Clearance Clearance: Active Secret clearance required. Must be onboard at the start of the Period of Performance. RESPONSIBILITIES Serve as the senior technical and cryptographic authority, the technical trust anchor for implementation, for algorithm evolution and Post-Quantum Cryptography across the DoD PKI Portfolio. Recommend approaches that steer the PKI program away from legacy, vulnerable cryptographic implementations. Develop and execute the plan to migrate DoD PKI to stronger cryptographic algorithms in accordance with NIST SP 800-131A Rev3 and the CNSA 2.0 PQC timeline, addressing encryption, digital signing, key agreement, key derivation, key wrapping, key transport, hash functions, and message authentication codes. Apply practical knowledge of NIST-standardized quantum-resistant algorithms, including ML-KEM and ML-DSA, and define the engineering steps required to transition existing systems to quantum-safe states. Maintain cryptographic agility across the portfolio in response to evolving NIST standards and Executive Order 14412, so algorithm changes are absorbed by configuration and re-test rather than re-architecture. Coordinate with COTS vendors (approximately 15 in the current ecosystem) to test feasibility and assess the timeliness of product transition plans; maintain the vendor tracking report and raise capability gaps to the coordination cell and Component CIOs. Develop and deploy PKE lab environments supporting Algorithm Evolution and PQC integration testing; document and report results to DoD working groups including the Certificate Validation Tiger Team. Evaluate HSM platforms for PQC readiness; HSM hardware refresh is within contract scope and the current environment uses Entrust HSMs. Provide Non-Person Entity (NPE) certificate management expertise, automating certificate lifecycles for routers, firewalls, microservices, and Kubernetes clusters using automated certificate management protocols such as EST and ACME. Support Certificate Authority Development, including CA architecture analysis, deficiency identification, Analysis of Alternatives development, and CA deployment across 42 NIPRNet and 31 SIPRNet Red Hat Certificate Authorities supporting approximately 10,000 certificate issuances per day. Provide input to CA deployment plans and develop and document Change Requests to modify software and hardware configurations, submitted through the PKI Configuration Management process and Remedy. Provide Tier III technical support for the most complex cryptographic and infrastructure issues, and review and update PKE enablement documentation as cryptographic changes are released. Qualifications TekSynap is a fast growing high-tech company that understands both the pace of technology today and the need to have a comprehensive well planned information management environment. "Technology moving at the speed of thought" embodies these principles - the need to nimbly utilize the best that information technology offers to meet the business needs of our Federal Government customers. Apply now to explore jobs with us at . We offer our full-time employees a competitive benefits package to include health, dental, vision, 401K, life insurance, short-term and long-term disability plans, vacation time and holidays. TekSynap is a drug-free workplace. We reserve the right to conduct drug testing in accordance with federal, state, and local laws. All employees and candidates may be subject to drug screening if deemed necessary to ensure a safe and compliant working environment. By applying to a role at TekSynap you are providing consent to receive text messages regarding your interview and employment status. If at any time you would like to opt out of text messaging, respond "STOP". As part of the application process, you agree that TekSynap Corporation may retain and use your name, e-mail, and contact information for purposes related to employment consideration. EQUAL EMPLOYMENT OPPORTUNITY . click apply for full job details
09/28/2026
Full time
Job Description Job Description Overview WORK ENVIRONMENT The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of the job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions. Location: On-site, DISA Headquarters, 6914 Cooper Ave, Fort Meade, MD 20755 Type of environment: Office - on-site at a Government facility (classified environment) Noise level: Low to Medium Work schedule: Day shift Monday - Friday. May be requested to work evenings and weekends to meet program and contract needs. Amount of Travel: Less than 10%. Occasional travel within the National Capital Region and to up to four (4) conferences per year. WORK AUTHORIZATION/SECURITY CLEARANCE U.S. Citizen Secret Clearance PHYSICAL DEMANDS The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. While performing the duties of this job, the employee is regularly required to use hands to handle, feel, touch; reach with hands and arms; talk and hear. The employee is regularly required to stand; walk; sit; climb or balance; and stoop, kneel, crouch, or crawl. The employee is regularly required to lift up to 10 pounds. The employee is frequently required to lift up to 25 pounds; and up to 50 pounds. The vision requirements include close vision, distance vision, peripheral vision, depth perception, and ability to adjust focus. WAGE INFORMATION Target salary range: $100,000 - $16,000.00/yr. The salary range displayed is an estimate only and is not a guarantee of compensation or salary and will be determined on several factors regarding the individual's particular combination of education, knowledge, skills, competencies and experience, as well as contract parameters and organizational requirements. The displayed salary is one component of the total compensation package for employees. OTHER INFORMATION Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice. TekSynap is a drug-free workplace. We reserve the right to conduct drug testing in accordance with federal, state, and local laws. All employees and candidates may be subject to drug screening if deemed necessary to ensure a safe and compliant working environment. Many positions require specific certifications and/or the ability to obtain a security clearance. Security clearances may only be granted to U.S. citizens. Applicants who accept an offer of employment may be subject to investigations performed by TekSynap and/or the Government to verify the candidate meets the required qualifications and other eligibility requirements. Responsibilities We are seeking a PKI Subject Matter Expert - Cryptographic Modernization (PQC, Algorithm Evolution & NPE) - Key Personnel to join our team supporting the DISA PKI Public Key Enablement (PKE) Engineering Support Task Order (SETI Small Business) in Fort Meade, Maryland. REQUIRED QUALIFICATIONS Ten (10) or more years of hands-on PKI, cryptographic engineering, or cryptographic infrastructure experience, including at least five (5) years in DoD or federal high-security environments. Hands-on, low-level technical proficiency in cryptographic infrastructure and system integration within high-security environments, with demonstrated capability to engineer solutions for complex hardware and legacy software integrations. Demonstrated understanding of the mathematics, protocols, and hardware that drive public key cryptography. Practical, demonstrable knowledge of NIST post-quantum standards (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA) and the engineering steps to migrate production systems to quantum-safe states. Expertise automating certificate lifecycles for Non-Person Entities (routers, firewalls, microservices, Kubernetes) using automated certificate management protocols (ACME, EST). Hands-on experience with Hardware Security Modules (Entrust, Thales, SafeNet), key ceremonies, and HSM lifecycle or refresh activities. Experience with Certificate Authority platforms, preferably Red Hat Certificate System, including CA stand-up, configuration, and certificate profile management across classified and unclassified domains. Working knowledge of DoD PKI policy, DoDI 8520.02, STIG application, and the DoD PKI Authority to Operate (ATO) accreditation process. Familiarity with the DoD PKE custom tool suite (e.g., InstallRoot, FileSigner, CRL Auto Cache, PITT) and software development in C++, C#, Java, Python, or Rust is strongly preferred. Certifications Certification: DoD 8140 Cyber Workforce Qualification Program, IAT Level II, IAT Level III, IAM III or equivalent, required at time of assignment Education Education: Bachelor's degree in Computer Science, Cybersecurity, Mathematics, Engineering, or a related field. Master's degree preferred; equivalent demonstrated technical experience may be considered. Clearance Clearance: Active Secret clearance required. Must be onboard at the start of the Period of Performance. RESPONSIBILITIES Serve as the senior technical and cryptographic authority, the technical trust anchor for implementation, for algorithm evolution and Post-Quantum Cryptography across the DoD PKI Portfolio. Recommend approaches that steer the PKI program away from legacy, vulnerable cryptographic implementations. Develop and execute the plan to migrate DoD PKI to stronger cryptographic algorithms in accordance with NIST SP 800-131A Rev3 and the CNSA 2.0 PQC timeline, addressing encryption, digital signing, key agreement, key derivation, key wrapping, key transport, hash functions, and message authentication codes. Apply practical knowledge of NIST-standardized quantum-resistant algorithms, including ML-KEM and ML-DSA, and define the engineering steps required to transition existing systems to quantum-safe states. Maintain cryptographic agility across the portfolio in response to evolving NIST standards and Executive Order 14412, so algorithm changes are absorbed by configuration and re-test rather than re-architecture. Coordinate with COTS vendors (approximately 15 in the current ecosystem) to test feasibility and assess the timeliness of product transition plans; maintain the vendor tracking report and raise capability gaps to the coordination cell and Component CIOs. Develop and deploy PKE lab environments supporting Algorithm Evolution and PQC integration testing; document and report results to DoD working groups including the Certificate Validation Tiger Team. Evaluate HSM platforms for PQC readiness; HSM hardware refresh is within contract scope and the current environment uses Entrust HSMs. Provide Non-Person Entity (NPE) certificate management expertise, automating certificate lifecycles for routers, firewalls, microservices, and