Network Zero Trust Engineer in Springfield, Virginia at VAE, Inc.

VAE, Inc. is a full service IT Infrastructure Solutions Company focused on building, securing and supporting our clients’ mission critical enterprises. We provide a distinctive array of design, integration and implementation services as well as fully managed service offerings. VAE is at the forefront of leveraging multi-tenant capable technologies and shared IT services to create secure, reliable and cost-effective end-to-end services and solutions. We deliver exceptional infrastructure solutions with extremely talented employees using a client-focused partnering approach.

The Network Zero Trust Engineer is a hands-on builder for the Air Force Next Generation Gateway (NGG) program. You will build, configure, test and cut over the Cisco, Palo Alto and F5 components that make up the Zero Trust network, working from designs set by the senior engineer and in coordination with Government network operators.

Key Responsibilities

• Build, configure, test and cut over Cisco SD-WAN, Palo Alto and F5 components in production.
• Deploy and onboard IOS XE SD-WAN edge routers in redundant A-side and B-side pairs using SD-WAN Manager, configuration groups or templates and centralized policy.
• Configure VRF segmentation, BGP and OSPF peering, VLANs (802.1Q and Q-in-Q) and IPsec.
• Implement firewall, TLS decryption and inspection configurations on Palo Alto and/or F5 platforms.
• Apply the DoW Zero Trust controls that relate to network components.
• Apply DISA STIG and NIST SP 800-53 hardening and follow change control and boundary approval processes.
• Keep logical and physical diagrams, IP plans and as-built records accurate.
• Work within a multi-vendor integration team and communicate clearly with Government network operators.

The Environment

You will work on a layered Zero Trust architecture built on Cisco Catalyst SD-WAN, with traffic steered through a security inspection stack before it reaches protected applications.

• Cisco Catalyst SD-WAN: SD-WAN Manager, Controller and Validator in the control plane, with IOS XE SD-WAN edge routers deployed in redundant A-side and B-side pairs. Cisco Catalyst Center is also part of the program.
• Segmentation by VRF: Transport (VPN 0), management, direct internet access and several service VPNs, including dedicated Zero Trust and quarantine VRFs that carry traffic to and from the security stack.
• Routing around the fabric: BGP and OSPF peering with provider edge routers, base core networks and DISA points of presence, with route leaking and redistribution between VRFs.
• Service chaining: Traffic is steered through Palo Alto Networks next-generation firewall virtual routers and AppGate ZTNA gateways before it reaches protected applications.
• Inspection stack: Palo Alto firewalls break and decrypt TLS, F5 BIG-IP inspects the traffic, and Palo Alto WildFire detonates unknown files to catch zero-day threats. Routing must deliver traffic to each tier and back on a symmetric path.
• Classified transport: On SIPRNet, TACLANE inline network encryptors interconnect sites, and all work follows classified enclave rules.
• Management enclave: A dedicated management network reached over the Air Force enterprise VPN (MPLS L3VPN with GETVPN), with management systems hosted on VMware at the data centers.

Experience and Education

• 8+ years of enterprise or DoD network engineering.
• 2+ years of hands-on work with Cisco SD-WAN plus Palo Alto or F5.
• Bachelor's degree in a technical field preferred.

Certifications

• IAT Level II (required).
• CCNP Enterprise preferred.

Required Qualifications

1. Clearance: Active Secret clearance at the time of submission, eligible for SIPRNet accounts. U.S. citizen.
2. Cisco SD-WAN: Hands-on production deployment of Cisco SD-WAN (Viptela or Catalyst), including SD-WAN Manager, configuration groups or templates, centralized policy and edge router onboarding.
3. Palo Alto and F5: Hands-on Palo Alto Networks next-generation firewall configuration (virtual and physical appliances) and F5 BIG-IP load balancing and inspection, including TLS decryption and service chaining. This role requires hands-on experience with at least one.
4. Security services: Working knowledge of PKI and certificates, SIEM log forwarding, multi-factor authentication and public cloud networking (AWS, Azure or GCP).
5. Routing and switching: Strong working knowledge of BGP and OSPF, VRFs and MPLS L3VPN, VLANs with 802.1Q and Q-in-Q trunking, and IPsec.
6. DoD networks: Experience on DoD or federal networks, including DISA STIG and NIST SP 800-53 hardening, change control and boundary approval processes.
7. Workforce qualification: Holds an IAT Level II baseline certification (for example CompTIA Security+ CE) and meets DoD 8140 qualification for the assigned work role before receiving privileged access, and can complete the DD Form 2875 privileged access process.
8. Documentation: Produces accurate logical and physical diagrams, IP plans and as-built records.
9. Teamwork: Works well inside a multi-vendor integration team and communicates clearly with Government network operators.

Preferred Qualifications

• Air Force networks: Air Force enterprise network (AFNet) operations or base communications experience, including work with Air Force network operations squadrons.
• Vendor certifications: Palo Alto PCNSE, F5 Certified BIG-IP Administrator or higher, and Cisco 300-415 ENSDWI.
• Classified networks: TACLANE configuration and SIPRNet circuit experience.
• DISA connections: Experience with DISA connection and peering processes.
• Cisco platforms: Catalyst 8500-series SD-WAN edge routers, Catalyst 9600-series switching and Cisco Catalyst Center (formerly DNA Center).
• Zero Trust: Familiarity with Zero Trust architectures, ZTNA and the DoD Zero Trust strategy; AppGate experience is a plus.
• Automation: Python, Ansible, NETCONF or RESTCONF.
• Monitoring: SolarWinds, Splunk or Cribl.
• Virtual networking: VMware vSphere networking in data center deployments.

VAE, Inc. is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law.