Senior Network Zero Trust Engineer in Springfield, Virginia at VAE, Inc.

VAE, Inc. is a full service IT Infrastructure Solutions Company focused on building, securing and supporting our clients’ mission critical enterprises. We provide a distinctive array of design, integration and implementation services as well as fully managed service offerings. VAE is at the forefront of leveraging multi-tenant capable technologies and shared IT services to create secure, reliable and cost-effective end-to-end services and solutions. We deliver exceptional infrastructure solutions with extremely talented employees using a client-focused partnering approach.

The Senior Network Zero Trust Engineer is the technical lead for Zero Trust network design on the Air Force Next Generation Gateway (NGG) program. You will own the design questions, align the network with Zero Trust controls, and solve the hardest routing, firewall and inspection problems. You will also mentor the other engineers on the team.

Key Responsibilities

• Lead large-scale Zero Trust network design and integration, including segmentation and network access control, against the DoW Zero Trust controls.
• Design and govern the Cisco Catalyst SD-WAN fabric, including VRF segmentation, configuration groups or templates, centralized policy and edge router onboarding.
• Architect routing across the fabric, including BGP and OSPF peering with provider edges, base core networks and DISA points of presence, and route leaking between VRFs.
• Design service chaining through Palo Alto next-generation firewalls, AppGate ZTNA gateways and F5 BIG-IP, ensuring symmetric paths through every inspection tier.
• Resolve complex firewall, TLS decryption and inspection issues across Palo Alto and F5 platforms.
• Ensure designs meet DISA STIG and NIST SP 800-53 hardening, change control and boundary approval requirements.
• Produce and review logical and physical diagrams, IP plans and as-built records.
• Mentor engineers and work closely with Government network operators and multi-vendor integration partners.

The Environment

You will work on a layered Zero Trust architecture built on Cisco Catalyst SD-WAN, with traffic steered through a security inspection stack before it reaches protected applications.

• Cisco Catalyst SD-WAN: SD-WAN Manager, Controller and Validator in the control plane, with IOS XE SD-WAN edge routers deployed in redundant A-side and B-side pairs. Cisco Catalyst Center is also part of the program.
• Segmentation by VRF: Transport (VPN 0), management, direct internet access and several service VPNs, including dedicated Zero Trust and quarantine VRFs that carry traffic to and from the security stack.
• Routing around the fabric: BGP and OSPF peering with provider edge routers, base core networks and DISA points of presence, with route leaking and redistribution between VRFs.
• Service chaining: Traffic is steered through Palo Alto Networks next-generation firewall virtual routers and AppGate ZTNA gateways before it reaches protected applications.
• Inspection stack: Palo Alto firewalls break and decrypt TLS, F5 BIG-IP inspects the traffic, and Palo Alto WildFire detonates unknown files to catch zero-day threats. Routing must deliver traffic to each tier and back on a symmetric path.
• Classified transport: On SIPRNet, TACLANE inline network encryptors interconnect sites, and all work follows classified enclave rules.
• Management enclave: A dedicated management network reached over the Air Force enterprise VPN (MPLS L3VPN with GETVPN), with management systems hosted on VMware at the data centers.

Experience and Education

• 10+ years of enterprise or DoD network and network security engineering.
• 4+ years with Cisco SD-WAN, Palo Alto and F5 in production.
• Bachelor's degree in a technical field, or equivalent experience.

Certifications

• CCNP Enterprise (required).
• IAT Level II minimum; IAT Level III (for example CISSP) preferred.

Required Qualifications

1. Clearance: Active Secret clearance at the time of submission, eligible for SIPRNet accounts. U.S. citizen.
2. Cisco SD-WAN: Hands-on production deployment of Cisco SD-WAN (Viptela or Catalyst), including SD-WAN Manager, configuration groups or templates, centralized policy and edge router onboarding.
3. Palo Alto and F5: Hands-on Palo Alto Networks next-generation firewall configuration (virtual and physical appliances) and F5 BIG-IP load balancing and inspection, including TLS decryption and service chaining. This role requires hands-on experience with both.
4. Security services: Working knowledge of PKI and certificates, SIEM log forwarding, multi-factor authentication and public cloud networking (AWS, Azure or GCP).
5. Routing and switching: Strong working knowledge of BGP and OSPF, VRFs and MPLS L3VPN, VLANs with 802.1Q and Q-in-Q trunking, and IPsec.
6. DoD networks: Experience on DoD or federal networks, including DISA STIG and NIST SP 800-53 hardening, change control and boundary approval processes.
7. Workforce qualification: Holds an IAT Level II baseline certification (for example CompTIA Security+ CE) and meets DoD 8140 qualification for the assigned work role before receiving privileged access, and can complete the DD Form 2875 privileged access process.
8. Documentation: Produces accurate logical and physical diagrams, IP plans and as-built records.
9. Teamwork: Works well inside a multi-vendor integration team and communicates clearly with Government network operators.

Preferred Qualifications

• Air Force networks: Air Force enterprise network (AFNet) operations or base communications experience, including work with Air Force network operations squadrons.
• Vendor certifications: Palo Alto PCNSE, F5 Certified BIG-IP Administrator or higher, and Cisco 300-415 ENSDWI.
• Classified networks: TACLANE configuration and SIPRNet circuit experience.
• DISA connections: Experience with DISA connection and peering processes.
• Cisco platforms: Catalyst 8500-series SD-WAN edge routers, Catalyst 9600-series switching and Cisco Catalyst Center (formerly DNA Center).
• Zero Trust: Familiarity with Zero Trust architectures, ZTNA and the DoD Zero Trust strategy; AppGate experience is a plus.
• Automation: Python, Ansible, NETCONF or RESTCONF.
• Monitoring: SolarWinds, Splunk or Cribl.
• Virtual networking: VMware vSphere networking in data center deployments.

VAE, Inc. is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law.