Kubernetes clusters using automated certificate management protocols such as EST and ACME. Support Certificate Authority Development, including CA architecture analysis, deficiency identification, Analysis of Alternatives development, and CA deployment across 42 NIPRNet and 31 SIPRNet Red Hat Certificate Authorities supporting approximately 10,000 certificate issuances per day. Provide input to CA deployment plans and develop and document Change Requests to modify software and hardware configurations, submitted through the PKI Configuration Management process and Remedy. Provide Tier III technical support for the most complex cryptographic and infrastructure issues, and review and update PKE enablement documentation as cryptographic changes are released. Qualifications TekSynap is a fast growing high-tech company that understands both the pace of technology today and the need to have a comprehensive well planned information management environment. "Technology moving at the speed of thought" embodies these principles - the need to nimbly utilize the best that information technology offers to meet the business needs of our Federal Government customers. Apply now to explore jobs with us at . We offer our full-time employees a competitive benefits package to include health, dental, vision, 401K, life insurance, short-term and long-term disability plans, vacation time and holidays. TekSynap is a drug-free workplace. We reserve the right to conduct drug testing in accordance with federal, state, and local laws. All employees and candidates may be subject to drug screening if deemed necessary to ensure a safe and compliant working environment. By applying to a role at TekSynap you are providing consent to receive text messages regarding your interview and employment status. If at any time you would like to opt out of text messaging, respond "STOP". As part of the application process, you agree that TekSynap Corporation may retain and use your name, e-mail, and contact information for purposes related to employment consideration. EQUAL EMPLOYMENT OPPORTUNITY . click apply for full job details
Job Description Job Description Lead Firewall EngineerClearance: Active TS/SCIExperience: 8+ yearsLead an enterprise boundary security team responsible for firewall operations, engineering, compliance, and modernization. You will provide technical direction, oversee complex troubleshooting, and support secure, reliable network performance.What You Will DoLead daily firewall operations, maintenance, troubleshooting, and project execution.Design and implement solutions using Palo Alto, Juniper SRX, and F5 technologies.Review network changes and assess operational and security impacts.Maintain secure configuration baselines, architecture diagrams, inventories, procedures, and technical documentation.Monitor performance, logs, software versions, and configuration drift.Lead compliance reviews, technical evaluations, and modernization efforts.Brief stakeholders and mentor engineering personnel.What You BringActive TS/SCI clearance with the ability to obtain and maintain a CI polygraph.At least eight years of network security experience, including five years supporting large enterprise networks.Experience leading a firewall or boundary security team.Advanced experience with Palo Alto, Juniper SRX, and F5 platforms.Strong knowledge of firewall policy, TLS/SSL, PKI, Kerberos, LDAP, Active Directory, SAML, OAuth, and network architecture.Experience with network design, implementation, cost estimates, and labor estimates.Current DoD 8140/8570 IAT Level II certification.Ability to obtain CSSP Infrastructure Support certification within 120 days.Availability for occasional evening or weekend work.Preferred QualificationsBachelor 's or master's degree in computer science, cybersecurity, network security, or a related field.F5, Juniper, or Palo Alto professional certification. Job Posted by ApplicantPro
09/28/2026
Full time
Job Description Job Description Lead Firewall EngineerClearance: Active TS/SCIExperience: 8+ yearsLead an enterprise boundary security team responsible for firewall operations, engineering, compliance, and modernization. You will provide technical direction, oversee complex troubleshooting, and support secure, reliable network performance.What You Will DoLead daily firewall operations, maintenance, troubleshooting, and project execution.Design and implement solutions using Palo Alto, Juniper SRX, and F5 technologies.Review network changes and assess operational and security impacts.Maintain secure configuration baselines, architecture diagrams, inventories, procedures, and technical documentation.Monitor performance, logs, software versions, and configuration drift.Lead compliance reviews, technical evaluations, and modernization efforts.Brief stakeholders and mentor engineering personnel.What You BringActive TS/SCI clearance with the ability to obtain and maintain a CI polygraph.At least eight years of network security experience, including five years supporting large enterprise networks.Experience leading a firewall or boundary security team.Advanced experience with Palo Alto, Juniper SRX, and F5 platforms.Strong knowledge of firewall policy, TLS/SSL, PKI, Kerberos, LDAP, Active Directory, SAML, OAuth, and network architecture.Experience with network design, implementation, cost estimates, and labor estimates.Current DoD 8140/8570 IAT Level II certification.Ability to obtain CSSP Infrastructure Support certification within 120 days.Availability for occasional evening or weekend work.Preferred QualificationsBachelor 's or master's degree in computer science, cybersecurity, network security, or a related field.F5, Juniper, or Palo Alto professional certification. Job Posted by ApplicantPro
Job Description Job Description Benefits: 401(k) 401(k) matching Dental insurance Health insurance Paid time off Profit sharing Training & development Tuition assistance Vision insurance Job Description SarelaTech is seeking an experienced Network Engineer (SME) to join our Integrated Information Technology Support Services (I3TS) team, who will support an extensive digital modernization program critical to Defense Threat Reduction Agency (DTRA) in Fort Belvoir, VA. The Network Engineer will work closely with the Leidos and Government technical leadership team to help drive innovation, growth, and efficiencies within the I3TS portfolio. Primary Responsibilities: The Commercial Solutions for Classified (CSfC) Network & Security Engineer will architect and operate secure, dual-layer cryptographic boundaries utilizing Cisco and Aruba IPsec/SSL VPNs and dynamic routing (BGP/OSPF) in strict compliance with NSA Capability Packages. In this role, you will author and tune Palo Alto NGFW security policies and IDS/IPS threat prevention signatures, implement enterprise network access control and 802.1X policies via Cisco ISE and Aruba ClearPass, integrate enterprise PKI/OCSP services and hardened NTP, and generate key engineering artifacts required for NSA CSfC PMO registration and compliance auditing. Architect, deploy, and maintain CSfC infrastructure operating within Black/Gray/Red networks. Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Mobile Access (MA), Multi-Sight (MSC) Capability Packages, with Campus Wireless LAN (WLAN) experience a bonus. Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates. Understanding of NIAP approved list and monitors for changes Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Capability Packages (MSC, MA, and CWLAN). Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates. Implement enterprise routing protocols (BGP, OSPF) alongside redundant outer and inner IPsec VPN tunnels across Cisco and Aruba appliances. Configure remote access SSL VPNs and ensure end-to-end traffic separation. Author, optimize, and audit Palo Alto Next-Generation Firewall (NGFW) security policies, App-ID, User-ID, and URL filtering. Configure and tune Palo Alto IDS/IPS threat signatures, anti-spyware, and vulnerability protection. Architect and manage Cisco Identity Services Engine (ISE) and Aruba ClearPass policy managers for 802.1X network access control, RADIUS/TACACS+ administration, posture assessment, and endpoint profiling. Integrate enterprise Public Key Infrastructure (PKI) components, managing X.509 certificate lifecycles, Certificate Authorities (CAs), CRL/OCSP validation, and hardened, authenticated Network Time Protocol (NTP) infrastructure. Prepare CSfC compliance artifacts, Key Management Plans (KMPs), Continuous Monitoring Plans (CMPs), and registration packages for NSA CSfC PMO submission. Required Qualifications: Bachelor's degree or higher in Computer Science, Information Technology, Engineering, Engineering Management, Management Information Systems, or related STEM degree program, and 12-15 years of relevant experience. Specific experience, education and training may be considered in lieu of degree. 12+ years of progressive network engineering experience within DoD/DoW, federal, or defense contractor enterprise environments Active TS/SCI Clearance Active DoD 8570.01-M / DoD 8140 IAT Level II or III baseline certification (e.g., Security+ CE, CySA+, CASP+, or CISSP). Active Computing Environment certification, including one or more of: Cisco CCNA, CCNP, Aruba ACSA or ACSP Proven expertise configuring Cisco (IOS-XE/ASR) and Aruba (Mobility Controllers/Gateways) IPsec and SSL VPNs, including IKEv2, Suite B/CNSA cryptography, and dynamic routing (BGP, OSPF). Demonstrated engineering experience with Palo Alto Networks firewalls (PAN-OS), Panorama central management, and advanced IDS/IPS inspection profiles. Hands-on deployment experience with both Cisco ISE and/or Aruba ClearPass implementing 802.1X, EAP-TLS authentication, and role-based access policies. Strong working knowledge of X.509 certificates, CA hierarchy integration, certificate revocation lists (CRLs), OCSP, and secure NTP stratum synchronization. Direct prior experience preparing and successfully registering NSA CSfC Capability Package solutions (Mobile Access, Multi-Site Connectivity, or Campus WLAN). Deep understanding of Commercial National Security Algorithm (CNSA) Suite requirements, post-quantum readiness considerations, and hardware security modules (HSMs). Familiarity with Ansible, for automating network device configuration backups, policy compliance checks, and certificate rotations. Certified in any of the following - Cisco CCNP/CCIE (Security or Enterprise), Palo Alto PCNSE, Aruba Certified ClearPass Expert (ACCX), or Aruba Certified Mobility Expert (ACMX).
