Network Security Engineer

Mid-Senior, 5-8 years in cybersecurity; 2+ years enforcing NAC policy in production Location Onsite at the base Reports to Engineering manager Role summary Hands-on engineer who configures and runs the C2C/NAC platform at the base: closes Step 1-3 gaps, builds and tunes policies, and executes Step 4 enforcement waves. Key responsibilities Close the remaining device discovery, classification, and interrogation gaps on the NAC platform. Build and test posture checks and auto-remediation policies; validate on a pilot group before expanding. Configure and validate integrations with ACAS, endpoint security/EDR, AD, SIEM, and ticketing. Enable monitor mode, analyze failures, and tune policies before enforcement. Execute enforcement waves with the network engineer; triage failures and roll back quickly when needed. Identify, categorize, and document exception devices and support the base in getting waivers. Document configurations, policies, and runbooks for handoff to base staff., Review switch inventory, firmware, and configurations to determine 802.1X/MAB/CoA readiness; identify non-capable or end-of-life gear. Build standard 802.1X/MAB configuration templates and deploy them building by building, with a rollback plan. Handle special ports: IP phones with daisy-chained PCs, printers, IoT, and other devices needing MAB or exceptions. Configure AAA/RADIUS/TACACS+, VLAN assignments (including quarantine/remediation), DHCP snooping, and related settings. Support monitor mode and enforcement waves; troubleshoot connectivity problems in real time. Configure wireless authentication where in scope. Produce as-built documentation, config backups, and network diagrams updates.

Production experience administering and enforcing policy on a NAC platform (Forescout or Cisco ISE, matching the base) at scale of thousands of endpoints. Solid understanding of 802.1X, MAB, RADIUS, Active Directory/GPO, and PKI/certificate deployment. Familiar with STIGs, SCAP, ACAS/Tenable, and endpoint security tools. Scripting or automation (PowerShell, Python, or REST APIs). Comfortable working in a live DoD environment with strict change control. Preferred qualifications Experience on DoD/DISA C2C deployments. Experience in a base NOC or with a base cyber/comm squadron. Experience with SIEM/log analysis and troubleshooting user impact. Certifications Security+ (baseline) CISSP, CEH, or CySA+ preferred Forescout Certified Administrator/Engineer or Cisco ISE/CCNP Security Network Engineer Level / experience Mid-Senior, 5-8 years in campus networking; 3+ years deploying 802.1X/MAB on wired and wireless, Hands-on 802.1X, MAB, and CoA deployment on wired and wireless in a production campus network. Deep configuration and troubleshooting experience on the base’s switch vendor (commonly Cisco IOS/IOS-XE): AAA, VLANs, DHCP snooping, DAI, port security. Experience with bulk configuration deployment and rollback across hundreds of switches (Ansible, Python/Netmiko, or a config management tool). Comfortable working in network closets and executing changes in after-hours windows. Preferred qualifications Experience in a DoD or base network operations environment. Wireless controller experience (802.1X SSIDs). Network automation and monitoring tool experience. Certifications CCNP Enterprise or CCNP Security (preferred); CCNA minimum Security+ (baseline)