CSfC Network Engineer Subject Matter Expert

Leidos

Confirmed live yesterday High trust

Quick summary

Work type: On-site
Location: Fort Belvoir, VA
Posted: 8 days ago
Freshness: Confirmed live yesterday
Nearby: 99+ roles within 25 mi

Market check

Salary context

How this pay compares to similar roles

Similar $167k

$108k most similar roles pay here $220k

This listing doesn't post a salary. Most similar roles pay $137,162–$196,750.

Based on 240 similar postings.

Employer

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations.

Leidos currently has 264 open roles on FindRole.

Listed pay typically runs $92,300–$166,850 across 245 roles with salary data.

Most-posted roles

View all roles at Leidos

At a glance

TL;DR · CSfC Network Engineer Subject Matter Expert

Role Posting Log in to save

CSfC Network Engineer Subject Matter Expert (SME) joins the Integrated Information Technology Support Services team to support a digital modernization program for the Defense Threat Reduction Agency. This role involves architecting and operating secure, dual-layer cryptographic boundaries in compliance with NSA Capability Packages. The engineer will build and maintain multi-layered Commercial Solutions for Classified architectures, ensuring strict adherence to vendor diversity and dual-tunnel encryption mandates. Day-to-day responsibilities include configuring Cisco and Aruba IPsec/SSL VPNs, managing BGP and OSPF routing, and tuning Palo Alto NGFW security policies with IDS/IPS threat prevention. The role requires implementing 802.1X access control via Cisco ISE or Aruba ClearPass, integrating PKI/OCSP services, and generating compliance artifacts for NSA registration. Key technologies include PAN-OS, Ansible for automation, and hardware security modules to solve complex secure network connectivity challenges within Black, Gray, and Red environments.

Skills

Cisco Aruba Palo Alto Networks NGFW BGP OSPF IPsec SSL VPN 802.1X Cisco ISE Aruba ClearPass PKI X.509 NTP Ansible PAN-OS Panorama RADIUS TACACS+ CNSA

What you'll do

Architect and operate secure dual-layer cryptographic boundaries using Cisco and Aruba IPsec/SSL VPNs.
Implement dynamic routing protocols including BGP and OSPF across enterprise network infrastructure.
Author, tune, and audit Palo Alto Next-Generation Firewall security policies and IDS/IPS threat signatures.
Manage Cisco ISE and Aruba ClearPass for 802.1X authentication, RADIUS/TACACS+ administration, and endpoint profiling.
Integrate and manage enterprise PKI components including X.509 certificates, CRLs, OCSP, and hardened NTP.
Generate engineering artifacts, Key Management Plans, and compliance documentation for NSA CSfC PMO registration.
Maintain multi-layered CSfC architectures in compliance with NSA Mobile Access and Multi-Site Connectivity packages.
Automate network configurations, policy checks, and certificate rotations using Ansible.

What we're looking for

Must be a U.S. citizen.
Must possess an active TS/SCI clearance.
Bachelor's degree in a STEM field or equivalent experience and training is required.
Must have 12-15 years of relevant experience and at least 12 years of progressive network engineering experience in DoD, federal, or defense contractor environments.
Must hold an active DoD 8570.01-M / 8140 IAT Level II or III certification (e.g., Security+, CySA+, CASP+, or CISSP).
Must possess a Computing Environment certification such as Cisco CCNA/CCNP, Aruba ACSA/ACSP, or Palo Alto PCNSE.
Required expertise includes configuring Cisco and Aruba IPsec/SSL VPNs, dynamic routing (BGP/OSPF), and Palo Alto NGFW security policies.
Experience is required in managing Cisco ISE or Aruba ClearPass for 802.1X, PKI certificate lifecycles, and NSA CSfC Capability Package registrations.

Save