09/28/2026
Full time
Job Description Job Description Benefits: 401(k) 401(k) matching Dental insurance Health insurance Paid time off Profit sharing Training & development Tuition assistance Vision insurance Job Description SarelaTech is seeking an experienced Network Engineer (SME) to join our Integrated Information Technology Support Services (I3TS) team, who will support an extensive digital modernization program critical to Defense Threat Reduction Agency (DTRA) in Fort Belvoir, VA. The Network Engineer will work closely with the Leidos and Government technical leadership team to help drive innovation, growth, and efficiencies within the I3TS portfolio. Primary Responsibilities: The Commercial Solutions for Classified (CSfC) Network & Security Engineer will architect and operate secure, dual-layer cryptographic boundaries utilizing Cisco and Aruba IPsec/SSL VPNs and dynamic routing (BGP/OSPF) in strict compliance with NSA Capability Packages. In this role, you will author and tune Palo Alto NGFW security policies and IDS/IPS threat prevention signatures, implement enterprise network access control and 802.1X policies via Cisco ISE and Aruba ClearPass, integrate enterprise PKI/OCSP services and hardened NTP, and generate key engineering artifacts required for NSA CSfC PMO registration and compliance auditing. Architect, deploy, and maintain CSfC infrastructure operating within Black/Gray/Red networks. Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Mobile Access (MA), Multi-Sight (MSC) Capability Packages, with Campus Wireless LAN (WLAN) experience a bonus. Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates. Understanding of NIAP approved list and monitors for changes Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Capability Packages (MSC, MA, and CWLAN). Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates. Implement enterprise routing protocols (BGP, OSPF) alongside redundant outer and inner IPsec VPN tunnels across Cisco and Aruba appliances. Configure remote access SSL VPNs and ensure end-to-end traffic separation. Author, optimize, and audit Palo Alto Next-Generation Firewall (NGFW) security policies, App-ID, User-ID, and URL filtering. Configure and tune Palo Alto IDS/IPS threat signatures, anti-spyware, and vulnerability protection. Architect and manage Cisco Identity Services Engine (ISE) and Aruba ClearPass policy managers for 802.1X network access control, RADIUS/TACACS+ administration, posture assessment, and endpoint profiling. Integrate enterprise Public Key Infrastructure (PKI) components, managing X.509 certificate lifecycles, Certificate Authorities (CAs), CRL/OCSP validation, and hardened, authenticated Network Time Protocol (NTP) infrastructure. Prepare CSfC compliance artifacts, Key Management Plans (KMPs), Continuous Monitoring Plans (CMPs), and registration packages for NSA CSfC PMO submission. Required Qualifications: Bachelor's degree or higher in Computer Science, Information Technology, Engineering, Engineering Management, Management Information Systems, or related STEM degree program, and 12-15 years of relevant experience. Specific experience, education and training may be considered in lieu of degree. 12+ years of progressive network engineering experience within DoD/DoW, federal, or defense contractor enterprise environments Active TS/SCI Clearance Active DoD 8570.01-M / DoD 8140 IAT Level II or III baseline certification (e.g., Security+ CE, CySA+, CASP+, or CISSP). Active Computing Environment certification, including one or more of: Cisco CCNA, CCNP, Aruba ACSA or ACSP Proven expertise configuring Cisco (IOS-XE/ASR) and Aruba (Mobility Controllers/Gateways) IPsec and SSL VPNs, including IKEv2, Suite B/CNSA cryptography, and dynamic routing (BGP, OSPF). Demonstrated engineering experience with Palo Alto Networks firewalls (PAN-OS), Panorama central management, and advanced IDS/IPS inspection profiles. Hands-on deployment experience with both Cisco ISE and/or Aruba ClearPass implementing 802.1X, EAP-TLS authentication, and role-based access policies. Strong working knowledge of X.509 certificates, CA hierarchy integration, certificate revocation lists (CRLs), OCSP, and secure NTP stratum synchronization. Direct prior experience preparing and successfully registering NSA CSfC Capability Package solutions (Mobile Access, Multi-Site Connectivity, or Campus WLAN). Deep understanding of Commercial National Security Algorithm (CNSA) Suite requirements, post-quantum readiness considerations, and hardware security modules (HSMs). Familiarity with Ansible, for automating network device configuration backups, policy compliance checks, and certificate rotations. Certified in any of the following - Cisco CCNP/CCIE (Security or Enterprise), Palo Alto PCNSE, Aruba Certified ClearPass Expert (ACCX), or Aruba Certified Mobility Expert (ACMX).
Job Description Job Description About Agile Defense At Agile Defense we know that action defines the outcome and new challenges require new solutions. That's why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next. Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility-leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation's vital interests. Requisition #: 1853 Job Title: Network Security Engineer Location: Suitland, MD Clearance Level: Public Trust Job Description Agile Defense is seeking a Senior Network Security Engineer to support the agency as it moves away from its legacy ForeScout CounterACT NAC/NAM system and adopts Cisco Identity Services Engine (ISE) as the new access control platform. The engineer will help configure and manage Cisco ISE across the environment, handling AAA services, wired and wireless 802.1X authentication, device administration, and posture checks for users and devices. This role also supports the agency's modernization work by improving authentication processes, updating ISE policies, and strengthening identity-based access controls. The engineer will troubleshoot access issues, refine policy designs, and help ensure users and devices can connect securely and reliably as the organization completes its transition from ForeScout to Cisco ISE. Troubleshoot and resolve Cisco ISE issues across RADIUS, TACACS+, 802.1X, device administration, and endpoint authentication. Deploy, configure, and maintain Cisco ISE running on two clustered Cisco SNS 3715 appliances, ensuring high availability and consistent policy enforcement. Support the agency's migration from ForeScout CounterACT to Cisco ISE, including reviewing legacy ForeScout policies, device groups, and access rules and mapping them into ISE policy sets. Provide general wireless support, including basic troubleshooting, wireless access workflows, and coordination with wireless infrastructure teams. Configure and support Cisco ISE integrations with Cisco 9800 WLCs, including guest/registration portals, wireless onboarding, and policy driven access control. Integrate and maintain Cisco ISE with Active Directory (AD) and LDAP, including identity lookups, group based authorization, and directory based authentication workflows. Deploy, configure, and maintain Cisco ISE components, including: o Policy Sets, Authorization Profiles, and Authentication Rules o TACACS+ device administration o 802.1X for wired and wireless networks o Profiling, posture, and compliance policies o Certificate based authentication and PKI integrations Monitor security events using ISE logs, syslog, and performing root cause analysis for authentication and access issues. Manage identity integrations, enforce security policies, and tune configurations to support Zero Trust and improve user experience. Perform routine health checks, upgrades, migrations, and document changes through SOPs, engineering designs, and implementation procedures. Work closely with engineering, operations, and compliance teams while mentoring junior staff and contributing to knowledge sharing efforts. Education and Background Bachelor's degree in Information Technology, Cybersecurity, or a related field. Years of Experience Eight (8) years of experience in a large government organization with five (5) years in technical leadership, including four (4) years implementing and troubleshooting Cisco ISE. Four (4) years of experience supporting identity centric or Zero Trust architectures with strong knowledge of segmentation, certificate management, and endpoint posture controls. Required Skills Senior Network Security Engineer responsible for designing, configuring, monitoring, and troubleshooting Cisco ISE as a NAC/NAM platform, including TACACS+/RADIUS services, device administration policies, and wired/wireless 802.1X authentication. Eight (8) years of experience in a large government organization with five (5) years in technical leadership, including four (4) years implementing and troubleshooting Cisco ISE with expertise in: o Authentication and authorization policies (RADIUS/TACACS+) o 802.1X/EAP methods for wireless and wired access o Device profiling, posture checks, and endpoint compliance o Certificate based authentication (EAP TLS) and PKI integration o AAA integrations for switches, appliances, firewalls, and wireless controllers Experience working with Cisco ISE deployed on Cisco SNS 3715 appliances, preferably in a two node clustered, high availability setup. Understanding of ForeScout CounterACT, including legacy NAC/NAM policies, device classification, and access workflows, to support the migration to Cisco ISE Experience providing general wireless network support, including basic troubleshooting, controller interactions, and wireless access workflows. Hands on experience integrating Cisco ISE with Active Directory (AD) and LDAP, including identity lookups, group based policy decisions, and directory based authentication. Experience supporting Cisco ISE integrations with Cisco 9800 Wireless LAN Controllers, including guest/registration page redirection and wireless onboarding. Experience migrating legacy NAC, RADIUS, or device authentication systems into Cisco ISE while aligning with Zero Trust principles. Solid understanding of telecommunications, network security, and Zero Trust best practices. Strong communication skills with the ability to explain Cisco ISE, NAC/NAM, and AAA concepts to both technical and non technical audiences. Preferred Skills Preferred certifications: Cisco CCNP Security, Cisco ISE Specialist, or similar identity/security certifications. Working Conditions On-site 5 days a week in Suitland, Maryland In addition, Agile Defense invests in its employees beyond just compensation. Agile's benefits offerings include, dependent upon position, Health Insurance, Life Insurance, Paid Time Off, Holiday Pay, short-term and long-term Disability, Retirement and Learning and Development opportunities as well as other optional benefit elections. Our Core Values Employees of Agile Defense are our number one priority, and the importance we place on our culture here is fundamental. Our culture is alive and evolving, but it always stays true to its roots. Here, you are valued as a family member, and we believe that we can accomplish great things together. Agile Defense has been highly successful in the past few years due to our employees and the culture we create together. What makes us Agile? We call it the 6Hs, the values that define our culture and guide everything we do. Together, these values infuse vibrancy, integrity, and a tireless work ethic into advancing the most important national security and critical civilian missions. It's how we show up every day. It's who we are. Happy - Be Infectious. Happiness multiplies and creates a positive and connected environment where motivation and satisfaction have an outsized effect on everything we do. Helpful - Be Supportive. Being helpful is the foundation of teamwork, resulting in a supportive atmosphere where collaboration flourishes, and collective success is celebrated. Honest - Be Trustworthy. Honesty serves as our compass, ensuring transparent communication and ethical conduct, essential to who we are and the complex domains we support. Humble - Be Grounded. Success is not achieved alone, humility ensures a culture of mutual respect, encouraging open communication, and a willingness to learn from one another and take on any task. Hungry - Be Eager. Our hunger for excellence drives an insatiable appetite for innovation and continuous improvement, propelling us forward in the face of new and unprecedented challenges. Hustle - Be Driven. Hustle is reflected in our relentless work ethic, where we are each committed to going above and beyond to advance the mission and achieve success. Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
