Network Security Engineer

Cyber Security Engineer (NAC / C2C Lead)
Level / experience
Mid–Senior, 5–8 years in cybersecurity; 2+ years enforcing NAC policy in production
Location
Onsite at the base
Reports to
Engineering manager
Role summary
Hands-on engineer who configures and runs the C2C/NAC platform at the base: closes Step 1–3 gaps, builds and tunes policies, and executes Step 4 enforcement waves.
Key responsibilities
Close the remaining device discovery, classification, and interrogation gaps on the NAC platform.
Build and test posture checks and auto-remediation policies; validate on a pilot group before expanding.
Configure and validate integrations with ACAS, endpoint security/EDR, AD, SIEM, and ticketing.
Enable monitor mode, analyze failures, and tune policies before enforcement.
Execute enforcement waves with the network engineer; triage failures and roll back quickly when needed.
Identify, categorize, and document exception devices and support the base in getting waivers.
Document configurations, policies, and runbooks for handoff to base staff.
Required qualifications
Production experience administering and enforcing policy on a NAC platform (Forescout or Cisco ISE, matching the base) at scale of thousands of endpoints.
Solid understanding of 802.1X, MAB, RADIUS, Active Directory/GPO, and PKI/certificate deployment.
Familiar with STIGs, SCAP, ACAS/Tenable, and endpoint security tools.
Scripting or automation (PowerShell, Python, or REST APIs).
Comfortable working in a live DoD environment with strict change control.
Preferred qualifications
Experience on DoD/DISA C2C deployments.
Experience in a base NOC or with a base cyber/comm squadron.
Experience with SIEM/log analysis and troubleshooting user impact.
Certifications
Security+ (baseline)
CISSP, CEH, or CySA+ preferred
Forescout Certified Administrator/Engineer or Cisco ISE/CCNP Security
Network Engineer
Level / experience
Mid–Senior, 5–8 years in campus networking; 3+ years deploying 802.1X/MAB on wired and wireless
Location
Onsite at the base
Reports to
Engineering manager
Role summary
Owns the switching side of Step 4: builds and deploys 802.1X/MAB configurations across the base, validates them, and handles the network side of enforcement and rollback.
Key responsibilities
Review switch inventory, firmware, and configurations to determine 802.1X/MAB/CoA readiness; identify non-capable or end-of-life gear.
Build standard 802.1X/MAB configuration templates and deploy them building by building, with a rollback plan.
Handle special ports: IP phones with daisy-chained PCs, printers, IoT, and other devices needing MAB or exceptions.
Configure AAA/RADIUS/TACACS+, VLAN assignments (including quarantine/remediation), DHCP snooping, and related settings.
Support monitor mode and enforcement waves; troubleshoot connectivity problems in real time.
Configure wireless authentication where in scope.
Produce as-built documentation, config backups, and network diagrams updates.
Required qualifications
Hands-on 802.1X, MAB, and CoA deployment on wired and wireless in a production campus network.
Deep configuration and troubleshooting experience on the base’s switch vendor (commonly Cisco IOS/IOS-XE): AAA, VLANs, DHCP snooping, DAI, port security.
Experience with bulk configuration deployment and rollback across hundreds of switches (Ansible, Python/Netmiko, or a config management tool).
Comfortable working in network closets and executing changes in after-hours windows.
Preferred qualifications
Experience in a DoD or base network operations environment.
Wireless controller experience (802.1X SSIDs).
Network automation and monitoring tool experience.
Certifications
CCNP Enterprise or CCNP Security (preferred); CCNA minimum
Security+ (baseline)