> Markdown version of [/jobs/ext/2237747-network-engineer](https://www.wearedevelopers.com/jobs/ext/2237747-network-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Network Engineer

- **Company:** Everforth Apex
- **Location:** Richmond, United States
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Border Gateway Protocol, Cloud Computing, Computer Networks, Continuous Integration, Domain Name System (DNS), Elasticsearch, Failover, Networking Hardware, Internet Protocol Security (IP SEC), IP Address Management, IP Routing, Virtual Private Networks (VPN), Multi-protocol Systems, Python (Programming Language), Network Security, Network Architecture, Network Diagrams, Routing, Role-Based Access Control, Ansible, Zero Trust Network Access, SAP Sales and Distribution, Simple Network Management Protocols, Datadog, Load Balancing, Computer Network Operations, Cloud Platform System, System Availability, Firewalls (Computer Science), Amazon Virtual Private Cloud (VPC), Juniper, Git, Cloudformation, SolarWinds (Software), Palo Alto Networks, Fortinet, Route53, Hardware Infrastructure, Cloudwatch, Terraform, Open Network Automation Platform, Software Version Control, Cisco, Servicenow, Vulnerability Analysis
- **Published:** August 26, 2026
- **Apply:** https://www.dice.com/job-detail/03251d1f-78aa-4318-8518-d3aec2b3515d

## About the Role

code using Terraform, CloudFormation, Ansible under Git-based version control with peer review, automating configuration deployment, compliance checking, and drift detection across on-premise and cloud estates. Build and improve monitoring dashboards, syslog feeds, SNMP and streaming telemetry, and alert thresholds for proactive detection of outages and anomalies. Participate in bi-weekly incident reviews, lead network-related post-mortems, and ensure corrective actions are implemented. Create and maintain network diagrams, inventories, standards, desk procedures, and troubleshooting guides current. Manage service requests, change control, ticket workflows, and coordinate connectivity changes with agency teams and partners with procurement to optimize network-related costs. What You Bring Required 10+ years of hands-on enterprise network engineering across routing, switching, firewalling, and secure remote connectivity. Proven design and operation of redundant IPsec site-to-site VPNs with
BGP-based failover between on-premise and cloud environments. Working command of network security controls: segmentation, least privilege, encryption in transit, MFA for administrative access, and device hardening. Experience supporting 24x7 operations, on-call rotation, and structured incident and change management using ITSM tooling such as FootPrints or ServiceNow. Strong AWS networking experience across VPC design, Transit Gateway, Direct Connect, Site-to Site VPN, Route 53, security groups, and network ACLs. Demonstrated delivery of network infrastructure as code using Terraform or CloudFormation under version control. Familiarity with CJIS, COV, or similar security frameworks, and ability to meet CJIS personnel security requirements including a background investigation. Preferred Experience in a law-enforcement or public-safety environment supporting CJIS-regulated systems such as VCIN, CCH, or LiveScan. Familiarity with the VITA/SAIC service delivery model and
Commonwealth of Virginia change control and service request workflows. Multi-vendor experience alongside Juniper Cisco, Palo Alto, Fortinet, or Check Point including SD WAN, MPLS, and carrier circuit management across a large remote-site footprint. AWS Network Firewall, Gateway Load Balancer, and appliance inspection architectures. Network automation with Python, Ansible, and CI/CD pipelines applied to network change. Hybrid DNS design, IPAM tooling, and large-scale CIDR planning, with observability tooling such as CloudWatch, PrometheGrafana, Elastic Stack, SolarWinds, or Datadog. Vendor certifications such as JNCIP or JNCIE, CCNP or CCIE, or PCNSE, and AWS Certified Advanced Networking Specialty or AWS Certified Security Specialty.