09/28/2026
Full time
Job Description Job Description About Agile Defense At Agile Defense we know that action defines the outcome and new challenges require new solutions. That's why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next. Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility-leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation's vital interests. Requisition #: 1853 Job Title: Network Security Engineer Location: Suitland, MD Clearance Level: Public Trust Job Description Agile Defense is seeking a Senior Network Security Engineer to support the agency as it moves away from its legacy ForeScout CounterACT NAC/NAM system and adopts Cisco Identity Services Engine (ISE) as the new access control platform. The engineer will help configure and manage Cisco ISE across the environment, handling AAA services, wired and wireless 802.1X authentication, device administration, and posture checks for users and devices. This role also supports the agency's modernization work by improving authentication processes, updating ISE policies, and strengthening identity-based access controls. The engineer will troubleshoot access issues, refine policy designs, and help ensure users and devices can connect securely and reliably as the organization completes its transition from ForeScout to Cisco ISE. Troubleshoot and resolve Cisco ISE issues across RADIUS, TACACS+, 802.1X, device administration, and endpoint authentication. Deploy, configure, and maintain Cisco ISE running on two clustered Cisco SNS 3715 appliances, ensuring high availability and consistent policy enforcement. Support the agency's migration from ForeScout CounterACT to Cisco ISE, including reviewing legacy ForeScout policies, device groups, and access rules and mapping them into ISE policy sets. Provide general wireless support, including basic troubleshooting, wireless access workflows, and coordination with wireless infrastructure teams. Configure and support Cisco ISE integrations with Cisco 9800 WLCs, including guest/registration portals, wireless onboarding, and policy driven access control. Integrate and maintain Cisco ISE with Active Directory (AD) and LDAP, including identity lookups, group based authorization, and directory based authentication workflows. Deploy, configure, and maintain Cisco ISE components, including: o Policy Sets, Authorization Profiles, and Authentication Rules o TACACS+ device administration o 802.1X for wired and wireless networks o Profiling, posture, and compliance policies o Certificate based authentication and PKI integrations Monitor security events using ISE logs, syslog, and performing root cause analysis for authentication and access issues. Manage identity integrations, enforce security policies, and tune configurations to support Zero Trust and improve user experience. Perform routine health checks, upgrades, migrations, and document changes through SOPs, engineering designs, and implementation procedures. Work closely with engineering, operations, and compliance teams while mentoring junior staff and contributing to knowledge sharing efforts. Education and Background Bachelor's degree in Information Technology, Cybersecurity, or a related field. Years of Experience Eight (8) years of experience in a large government organization with five (5) years in technical leadership, including four (4) years implementing and troubleshooting Cisco ISE. Four (4) years of experience supporting identity centric or Zero Trust architectures with strong knowledge of segmentation, certificate management, and endpoint posture controls. Required Skills Senior Network Security Engineer responsible for designing, configuring, monitoring, and troubleshooting Cisco ISE as a NAC/NAM platform, including TACACS+/RADIUS services, device administration policies, and wired/wireless 802.1X authentication. Eight (8) years of experience in a large government organization with five (5) years in technical leadership, including four (4) years implementing and troubleshooting Cisco ISE with expertise in: o Authentication and authorization policies (RADIUS/TACACS+) o 802.1X/EAP methods for wireless and wired access o Device profiling, posture checks, and endpoint compliance o Certificate based authentication (EAP TLS) and PKI integration o AAA integrations for switches, appliances, firewalls, and wireless controllers Experience working with Cisco ISE deployed on Cisco SNS 3715 appliances, preferably in a two node clustered, high availability setup. Understanding of ForeScout CounterACT, including legacy NAC/NAM policies, device classification, and access workflows, to support the migration to Cisco ISE Experience providing general wireless network support, including basic troubleshooting, controller interactions, and wireless access workflows. Hands on experience integrating Cisco ISE with Active Directory (AD) and LDAP, including identity lookups, group based policy decisions, and directory based authentication. Experience supporting Cisco ISE integrations with Cisco 9800 Wireless LAN Controllers, including guest/registration page redirection and wireless onboarding. Experience migrating legacy NAC, RADIUS, or device authentication systems into Cisco ISE while aligning with Zero Trust principles. Solid understanding of telecommunications, network security, and Zero Trust best practices. Strong communication skills with the ability to explain Cisco ISE, NAC/NAM, and AAA concepts to both technical and non technical audiences. Preferred Skills Preferred certifications: Cisco CCNP Security, Cisco ISE Specialist, or similar identity/security certifications. Working Conditions On-site 5 days a week in Suitland, Maryland In addition, Agile Defense invests in its employees beyond just compensation. Agile's benefits offerings include, dependent upon position, Health Insurance, Life Insurance, Paid Time Off, Holiday Pay, short-term and long-term Disability, Retirement and Learning and Development opportunities as well as other optional benefit elections. Our Core Values Employees of Agile Defense are our number one priority, and the importance we place on our culture here is fundamental. Our culture is alive and evolving, but it always stays true to its roots. Here, you are valued as a family member, and we believe that we can accomplish great things together. Agile Defense has been highly successful in the past few years due to our employees and the culture we create together. What makes us Agile? We call it the 6Hs, the values that define our culture and guide everything we do. Together, these values infuse vibrancy, integrity, and a tireless work ethic into advancing the most important national security and critical civilian missions. It's how we show up every day. It's who we are. Happy - Be Infectious. Happiness multiplies and creates a positive and connected environment where motivation and satisfaction have an outsized effect on everything we do. Helpful - Be Supportive. Being helpful is the foundation of teamwork, resulting in a supportive atmosphere where collaboration flourishes, and collective success is celebrated. Honest - Be Trustworthy. Honesty serves as our compass, ensuring transparent communication and ethical conduct, essential to who we are and the complex domains we support. Humble - Be Grounded. Success is not achieved alone, humility ensures a culture of mutual respect, encouraging open communication, and a willingness to learn from one another and take on any task. Hungry - Be Eager. Our hunger for excellence drives an insatiable appetite for innovation and continuous improvement, propelling us forward in the face of new and unprecedented challenges. Hustle - Be Driven. Hustle is reflected in our relentless work ethic, where we are each committed to going above and beyond to advance the mission and achieve success. Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
Job Description Job Description Description: MDVIP: Transforming Primary Care, One Patient at a Time MDVIP is a national leader in personalized healthcare, empowering over 425,000 members to achieve their health and wellness goals through a network of more than 1,400 concierge primary care physicians. Our program emphasizes preventive medicine, offering comprehensive screenings, advanced diagnostics, and individualized wellness plans. Recognized as a Great Place to Work since 2018, MDVIP is committed to excellence in patient care and employee satisfaction. Position Summary The Network Security Engineer is an individual contributor role reporting to the Sr. Network Operations Manager. This is a contract-to-perm position (6-month contract), based in Boca Raton, FL (Hybrid), supporting the Boca Raton and Atlanta (ATL) data centers. This role provides dedicated engineering capacity for the ownership, hardening, and reliability of the organization's on-premises and hybrid infrastructure. The Network Security Engineer sustains a predictable remediation cadence across recurring security obligations - including monthly patching, zero-day response, vulnerability remediation, OS hardening, and cloud security score - while maintaining core platform services that underpin 24/7 operational reliability. This role is critical to reducing key-person risk, closing the capacity gap between rising compliance/audit workloads and existing staffing, and ensuring remediation tied to penetration tests, annual Security Risk Assessments (SRAs), and HIPAA assessments is completed on schedule. Key Responsibilities Security Remediation & Compliance Execute remediation for findings from penetration tests, annual Security Risk Assessments (SRAs), and HIPAA assessments, ensuring items are tracked to closure within defined SLAs; work with Project