Cisco ISE NAC Architect – Hybrid/Zero-Trust Security

M&T Bank Corporation; Buffalo (NY); Hybrid; USD 116,000 - 194,000; Full time

Job summary

M&T Bank Corporation seeks a senior security engineer to implement and support enterprise Cisco ISE solutions, expanding secure access across wired, wireless, VPN, and cloud environments. The role involves mentoring engineers, strengthening Zero Trust controls, and driving large-scale security projects.

The engineer will collaborate with Cybersecurity, Network Engineering, and Identity teams, with four days onsite at Seneca One Buffalo and one day per week from home.

Qualifications

• Bachelor's degree with 5+ years of relevant experience, or 9+ years combined education/work experience in cybersecurity.
• Advanced understanding of security system development, infrastructure lifecycle, and architecture.

Responsibilities

• Implement Cisco ISE-based NAC solutions for enterprise-wide AAA services (802.1X, RADIUS, TACACS+).
• Configure and maintain Cisco ISE policies, device profiling, posture assessment, guest access, and BYOD onboarding.
• Develop and maintain RBAC and dynamic authorization policies; apply network segmentation strategies (Cisco TrustSec, SGTs).
• Support testing, deployments, upgrades, patches, integrations, and policy changes across wired, wireless, and VPN environments.
• Manage ISE infrastructure lifecycle, including HA, certificates, and source integrations; integrate with AD/LDAP/PKI, SIEM, and SOAR tools.
• Develop automation/orchestration to streamline user provisioning, policy management, and endpoint onboarding.
• Analyze authentication events to identify risks, optimize policies, and improve user experience.
• Troubleshoot complex NAC issues; partner with multiple teams to implement secure access aligned with Zero Trust.

Skills

Cisco ISE

NAC

AAA services

Zero Trust

Policy management

Mentoring

Education

Bachelor's degree

Tools

Active Directory

LDAP

PKI

SIEM

Security orchestration tools

Job description

M&T Bank Corporation seeks a senior security engineer to implement and support enterprise Cisco ISE solutions, expanding secure access across wired, wireless, VPN, and cloud environments. The role involves mentoring engineers, strengthening Zero Trust controls, and driving large-scale security projects.

The engineer will collaborate with Cybersecurity, Network Engineering, and Identity teams, with four days onsite at Seneca One Buffalo and one day per week from home.