Network Engineer

Client is seeking an experienced Network Engineer to design, secure, and operate the agency’s hybrid network across on-premise infrastructure and AWS as part of a major migration from on-premise systems to AWS. This role owns end-to-end connectivity for mission-critical state police systems spanning 500+ remote sites and applications including VCIN, CCH, and LiveScan while engineering the highly available site-to-site VPN and hybrid connectivity fabric that links VSP facilities, VITA and partner networks, and AWS. You will work closely with Infrastructure, Platform Engineering, and with state partners, to ensure all network components meet CJIS, COV, and FBI security requirements. Hybrid Network Operations & Secure Connectivity Maintain a stable, resilient, and secured network across 500+ remote offices, ensuring reliable connectivity for mission-critical state police applications (VCIN, CCH, LiveScan, and similar). Govern ACLs, routing policies, and device configurations through quarterly reviews evidencing alignment with security and compliance requirements. Provide support on a 24x7 on-call rotation, returning critical production calls within 30 minutes and driving network incidents to resolution. Review and update assigned FootPrints and other tickets on receipt and work with Help Desk, Procurement and other teams on equipment moves, adds, and changes. Perform onsite surveys for site modernization, new site implementations, and decommissioning. Install, terminate, and test structured cabling for new deployments and office expansions, and safely remove outdated hardware and cabling in compliance with asset disposal protocols. Site-to-Site VPN Engineering & High Availability Design, build, and operate redundant IPsec site-to-site VPNs connecting clients facilities, VITA and partner networks, and Cloud, including the tunnels supporting clients operational, and law enforcement systems. Ensure resilience across customer gateways and diverse carrier paths so no single device, circuit is a point of failure. Set up dynamic failover using BGP over VPN by tuning basic route settings and filters so traffic automatically moves to the backup connection when needed. Standardize IKEv2 settings including Phase 1/Phase 2 timers, PFS groups, rekey behavior, and retire outdated cipher suites to improve VPN security and consistency Enable DPD, tunnel state monitoring, and per-tunnel alerting so partial failures surface before users report them. Build and manage AWS Site-to-Site VPN attachments to Transit Gateway and Virtual Private Gateway, using accelerated VPN where latency or jitter sensitivity requires it. Execute scheduled failover tests against RTO targets, manage pre-shared keys and certificates through approved secrets management, and maintain a complete VPN inventory of endpoints, tunnel pairs, encryption domains, and maintenance windows. AWS Cloud Network Engineering & Migration Support AWS Cloud migration efforts, hybrid connectivity setup, and post-migration stabilization. Design, document, and validate VPC networking subnets, route tables, security groups, network ACLs, VPC endpoints and PrivateLink under an IP address management and CIDR strategy. Build and operate Transit Gateway hub-and-spoke topologies with route table segmentation and controlled inter-VPC and inter-account routing. Implement AWS Direct Connect and hybrid DNS using Route 53 Resolver endpoints and forwarding rules. Deploy ingress and egress inspection using AWS Network Firewall, Gateway Load Balancer, or approved third-party virtual appliances. Perform discovery and remediate on-prem network gaps and segmentation issues that could affect a secure cloud migration. Monitor post-migration connectivity, routing, access controls, network performance, and collaborate with state partners, cloud teams, and vendors to ensure secure, compliant, and resilient hybrid designs. Network Security, Compliance & DR Readiness Apply secure-by-design, least-privilege, and Zero Trust principles to routing, segmentation, encrypted transport, and access controls, including MFA for all admin access. Align network configurations and audit evidence with CJIS Security Policy, COV, and FBI security requirements. Strengthen device access controls by using centralized login and auditing systems, ensuring only authorized users can manage network equipment. Support ongoing vulnerability scanning, remediation planning, and periodic access reviews across the network estate. Use VPC Flow Logs, Traffic Mirroring, CloudTrail, and GuardDuty findings for network threat detection, investigation, and forensics. Identify network single points of failure across infrastructure and routing, and ensure DR segments and backup paths meet the same security standards. Maintain accurate hardware and software inventory for SPHQ and DR, documenting new network equipment in FootPrints within two weeks of arrival. Network Automation, Observability & Documentation Deliver network components as

code using Terraform, CloudFormation, Ansible under Git-based version control with peer review, automating configuration deployment, compliance checking, and drift detection across on-premise and cloud estates. Build and improve monitoring dashboards, syslog feeds, SNMP and streaming telemetry, and alert thresholds for proactive detection of outages and anomalies. Participate in bi-weekly incident reviews, lead network-related post-mortems, and ensure corrective actions are implemented. Create and maintain network diagrams, inventories, standards, desk procedures, and troubleshooting guides current. Manage service requests, change control, ticket workflows, and coordinate connectivity changes with agency teams and partners with procurement to optimize network-related costs. What You Bring Required 10+ years of hands-on enterprise network engineering across routing, switching, firewalling, and secure remote connectivity. Proven design and operation of redundant IPsec site-to-site VPNs with BGP-based failover between on-premise and cloud environments. Working command of network security controls: segmentation, least privilege, encryption in transit, MFA for administrative access, and device hardening. Experience supporting 24x7 operations, on-call rotation, and structured incident and change management using ITSM tooling such as FootPrints or ServiceNow. Strong AWS networking experience across VPC design, Transit Gateway, Direct Connect, Site-to Site VPN, Route 53, security groups, and network ACLs. Demonstrated delivery of network infrastructure as code using Terraform or CloudFormation under version control. Familiarity with CJIS, COV, or similar security frameworks, and ability to meet CJIS personnel security requirements including a background investigation. Preferred Experience in a law-enforcement or public-safety environment supporting CJIS-regulated systems such as VCIN, CCH, or LiveScan. Familiarity with the VITA/SAIC service delivery model and Commonwealth of Virginia change control and service request workflows. Multi-vendor experience alongside Juniper Cisco, Palo Alto, Fortinet, or Check Point including SD WAN, MPLS, and carrier circuit management across a large remote-site footprint. AWS Network Firewall, Gateway Load Balancer, and appliance inspection architectures. Network automation with Python, Ansible, and CI/CD pipelines applied to network change. Hybrid DNS design, IPAM tooling, and large-scale CIDR planning, with observability tooling such as CloudWatch, PrometheGrafana, Elastic Stack, SolarWinds, or Datadog. Vendor certifications such as JNCIP or JNCIE, CCNP or CCIE, or PCNSE, and AWS Certified Advanced Networking Specialty or AWS Certified Security Specialty.

Everforth Apex is a world-class IT services company that serves thousands of clients across the globe. When you join Everforth Apex, you become part of a team that values innovation, collaboration, and continuous learning. We offer quality career resources, training, certifications, development opportunities, and a comprehensive benefits package. Our commitment to excellence is reflected in many awards, including ClearlyRateds Best of Staffing in Talent Satisfaction in the United States and Great Place to Work in the United Kingdom and Mexico.

Everforth Apex uses a virtual recruiter as part of the application process. Click for more details. By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from Everforth Apex and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at