Managers, technology stack owners, and third-party resources to ensure timely delivery. Lead monthly patching cycles and rapid zero-day response across on-prem and hybrid server environments. Apply security remediations on infrastructure appliances including Cisco switches, firewalls (Palo Alto, Fortinet, Cisco Meraki), Linux appliances, and the virtual server environment and SANs (VMware, vSphere). Perform vulnerability remediation and OS/system hardening in line with established security baselines and audit requirements. Maintain a remediation burndown and support reporting on patch/vulnerability KPIs, including critical remediation timelines and cloud security score. Core Platform & Infrastructure Ownership Track Azure Security Score trends and drive remediation of flagged recommendations, providing regular posture reporting to leadership and audit stakeholders. Manage the full PKI infrastructure/SSL certificate lifecycle, including issuance, renewal, tracking, and remediation of expiring or non-compliant certificates, and manage key vault rotations for critical cloud-hosted applications. Utilize automation tools to deploy required machine certificates across the organization. Manage syslog retention and forwarding across on-premises and cloud infrastructure, supporting the Security team's SIEM ingestion, correlation, and compliance reporting needs. Administer network micro-segmentation using Illumio, including policy design, enforcement, and ongoing tuning. Review and administer security tools to harden network edge security, including next generation firewalls, SD-WAN, and switching, striving for zero trust networks. Manage wireless security, including network access control (NAC), utilizing Cisco wireless and HPE Aruba ClearPass. Administer Identity and Access Management/Privileged Access Management (IAM/PAM) using BeyondTrust for remote server access, including access reviews and privileged session controls. Manage and review Azure RBAC roles and access privileges, and perform Active Directory hardening in compliance with discovered vulnerabilities and best practices. Review and secure SDLC servers and hosted applications, both on-premises and in Azure, applying measures to keep all public endpoints secure. Operational Reliability & Risk Reduction Balance day-to-day operational demands (SSL renewals/rotations, security remediation, configuration hardening, troubleshooting) with planned, time-bound deliverables. Identify and reduce single-point-of-failure risk by documenting procedures and cross-training across PKI, AD, cloud access, segmentation, and patching functions. Partner with the Azure DevOps and Security teams to align on-prem/hybrid remediation with broader cloud governance and security initiatives. Escalate emerging risks, audit exceptions, and outage-driving conflicts between operational and remediation priorities to leadership. Key Competencies Analytical: synthesizes complex or diverse technical information, using intuition and experience to complement data. Collaboration: openly partners with security operations, DevOps, and business stakeholders, valuing diverse perspectives and building productive relationships. Communication: listens and responds effectively to stakeholder needs; writes and speaks clearly and persuasively. Initiative and personal accountability: identifies and creates solutions independently, sets and meets deadlines, and reports timely and prepared. Problem solving/decision making: thinks strategically, drawing on diverse sources to identify issues, risks, and trends and determine optimal, timely solutions. Strong troubleshooting skills and the ability to manage competing priorities between reactive operational work and scheduled remediation projects. Ability to support 24/7 platform reliability, including scheduled evening and weekend work for monthly patching cycles, zero-day response, and maintenance outside normal business hours. Ability to travel periodically between the Boca Raton, FL and Atlanta (ATL) data centers as needed. Requirements: Qualifications Required Qualifications Bachelor's degree in Computer Science, Information Security, or a related field; at least five (5) years of related business experience in network security, systems engineering, or infrastructure operations in an enterprise environment, or an equivalent combination of education and professional experience. Hands-on experience with both on-premises and cloud infrastructure platforms, including vulnerability management, patch management, and OS hardening across Windows and/or Linux server environments. Experience with PKI/SSL certificate lifecycle management and IAM/PAM tools (e.g., BeyondTrust or equivalent). Experience partnering with security operations/SIEM teams to onboard new log sources and ensure reliable syslog delivery from network infrastructure. Working knowledge of hybrid Active Directory/Microsoft Entra ID environments and familiarity with network segmentation concepts and tools (e.g., Illumio or comparable micro-segmentation platforms). Experience supporting audit and compliance remediation cycles, such as HIPAA assessments, SRAs, or penetration test findings. Proficiency with firewalls and network security appliances (Palo Alto, Fortinet, Cisco Meraki, Cisco switches), SD-WAN/next-generation firewall administration, and wireless security/NAC (Cisco wireless, HPE Aruba ClearPass). This is a hybrid role based in Boca Raton, FL, with periodic on-site support required at the Boca Raton and Atlanta (ATL) data centers. At no time may work be performed, or computer systems accessed, from outside of the U.S. Preferred Qualifications Vendor-specific certifications, Microsoft Azure, Security+, CISSP, GIAC, or an equivalent security certification. Scripting/automation experience (e.g., PowerShell) for remediation and hardening tasks. Why Join MDVIP? Be part of a mission-driven organization leading innovation in personalized healthcare. Drive transformation and growth in a dynamic, fast-paced environment. Competitive Compensation: Attractive base salary complemented by performance-based incentives. Comprehensive Benefits: Health, dental, vision insurance, and retirement plans. Professional Development: Access to ongoing training and leadership development programs. Positive Work Environment: Consistently recognized as a Great Place to Work , fostering a culture of collaboration and excellence. MDVIP is an Equal Opportunity Employer and is committed to fostering an inclusive and diverse workplace. We welcome applicants of all backgrounds and do not discriminate based on race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, veteran status, or any other protected status. We believe that diversity and inclusion drive innovation and strengthen our company culture. If you require accommodations during the application or interview process, please let us know, and we will be happy to assist. Pay Transparency: Our compensation reflects the cost of labor across appropriate US geographic markets. Pay is based on several factors including but not limited to market location and may vary depending on job-related knowledge, skills, and education/training and a candidate's work experience. Hired applicants are offered annual incentive compensation programs, subject to applicable eligibility requirements . click apply for full job details
09/28/2026
Full time
Job Description Job Description Description: MDVIP: Transforming Primary Care, One Patient at a Time MDVIP is a national leader in personalized healthcare, empowering over 425,000 members to achieve their health and wellness goals through a network of more than 1,400 concierge primary care physicians. Our program emphasizes preventive medicine, offering comprehensive screenings, advanced diagnostics, and individualized wellness plans. Recognized as a Great Place to Work since 2018, MDVIP is committed to excellence in patient care and employee satisfaction. Position Summary The Network Security Engineer is an individual contributor role reporting to the Sr. Network Operations Manager. This is a contract-to-perm position (6-month contract), based in Boca Raton, FL (Hybrid), supporting the Boca Raton and Atlanta (ATL) data centers. This role provides dedicated engineering capacity for the ownership, hardening, and reliability of the organization's on-premises and hybrid infrastructure. The Network Security Engineer sustains a predictable remediation cadence across recurring security obligations - including monthly patching, zero-day response, vulnerability remediation, OS hardening, and cloud security score - while maintaining core platform services that underpin 24/7 operational reliability. This role is critical to reducing key-person risk, closing the capacity gap between rising compliance/audit workloads and existing staffing, and ensuring remediation tied to penetration tests, annual Security Risk Assessments (SRAs), and HIPAA assessments is completed on schedule. Key Responsibilities Security Remediation & Compliance Execute remediation for findings from penetration tests, annual Security Risk Assessments (SRAs), and HIPAA assessments, ensuring items are tracked to closure within defined SLAs; work with Project Managers, technology stack owners, and third-party resources to ensure timely delivery. Lead monthly patching cycles and rapid zero-day response across on-prem and hybrid server environments. Apply security remediations on infrastructure appliances including Cisco switches, firewalls (Palo Alto, Fortinet, Cisco Meraki), Linux appliances, and the virtual server environment and SANs (VMware, vSphere). Perform vulnerability remediation and OS/system hardening in line with established security baselines and audit requirements. Maintain a remediation burndown and support reporting on patch/vulnerability KPIs, including critical remediation timelines and cloud security score. Core Platform & Infrastructure Ownership Track Azure Security Score trends and drive remediation of flagged recommendations, providing regular posture reporting to leadership and audit stakeholders. Manage the full PKI infrastructure/SSL certificate lifecycle, including issuance, renewal, tracking, and remediation of expiring or non-compliant certificates, and manage key vault rotations for critical cloud-hosted applications. Utilize automation tools to deploy required machine certificates across the organization. Manage syslog retention and forwarding across on-premises and cloud infrastructure, supporting the Security team's SIEM ingestion, correlation, and compliance reporting needs. Administer network micro-segmentation using Illumio, including policy design, enforcement, and ongoing tuning. Review and administer security tools to harden network edge security, including next generation firewalls, SD-WAN, and switching, striving for zero trust networks. Manage wireless security, including network access control (NAC), utilizing Cisco wireless and HPE Aruba ClearPass. Administer Identity and Access Management/Privileged Access Management (IAM/PAM) using BeyondTrust for remote server access, including access reviews and privileged session controls. Manage and review Azure RBAC roles and access