> Markdown version of [/jobs/ext/3875473-network-security-engineer](https://www.wearedevelopers.com/jobs/ext/3875473-network-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Network Security Engineer

- **Company:** Kriaanet Inc
- **Location:** Washington, DC, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** IEEE 802.1X, Active Directory, Cisco IOS, Dynamic Host Configuration Protocol, Firmware, Python (Programming Language), Network Security, Log Analysis, Network Diagrams, Public Key Infrastructure, Windows PowerShell, Ansible, Security Content Automation Protocol, Security Information and Event Management, Systems Integration, Virtual Local Area Networks, Scripting, Authentication Authorization Accounting (Server Program), Identity Services Engine, Computer Network Operations, Connectivity Problems, Forescout, TACACS+ Protocol, Restful APIs, Open Network Automation Platform
- **Published:** October 22, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9257515/network-security-engineer

## About the Role

Production experience administering and enforcing policy on a NAC platform (Forescout or Cisco ISE, matching the base) at scale of thousands of endpoints.
Solid understanding of 802.1X, MAB, RADIUS, Active Directory/GPO, and PKI/certificate deployment.
Familiar with STIGs, SCAP, ACAS/Tenable, and endpoint security tools.
Scripting or automation (PowerShell, Python, or REST APIs).
Comfortable working in a live DoD environment with strict change control.
Preferred qualifications
Experience on DoD/DISA C2C deployments.
Experience in a base NOC or with a base cyber/comm squadron.
Experience with SIEM/log analysis and troubleshooting user impact.
Certifications
Security+ (baseline)
CISSP, CEH, or CySA+ preferred
Forescout Certified Administrator/Engineer or Cisco ISE/CCNP Security
Network Engineer
Level / experience
Mid-Senior, 5-8 years in campus networking; 3+ years deploying 802.1X/MAB on wired and wireless, Hands-on 802.1X, MAB, and CoA deployment on wired and wireless in a production campus network.
Deep configuration and troubleshooting experience on the base's switch vendor (commonly Cisco IOS/IOS-XE): AAA, VLANs, DHCP snooping, DAI, port security.
Experience with bulk configuration deployment and rollback across hundreds of switches (Ansible, Python/Netmiko, or a config management tool).
Comfortable working in network closets and executing changes in after-hours windows.
Preferred qualifications
Experience in a DoD or base network operations environment.
Wireless controller experience (802.1X SSIDs).
Network automation and monitoring tool experience.
Certifications
CCNP Enterprise or CCNP Security (preferred); CCNA minimum
Security+ (baseline)

## Description

Mid-Senior, 5-8 years in cybersecurity; 2+ years enforcing NAC policy in production
Location
Onsite at the base
Reports to
Engineering manager
Role summary
Hands-on engineer who configures and runs the C2C/NAC platform at the base: closes Step 1-3 gaps, builds and tunes policies, and executes Step 4 enforcement waves.
Key responsibilities
Close the remaining device discovery, classification, and interrogation gaps on the NAC platform.
Build and test posture checks and auto-remediation policies; validate on a pilot group before expanding.
Configure and validate integrations with ACAS, endpoint security/EDR, AD, SIEM, and ticketing.
Enable monitor mode, analyze failures, and tune policies before enforcement.
Execute enforcement waves with the network engineer; triage failures and roll back quickly when needed.
Identify, categorize, and document exception devices and support the base in getting waivers.
Document configurations, policies, and runbooks for handoff to base staff., Review switch inventory, firmware, and configurations to determine 802.1X/MAB/CoA readiness; identify non-capable or end-of-life gear.
Build standard 802.1X/MAB configuration templates and deploy them building by building, with a rollback plan.
Handle special ports: IP phones with daisy-chained PCs, printers, IoT, and other devices needing MAB or exceptions.
Configure AAA/RADIUS/TACACS+, VLAN assignments (including quarantine/remediation), DHCP snooping, and related settings.
Support monitor mode and enforcement waves; troubleshoot connectivity problems in real time.
Configure wireless authentication where in scope.
Produce as-built documentation, config backups, and network diagrams updates.