> Markdown version of [/jobs/ext/4680274-network-zero-trust-engineer](https://www.wearedevelopers.com/jobs/ext/4680274-network-zero-trust-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Network Zero Trust Engineer - **Company:** VAE, Inc. - **Location:** Springfield, VA, United States - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** IEEE 802.1Q, Amazon Web Services, Apple IOS, Microsoft Azure, Border Gateway Protocol, Catalyst (Software), CompTIA Security+, Computer Networks, Data Centers, Multi-Factor Authentication, Trunking, Internet Protocol Security (IP SEC), Virtual Private Networks (VPN), Multi-protocol Systems, Python (Programming Language), Netconf, Network Control, Routing, Network Virtualization, Open Shortest Path First (OSPF), Peering, Public Key Infrastructure, Ansible, Zero Trust Network Access, Security Information and Event Management, Software Deployment, Virtual Local Area Networks, VMware VSphere, Wide Area Networks, Load Balancing, Computer Network Operations, SC Clearance, SolarWinds (Software), Palo Alto Networks, Firewall Services Module, Splunk, Cisco Switches, Big Ip, Cisco, Vmware - **Published:** November 12, 2026 - **Apply:** https://www.disabledperson.com/jobs/76462690-network-zero-trust-engineer ## About the Role * 8+ years of enterprise or DoD network engineering. * 2+ years of hands-on work with Cisco SD-WAN plus Palo Alto or F5. * Bachelor's degree in a technical field preferred. Certifications * IAT Level II (required). * CCNP Enterprise preferred., 1. Clearance: Active Secret clearance at the time of submission, eligible for SIPRNet accounts. U.S. citizen. 2. Cisco SD-WAN: Hands-on production deployment of Cisco SD-WAN (Viptela or Catalyst), including SD-WAN Manager, configuration groups or templates, centralized policy and edge router onboarding. 3. Palo Alto and F5: Hands-on Palo Alto Networks next-generation firewall configuration (virtual and physical appliances) and F5 BIG-IP load balancing and inspection, including TLS decryption and service chaining. This role requires hands-on experience with at least one. 4. Security services: Working knowledge of PKI and certificates, SIEM log forwarding, multi-factor authentication and public cloud networking (AWS, Azure or GCP). 5. Routing and switching: Strong working knowledge of BGP and OSPF, VRFs and MPLS L3VPN, VLANs with 802.1Q and Q-in-Q trunking, and IPsec. 6. DoD networks: Experience on DoD or federal networks, including DISA STIG and NIST SP 800-53 hardening, change control and boundary approval processes. 7. Workforce qualification: Holds an IAT Level II baseline certification (for example CompTIA Security+ CE) and meets DoD 8140 qualification for the assigned work role before receiving privileged access, and can complete the DD Form 2875 privileged access process. 8. Documentation: Produces accurate logical and physical diagrams, IP plans and as-built records. 9. Teamwork: Works well inside a multi-vendor integration team and communicates clearly with Government network operators., * Air Force networks: Air Force enterprise network (AFNet) operations or base communications experience, including work with Air Force network operations squadrons. * Vendor certifications: Palo Alto PCNSE, F5 Certified BIG-IP Administrator or higher, and Cisco 300-415 ENSDWI. * Classified networks: TACLANE configuration and SIPRNet circuit experience. * DISA connections: Experience with DISA connection and peering processes. * Cisco platforms: Catalyst 8500-series SD-WAN edge routers, Catalyst 9600-series switching and Cisco Catalyst Center (formerly DNA Center). * Zero Trust: Familiarity with Zero Trust architectures, ZTNA and the DoD Zero Trust strategy; AppGate experience is a plus. * Automation: Python, Ansible, NETCONF or RESTCONF. * Monitoring: SolarWinds, Splunk or Cribl. * Virtual networking: VMware vSphere networking in data center deployments. ## Description The Network Zero Trust Engineer is a hands-on builder for the Air Force Next Generation Gateway (NGG) program. You will build, configure, test and cut over the Cisco, Palo Alto and F5 components that make up the Zero Trust network, working from designs set by the senior engineer and in coordination with Government network operators., * Build, configure, test and cut over Cisco SD-WAN, Palo Alto and F5 components in production. * Deploy and onboard IOS XE SD-WAN edge routers in redundant A-side and B-side pairs using SD-WAN Manager, configuration groups or templates and centralized policy. * Configure VRF segmentation, BGP and OSPF peering, VLANs (802.1Q and Q-in-Q) and IPsec. * Implement firewall, TLS decryption and inspection configurations on Palo Alto and/or F5 platforms. * Apply the DoW Zero Trust controls that relate to network components. * Apply DISA STIG and NIST SP 800-53 hardening and follow change control and boundary approval processes. * Keep logical and physical diagrams, IP plans and as-built records accurate. * Work within a multi-vendor integration team and communicate clearly with Government network operators. The Environment You will work on a layered Zero Trust architecture built on Cisco Catalyst SD-WAN, with traffic steered through a security inspection stack before it reaches protected applications. * Cisco Catalyst SD-WAN: SD-WAN Manager, Controller and Validator in the control plane, with IOS XE SD-WAN edge routers deployed in redundant A-side and B-side pairs. Cisco Catalyst Center is also part of the program. * Segmentation by VRF: Transport (VPN 0), management, direct internet access and several service VPNs, including dedicated Zero Trust and quarantine VRFs that carry traffic to and from the security stack. * Routing around the fabric: BGP and OSPF peering with provider edge routers, base core networks and DISA points of presence, with route leaking and redistribution between VRFs. * Service chaining: Traffic is steered through Palo Alto Networks next-generation firewall virtual routers and AppGate ZTNA gateways before it reaches protected applications. * Inspection stack: Palo Alto firewalls break and decrypt TLS, F5 BIG-IP inspects the traffic, and Palo Alto WildFire detonates unknown files to catch zero-day threats. Routing must deliver traffic to each tier and back on a symmetric path. * Classified transport: On SIPRNet, TACLANE inline network encryptors interconnect sites, and all work follows classified enclave rules. * Management enclave: A dedicated management network reached over the Air Force enterprise VPN (MPLS L3VPN with GETVPN), with management systems hosted on VMware at the data centers.