privileges, and perform Active Directory hardening in compliance with discovered vulnerabilities and best practices. Review and secure SDLC servers and hosted applications, both on-premises and in Azure, applying measures to keep all public endpoints secure. Operational Reliability & Risk Reduction Balance day-to-day operational demands (SSL renewals/rotations, security remediation, configuration hardening, troubleshooting) with planned, time-bound deliverables. Identify and reduce single-point-of-failure risk by documenting procedures and cross-training across PKI, AD, cloud access, segmentation, and patching functions. Partner with the Azure DevOps and Security teams to align on-prem/hybrid remediation with broader cloud governance and security initiatives. Escalate emerging risks, audit exceptions, and outage-driving conflicts between operational and remediation priorities to leadership. Key Competencies Analytical: synthesizes complex or diverse technical information, using intuition and experience to complement data. Collaboration: openly partners with security operations, DevOps, and business stakeholders, valuing diverse perspectives and building productive relationships. Communication: listens and responds effectively to stakeholder needs; writes and speaks clearly and persuasively. Initiative and personal accountability: identifies and creates solutions independently, sets and meets deadlines, and reports timely and prepared. Problem solving/decision making: thinks strategically, drawing on diverse sources to identify issues, risks, and trends and determine optimal, timely solutions. Strong troubleshooting skills and the ability to manage competing priorities between reactive operational work and scheduled remediation projects. Ability to support 24/7 platform reliability, including scheduled evening and weekend work for monthly patching cycles, zero-day response, and maintenance outside normal business hours. Ability to travel periodically between the Boca Raton, FL and Atlanta (ATL) data centers as needed. Requirements: Qualifications Required Qualifications Bachelor's degree in Computer Science, Information Security, or a related field; at least five (5) years of related business experience in network security, systems engineering, or infrastructure operations in an enterprise environment, or an equivalent combination of education and professional experience. Hands-on experience with both on-premises and cloud infrastructure platforms, including vulnerability management, patch management, and OS hardening across Windows and/or Linux server environments. Experience with PKI/SSL certificate lifecycle management and IAM/PAM tools (e.g., BeyondTrust or equivalent). Experience partnering with security operations/SIEM teams to onboard new log sources and ensure reliable syslog delivery from network infrastructure. Working knowledge of hybrid Active Directory/Microsoft Entra ID environments and familiarity with network segmentation concepts and tools (e.g., Illumio or comparable micro-segmentation platforms). Experience supporting audit and compliance remediation cycles, such as HIPAA assessments, SRAs, or penetration test findings. Proficiency with firewalls and network security appliances (Palo Alto, Fortinet, Cisco Meraki, Cisco switches), SD-WAN/next-generation firewall administration, and wireless security/NAC (Cisco wireless, HPE Aruba ClearPass). This is a hybrid role based in Boca Raton, FL, with periodic on-site support required at the Boca Raton and Atlanta (ATL) data centers. At no time may work be performed, or computer systems accessed, from outside of the U.S. Preferred Qualifications Vendor-specific certifications, Microsoft Azure, Security+, CISSP, GIAC, or an equivalent security certification. Scripting/automation experience (e.g., PowerShell) for remediation and hardening tasks. Why Join MDVIP? Be part of a mission-driven organization leading innovation in personalized healthcare. Drive transformation and growth in a dynamic, fast-paced environment. Competitive Compensation: Attractive base salary complemented by performance-based incentives. Comprehensive Benefits: Health, dental, vision insurance, and retirement plans. Professional Development: Access to ongoing training and leadership development programs. Positive Work Environment: Consistently recognized as a Great Place to Work , fostering a culture of collaboration and excellence. MDVIP is an Equal Opportunity Employer and is committed to fostering an inclusive and diverse workplace. We welcome applicants of all backgrounds and do not discriminate based on race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, veteran status, or any other protected status. We believe that diversity and inclusion drive innovation and strengthen our company culture. If you require accommodations during the application or interview process, please let us know, and we will be happy to assist. Pay Transparency: Our compensation reflects the cost of labor across appropriate US geographic markets. Pay is based on several factors including but not limited to market location and may vary depending on job-related knowledge, skills, and education/training and a candidate's work experience. Hired applicants are offered annual incentive compensation programs, subject to applicable eligibility requirements . click apply for full job details
Job Description Job Description About the Company : Sungrow North America is a leading provider of renewable energy solutions, specializing in the development and manufacturing of photovoltaic inverters and energy storage systems. The company offers a comprehensive range of products and services designed to optimize the performance and efficiency of solar power installations. Sungrow North America aims to provide sustainable and reliable energy solutions to meet the growing demand for clean power and is known for its commitment to innovation, high-quality standards, and exceptional customer service. Security Engineer - Network & Identity: The Security Engineer (Network & Identity) is a hands-on engineering role within the IT team responsible for designing, implementing, securing, and automating Sungrow USA's network security, PKI and certificate management, and identity & access infrastructure across on-premises, cloud, and SaaS environments. This role serves as the technical owner for network security architecture, cryptographic services, certificate lifecycle management, authentication, and access controls. The position focuses on Zero Trust security, network segmentation, certificate-based authentication, and identity protection to reduce organizational risk and enable secure business operations and platform ownership rather than SOC operations, threat monitoring, or incident response. Essential Duties and Responsibilities: Network Security Design, implement, and maintain secure enterprise network architectures across corporate offices, data centers, cloud platforms, and remote workforce environments. Architect network segmentation, Zero Trust access controls, and secure connectivity standards using Fortinet and Zscaler security solutions. Develop and maintain Zero Trust architectures across network, identity, endpoint, application, and cloud environments. Design and administer secure remote access using Zscaler Private Access, VPN technologies, and identity-aware access controls. Manage firewall policies, network security controls, routing security, DNS security, and hybrid-cloud connectivity. Design and support Network Access Control architectures using IEEE 802.1X, RADIUS, and certificate-based authentication. Assess network security posture, develop remediation plans, and drive continuous security improvements. Cryptography, PKI & Certificate Management Own the enterprise PKI, cryptography, and certificate lifecycle management architecture, standards, and governance program. Design and manage certificate-based authentication and machine identity solutions for users, devices, servers, applications, cloud workloads, and network infrastructure across Azure, AWS, and hybrid environments. Implement and maintain certificate lifecycle automation using Microsoft Cloud PKI, Keyfactor, CyberArk Certificate Manager, EJBCA, DigiCert, AppViewX, or comparable platforms. Manage certificate issuance, enrollment, discovery, deployment, monitoring, renewal, revocation, auditing, and compliance across the enterprise. Design and support cryptographic services and certificate-based security controls, including TLS/mTLS, code signing, PKI trust hierarchies, certificate-based authentication, SCEP, PKCS, and machine identities. Establish PKI and cryptographic standards, key management practices, and security controls to support Zero Trust, regulatory compliance, and enterprise security requirements. Troubleshoot and resolve complex certificate, cryptographic, trust chain, authentication, and secure communications issues across enterprise systems and applications. Identity & Access Define authentication and authorization standards for workforce, partner, application, service, and machine identities. Design, implement, and maintain Microsoft Entra ID architecture, tenant governance, and identity security controls. Develop, test, and enforce Conditional Access policies and Zero Trust access controls. Implement and maintain MFA, passwordless authentication, phishing-resistant authentication, and Microsoft Entra ID Protection capabilities. Design and support enterprise SSO and federation integrations using SAML, OAuth 2.0, OpenID Connect, and SCIM. Implement least-privilege and risk-based access models across enterprise platforms. Administer RBAC, administrative separation, Microsoft Entra Privileged Identity Management, and least-privilege access controls. Govern application registrations, service principals, enterprise applications, API permissions, and managed identities. Support B2B collaboration, guest-user governance, external workforce access, and third-party identity integrations. Design and implement security controls across Microsoft Azure and AWS environments. Apply least privilege, RBAC, encryption, secrets management, and secure configuration standards to on-prem and cloud resources. Automate identity provisioning and deprovisioning, access governance, certificate management, configuration validation, and security operations. Create reusable secure-by-default templates and reduce manual administration through automation and orchestration Conduct access reviews, entitlement certifications, and identity governance activities. Education or Desired License and Certificates: Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field, or equivalent professional experience. Microsoft Certified: Identity and Access Administrator Associate (SC-300) preferred. Microsoft Certified: Azure Security Engineer Associate (AZ-500) preferred. CCNA, Fortinet, Zscaler, AWS Security, CISSP, CISM, Terraform, or relevant PKI certification preferred Preferred Experience & Qualifications: 5+ years of experience in security engineering, identity & access management (IAM), network security, cloud security, or a related enterprise IT discipline. Hands-on experience with Microsoft Entra