## Description

Client is seeking an experienced Network Engineer to design, secure, and operate the agency's hybrid network across on-premise infrastructure and AWS as part of a major migration from on-premise systems to AWS. This role owns end-to-end connectivity for mission-critical state police systems spanning 500+ remote sites and applications including VCIN, CCH, and LiveScan while engineering the highly available site-to-site VPN and hybrid connectivity fabric that links VSP facilities, VITA and partner networks, and AWS. You will work closely with Infrastructure, Platform Engineering, and with state partners, to ensure all network components meet CJIS, COV, and FBI security requirements. Hybrid Network Operations & Secure Connectivity Maintain a stable, resilient, and secured network across 500+ remote offices, ensuring reliable connectivity for mission-critical state police applications (VCIN, CCH, LiveScan, and similar). Govern ACLs, routing policies, and device configurations through
quarterly reviews evidencing alignment with security and compliance requirements. Provide support on a 24x7 on-call rotation, returning critical production calls within 30 minutes and driving network incidents to resolution. Review and update assigned FootPrints and other tickets on receipt and work with Help Desk, Procurement and other teams on equipment moves, adds, and changes. Perform onsite surveys for site modernization, new site implementations, and decommissioning. Install, terminate, and test structured cabling for new deployments and office expansions, and safely remove outdated hardware and cabling in compliance with asset disposal protocols. Site-to-Site VPN Engineering & High Availability Design, build, and operate redundant IPsec site-to-site VPNs connecting clients facilities, VITA and partner networks, and Cloud, including the tunnels supporting clients operational, and law enforcement systems. Ensure resilience across customer gateways and diverse carrier paths so no
single device, circuit is a point of failure. Set up dynamic failover using BGP over VPN by tuning basic route settings and filters so traffic automatically moves to the backup connection when needed. Standardize IKEv2 settings including Phase 1/Phase 2 timers, PFS groups, rekey behavior, and retire outdated cipher suites to improve VPN security and consistency Enable DPD, tunnel state monitoring, and per-tunnel alerting so partial failures surface before users report them. Build and manage AWS Site-to-Site VPN attachments to Transit Gateway and Virtual Private Gateway, using accelerated VPN where latency or jitter sensitivity requires it. Execute scheduled failover tests against RTO targets, manage pre-shared keys and certificates through approved secrets management, and maintain a complete VPN inventory of endpoints, tunnel pairs, encryption domains, and maintenance windows. AWS Cloud Network Engineering & Migration Support AWS Cloud migration efforts, hybrid connectivity setup, and
post-migration stabilization. Design, document, and validate VPC networking subnets, route tables, security groups, network ACLs, VPC endpoints and PrivateLink under an IP address management and CIDR strategy. Build and operate Transit Gateway hub-and-spoke topologies with route table segmentation and controlled inter-VPC and inter-account routing. Implement AWS Direct Connect and hybrid DNS using Route 53 Resolver endpoints and forwarding rules. Deploy ingress and egress inspection using AWS Network Firewall, Gateway Load Balancer, or approved third-party virtual appliances. Perform discovery and remediate on-prem network gaps and segmentation issues that could affect a secure cloud migration. Monitor post-migration connectivity, routing, access controls, network performance, and collaborate with state partners, cloud teams, and vendors to ensure secure, compliant, and resilient hybrid designs. Network Security, Compliance & DR Readiness Apply secure-by-design, least-privilege, and Zero
Trust principles to routing, segmentation, encrypted transport, and access controls, including MFA for all admin access. Align network configurations and audit evidence with CJIS Security Policy, COV, and FBI security requirements. Strengthen device access controls by using centralized login and auditing systems, ensuring only authorized users can manage network equipment. Support ongoing vulnerability scanning, remediation planning, and periodic access reviews across the network estate. Use VPC Flow Logs, Traffic Mirroring, CloudTrail, and GuardDuty findings for network threat detection, investigation, and forensics. Identify network single points of failure across infrastructure and routing, and ensure DR segments and backup paths meet the same security standards. Maintain accurate hardware and software inventory for SPHQ and DR, documenting new network equipment in FootPrints within two weeks of arrival. Network Automation, Observability & Documentation Deliver network components as


## Related Videos

- [How Cisco embraced a DevOps culture within its network engineering team](https://www.wearedevelopers.com/videos/99-how-cisco-embraced-a-devops-culture-within-its-network-engineering-team)
- [How a Small Team Shrank a Microsoft Monorepo by 94%](https://www.wearedevelopers.com/videos/1236-how-a-small-team-shrank-a-microsoft-monorepo-by-94)
- [Your Infrastructure Is Not a Playground: AI Agents for Infra Done Right](https://www.wearedevelopers.com/videos/2084-your-infrastructure-is-not-a-playground-ai-agents-for-infra-done-right)
- [Computer Vision from the Edge to the Cloud done easy](https://www.wearedevelopers.com/videos/263-computer-vision-from-the-edge-to-the-cloud-done-easy)
- [Git for Code Reviews](https://www.wearedevelopers.com/videos/429-git-for-code-reviews)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)

## Related Articles

- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [Everything a Developer Needs to Know About MCP with Neo4j](https://www.wearedevelopers.com/magazine/604-everything-a-developer-needs-to-know-about-mcp-with-neo4j)
- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)
- [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)
- [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)