ID, including Conditional Access, MFA, SSO, Identity Protection, PIM, RBAC, identity governance, and modern authentication protocols (SAML, OAuth, OpenID Connect, SCIM). Experience designing, implementing, and securing enterprise identity, privileged access, and machine identity solutions across hybrid and multi-cloud environments. Hands-on experience with Fortinet, Zscaler (ZIA/ZPA), Zero Trust architectures, least-privilege access models, and network security controls. Experience designing and operating enterprise PKI, certificate lifecycle management, certificate-based authentication, and machine identity platforms such as Keyfactor, DigiCert, EJBCA, AppViewX, CyberArk Certificate Manager, or similar solutions. Experience securing Azure and AWS environments, including identity, networking, encryption, secrets management, logging, and security monitoring. Experience with PAM and IGA platforms such as CyberArk, Delinea, BeyondTrust, SailPoint, Saviynt, or similar technologies. Experience integrating identity, network, cloud, and security telemetry with SIEM and security operations platforms. Strong automation and Infrastructure as Code skills using PowerShell, Python, Microsoft Graph API, REST APIs, Terraform, or similar technologies. Strong troubleshooting skills across authentication, federation, certificates, PKI, network security, cloud access, application integrations, and enterprise identity services. Knowledge of cybersecurity and compliance frameworks including SOC 2, ISO/IEC 27001, NIST CSF, NIST 800-63, CIS Controls, Zero Trust, and NERC CIP. Competencies: Mandarin fluency preferred but not required. Strong analytical, troubleshooting, and problem-solving skills. Ability to work independently and collaboratively in a fast-paced environment. Excellent communication, stakeholder management, and technical documentation skills. Strong organization, attention to detail, initiative, and ownership. Ability to balance security, reliability, usability, scalability, and business requirements. Proactive approach to automation, standardization, and continuous improvement. Travel 5%-20% Work Location and Status: Full time, Hybrid at any Sungrow USA office in Phoenix, Costa Mesa, or Houston No visa sponsorship Compensation: Compensation commensurate with experience Competitive salary and annual bonus eligibility Comprehensive benefits package including health, dental, vision, and retirement plans Strong personal and company growth opportunities Sungrow is an equal opportunity employer. Due to strong interest in this position, Sungrow will only reach out to those candidates who best meet the requirements. Thank you for your interest in Sungrow.
09/28/2026
Full time
Job Description Job Description About the Company : Sungrow North America is a leading provider of renewable energy solutions, specializing in the development and manufacturing of photovoltaic inverters and energy storage systems. The company offers a comprehensive range of products and services designed to optimize the performance and efficiency of solar power installations. Sungrow North America aims to provide sustainable and reliable energy solutions to meet the growing demand for clean power and is known for its commitment to innovation, high-quality standards, and exceptional customer service. Security Engineer - Network & Identity: The Security Engineer (Network & Identity) is a hands-on engineering role within the IT team responsible for designing, implementing, securing, and automating Sungrow USA's network security, PKI and certificate management, and identity & access infrastructure across on-premises, cloud, and SaaS environments. This role serves as the technical owner for network security architecture, cryptographic services, certificate lifecycle management, authentication, and access controls. The position focuses on Zero Trust security, network segmentation, certificate-based authentication, and identity protection to reduce organizational risk and enable secure business operations and platform ownership rather than SOC operations, threat monitoring, or incident response. Essential Duties and Responsibilities: Network Security Design, implement, and maintain secure enterprise network architectures across corporate offices, data centers, cloud platforms, and remote workforce environments. Architect network segmentation, Zero Trust access controls, and secure connectivity standards using Fortinet and Zscaler security solutions. Develop and maintain Zero Trust architectures across network, identity, endpoint, application, and cloud environments. Design and administer secure remote access using Zscaler Private Access, VPN technologies, and identity-aware access controls. Manage firewall policies, network security controls, routing security, DNS security, and hybrid-cloud connectivity. Design and support Network Access Control architectures using IEEE 802.1X, RADIUS, and certificate-based authentication. Assess network security posture, develop remediation plans, and drive continuous security improvements. Cryptography, PKI & Certificate Management Own the enterprise PKI, cryptography, and certificate lifecycle management architecture, standards, and governance program. Design and manage certificate-based authentication and machine identity solutions for users, devices, servers, applications, cloud workloads, and network infrastructure across Azure, AWS, and hybrid environments. Implement and maintain certificate lifecycle automation using Microsoft Cloud PKI, Keyfactor, CyberArk Certificate Manager, EJBCA, DigiCert, AppViewX, or comparable platforms. Manage certificate issuance, enrollment, discovery, deployment, monitoring, renewal, revocation, auditing, and compliance across the enterprise. Design and support cryptographic services and certificate-based security controls, including TLS/mTLS, code signing, PKI trust hierarchies, certificate-based authentication, SCEP, PKCS, and machine identities. Establish PKI and cryptographic standards, key management practices, and security controls to support Zero Trust, regulatory compliance, and enterprise security requirements. Troubleshoot and resolve complex certificate, cryptographic, trust chain, authentication, and secure communications issues across enterprise systems and applications. Identity & Access Define authentication and authorization standards for workforce, partner, application, service, and machine identities. Design, implement, and maintain Microsoft Entra ID architecture, tenant governance, and identity security controls. Develop, test, and enforce Conditional Access policies and Zero Trust access controls. Implement and maintain MFA, passwordless authentication, phishing-resistant authentication, and Microsoft Entra ID Protection capabilities. Design and support enterprise SSO and federation integrations using SAML, OAuth 2.0, OpenID Connect, and SCIM. Implement least-privilege and risk-based access models across enterprise platforms. Administer RBAC, administrative separation, Microsoft Entra Privileged Identity Management, and least-privilege access controls. Govern application registrations, service principals, enterprise applications, API permissions, and managed identities. Support B2B collaboration, guest-user governance, external workforce access, and third-party identity integrations. Design and implement security controls across Microsoft Azure and AWS environments. Apply least privilege, RBAC, encryption, secrets management, and secure configuration standards to on-prem and cloud resources. Automate identity provisioning and deprovisioning, access governance, certificate management, configuration validation, and security operations. Create reusable secure-by-default templates and reduce manual administration through automation and orchestration Conduct access reviews, entitlement certifications, and identity governance activities. Education or Desired License and Certificates: Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field, or equivalent professional experience. Microsoft Certified: Identity and Access Administrator Associate (SC-300) preferred. Microsoft Certified: Azure Security Engineer Associate (AZ-500) preferred. CCNA, Fortinet, Zscaler, AWS Security, CISSP, CISM, Terraform, or relevant PKI certification preferred Preferred Experience & Qualifications: 5+ years of experience in security engineering, identity & access management (IAM), network security, cloud security, or a related enterprise IT discipline. Hands-on experience with Microsoft Entra ID, including Conditional Access, MFA, SSO, Identity Protection, PIM, RBAC, identity governance, and modern authentication protocols (SAML, OAuth, OpenID Connect, SCIM). Experience designing, implementing, and securing enterprise identity, privileged access, and machine identity solutions across hybrid and multi-cloud environments. Hands-on experience with Fortinet, Zscaler (ZIA/ZPA), Zero Trust architectures, least-privilege access models, and network security controls. Experience designing and operating enterprise PKI, certificate lifecycle management, certificate-based authentication, and machine identity platforms such as Keyfactor, DigiCert, EJBCA, AppViewX, CyberArk Certificate Manager, or similar solutions. Experience securing Azure and AWS environments, including identity, networking, encryption, secrets management, logging, and security monitoring. Experience with PAM and IGA platforms such as CyberArk, Delinea, BeyondTrust, SailPoint, Saviynt, or similar technologies. Experience integrating identity, network, cloud, and security telemetry with SIEM and security operations platforms. Strong automation and Infrastructure as Code skills using PowerShell, Python, Microsoft Graph API, REST APIs, Terraform, or similar technologies. Strong troubleshooting skills across authentication, federation, certificates, PKI, network security, cloud access, application integrations, and enterprise identity services. Knowledge of cybersecurity and compliance frameworks including SOC 2, ISO/IEC 27001, NIST CSF, NIST 800-63, CIS Controls, Zero Trust, and NERC CIP. Competencies: Mandarin fluency preferred but not required. Strong analytical, troubleshooting, and problem-solving skills. Ability to work independently and collaboratively in a fast-paced environment. Excellent communication, stakeholder management, and technical documentation skills. Strong organization, attention to detail, initiative, and ownership. Ability to balance security, reliability, usability, scalability, and business requirements. Proactive approach to automation, standardization, and continuous improvement. Travel 5%-20% Work Location and Status: Full time, Hybrid at any Sungrow USA office in Phoenix, Costa Mesa, or Houston No visa sponsorship Compensation: Compensation commensurate with experience Competitive salary and annual bonus eligibility Comprehensive benefits package including health, dental, vision, and retirement plans Strong personal and company growth opportunities Sungrow is an equal opportunity employer. Due to strong interest in this position, Sungrow will only reach out to those candidates who best meet the requirements. Thank you for your interest in Sungrow.
Job Description Job Description PALO ALTO FIREWALL ENGINEER Position Description Description This is an opening for a Firewall Engineer/Team Lead to support a Department of State (DoS) Bureau of Diplomatic Technology (DT) program. This program provides transparent, interconnected systems and security supporting the DoS in successfully carrying out its U.S. foreign policy mission. DT provides enterprise architecture design, engineering, operations and maintenance support services for servers, networks, firewalls, and enterprise applications across the Department. Program is named "Vanguard" and is an IT consolidation consisting of the Department's servers, mainframes, network devices, network perimeter, anti-virus engineering, public key infrastructure (PKI)/biometrics/encryption, monitoring tools, telephony, mobile computing platform, virtual environment, and enclave design/security engineering. This is a firewall engineer position within the Vanguard 2025 program, providing general Tier II monitoring, configuration, and support to multiple firewalls and perimeter security systems. The position directly supports DoS on-site to provide perimeter security protection to over 80,000 customers globally. This is a hybrid position based out of Beltsville, MD with 3 days on-site. Shift is MIDs (11:00pm-7:30am), Sun-Thurs after training. During the 6-8 week training period, it will be 5 days on-site Mon-Fri (7:00am-3:30pm). Your responsibilities will include: Provides Tier 2 support in the monitoring, management, and troubleshooting of perimeter devices to include firewalls, proxies, and mail transport agents. Along with being a Team Lead for the MID shift. As the Lead you will be expectant to give a turnover of events for the past shift, create weekly Quad Chart, and be able to direct work to other firewall operations staff. Must be able to guide other staff on tasks assigned to the team. Review request for time off and stay in touch with the manager on all events happening on the shift. Monitor Service Now application for Firewall Operations incident and service requests. Implements firewall rules and policies, perform troubleshoots of firewall, email, and Proxy platforms for performance issues. Analyzes network traffic captures. Escalates issues as required to Tier 3 staff and monitors issues throughout a problem's life cycle. Performs recurring maintenance activities such as device reboots and software upgrades on perimeter devices. Records and reports on firewall operations, utilization, and maintenance. Collaborate across Bureaus and Agencies to implement and repair network changes as they relate to perimeter security devices. Support Diplomatic Security Computer Incident Response Team (CIRT) by implementing block requests for IP's, Websites, and Email addresses. Update architecture diagrams using Visio. Monitor and perform health checks on multiple perimeter security devices. Draft, coordinate and publish outage notifications as required. Update shift logs and provide reports to leadership daily. Maintain standard operating procedures (SOP), work instructions, and other working documents. Attend weekly teleconferences, onsite meetings, and participate in working groups as required. Qualifications Required Education & Experience BA degree and 6 years of experience; may accept additional experience in lieu of degree. In Depth experience using Palo Alto Firewalls and Panorama monitoring tools to troubleshoot and configure a Firewall infrastructure. Strong understanding of networking, proxy, and packet filtering technologies. Minimum 5 years IT Customer Support experience (Tier I and/or Tier II). First-hand experience with supporting the monitoring and configuration of Firewall/DMZ infrastructure including Network and Application Firewall Packet Filtering technologies (StoneGate, Palo Alto, FortiGate, Azure Firewall, Cloudflare, Cisco Email Security Appliances (ESA), A10 proxy devices). CLI experience preferred. Experienced in utilizing network monitoring tools such as Nagios and NeuralStar. Basic Microsoft Windows Server 2016 implementation and troubleshooting from a security/firewall perspective. Experienced with TCP/IP network implementation and troubleshooting. Required Clearance US Citizenship. An Interim Secret clearance is required to start work and requires eligibility to obtain a Top Secret clearance. Powered by JazzHR ZpLPHj5F0L
09/28/2026
Full time
Job Description Job Description PALO ALTO FIREWALL ENGINEER Position Description Description This is an opening for a Firewall Engineer/Team Lead to support a Department of State (DoS) Bureau of Diplomatic Technology (DT) program. This program provides transparent, interconnected systems and security supporting the DoS in successfully carrying out its U.S. foreign policy mission. DT provides enterprise architecture design, engineering, operations and maintenance support services for servers, networks, firewalls, and enterprise applications across the Department. Program is named "Vanguard" and is an IT consolidation consisting of the Department's servers, mainframes, network devices, network perimeter, anti-virus engineering, public key infrastructure (PKI)/biometrics/encryption, monitoring tools, telephony, mobile computing platform, virtual environment, and enclave design/security engineering. This is a firewall engineer position within the Vanguard 2025 program, providing general Tier II monitoring, configuration, and support to multiple firewalls and perimeter security systems. The position directly supports DoS on-site to provide perimeter security protection to over 80,000 customers globally. This is a hybrid position based out of Beltsville, MD with 3 days on-site. Shift is MIDs (11:00pm-7:30am), Sun-Thurs after training. During the 6-8 week training period, it will be 5 days on-site Mon-Fri (7:00am-3:30pm). Your responsibilities will include: Provides Tier 2 support in the monitoring, management, and troubleshooting of perimeter devices to include firewalls, proxies, and mail transport agents. Along with being a Team Lead for the MID shift. As the Lead you will be expectant to give a turnover of events for the past shift, create weekly Quad Chart, and be able to direct work to other firewall operations staff. Must be able to guide other staff on tasks assigned to the team. Review request for time off and stay in touch with the manager on all events happening on the shift. Monitor Service Now application for Firewall Operations incident and service requests. Implements firewall rules and policies, perform troubleshoots of firewall, email, and Proxy platforms for performance issues. Analyzes network traffic captures. Escalates issues as required to Tier 3 staff and monitors issues throughout a problem's life cycle. Performs recurring maintenance activities such as device reboots and software upgrades on perimeter devices. Records and reports on firewall operations, utilization, and maintenance. Collaborate across Bureaus and Agencies to implement and repair network changes as they relate to perimeter security devices. Support Diplomatic Security Computer Incident Response Team (CIRT) by implementing block requests for IP's, Websites, and Email addresses. Update architecture diagrams using Visio. Monitor and perform health checks on multiple perimeter security devices. Draft, coordinate and publish outage notifications as required. Update shift logs and provide reports to leadership daily. Maintain standard operating procedures (SOP), work instructions, and other working documents. Attend weekly teleconferences, onsite meetings, and participate in working groups as required. Qualifications Required Education & Experience BA degree and 6 years of experience; may accept additional experience in lieu of degree. In Depth experience using Palo Alto Firewalls and Panorama monitoring tools to troubleshoot and configure a Firewall infrastructure. Strong understanding of networking, proxy, and packet filtering technologies. Minimum 5 years IT Customer Support experience (Tier I and/or Tier II). First-hand experience with supporting the monitoring and configuration of Firewall/DMZ infrastructure including Network and Application Firewall Packet Filtering technologies (StoneGate, Palo Alto, FortiGate, Azure Firewall, Cloudflare, Cisco Email Security Appliances (ESA), A10 proxy devices). CLI experience preferred. Experienced in utilizing network monitoring tools such as Nagios and NeuralStar. Basic Microsoft Windows Server 2016 implementation and troubleshooting from a security/firewall perspective. Experienced with TCP/IP network implementation and troubleshooting. Required Clearance US Citizenship. An Interim Secret clearance is required to start work and requires eligibility to obtain a Top Secret clearance. Powered by JazzHR ZpLPHj5F0L