Cloud / Network Security Engineer

eTelligent Group; Bethesda (MD); Hybrid; USD 130,000 - 140,000; Full time

Job summary

eTel is seeking an experienced ZTA Architect to co-create cloud, on-premises, and hybrid reference architectures for NIH. You will design microsegmentation, workload-identity patterns, and secure access patterns while mapping controls to telemetry for continuous evidence collection.

You will collaborate with NIH OCIO and IC engineering teams to produce reusable design patterns and ensure compliant, secure architectures for NIH Future State ZTA initiatives.

Qualifications

• Bachelor's degree + 7+ years in network or cloud security engineering.
• Hands-on experience with identity-aware access, microsegmentation, and cloud security patterns in enterprise environments.
• Experience with firewalls, SSE/ZTNA, and native AWS or Azure security services.
• Security+ or a higher security certification.
• Ability to obtain NIH suitability determination and PIV credential; fluent in English.

Responsibilities

• Co-author the cloud, on-premises, and hybrid reference architectures with the Senior ZT Architect, as reusable design patterns with NIST SP 800-53 Rev 5 control mappings.
• Design microsegmentation and workload-identity patterns; software-defined perimeter for HPC clusters; isolated VLANs with brokered remote access for laboratory instruments.
• Document how centrally provided network, endpoint, and logging services are inherited, input to the Centrally Provided Services Matrix.
• Define technical policy anchors for the network and device pillars; map controls to telemetry for continuous-monitoring evidence.
• Support Task 3 network use cases: flow baselining to generate and validate microsegmentation policy, and lateral-movement anomaly detection.
• Support Task 4 gap assessment for the network, device, and cloud pillars, and the evidence expectations in the ZTA Overlay.
• Validate patterns with IC engineering teams (CIT, HPC, and clinical platform owners).

Skills

Cloud security

Network security

Identity access

Zero Trust

Firewalls

Security+ certified

Education

Bachelor's degree in related field

Tools

AWS

Azure

Illumio

Terraform

Palo Alto

Job description

Company Overview:
Over the past 15 years, eTel has delivered essential solutions for the federal government by securing and managing data, providing scalable identity access, modernizing legacy systems, and building high-performance platforms. By integrating new technologies and ensuring reliable operations we help agencies stay prepared for future challenges As a premier technology solutions and services company to the US federal government, eTel possesses longstanding relationships across the federal civilian marketplace. Other customers include the broader Treasury Department, Commerce Department, and State Department.

Company Overview:
Over the past 15 years, eTel has delivered essential solutions for the federal government by securing and managing data, providing scalable identity access, modernizing legacy systems, and building high-performance platforms. By integrating new technologies and ensuring reliable operations we help agencies stay prepared for future challenges As a premier technology solutions and services company to the US federal government, eTel possesses longstanding relationships across the federal civilian marketplace. Other customers include the broader Treasury Department, Commerce Department, and State Department.
eTel offers integrated CMMI Level 3 processes, tools, and techniques with innovative, cost-efficient, and secure solutions to address complex challenges. eTel also holds ISO 9001:2015, ISO/IEC 27001:2013, and ISO/IEC 20000-1:2018 certifications, and offers dedicated subject matter experts (SMEs) and thought leaders that possess a deep understanding of customers' environments and challenges.
Work Location and On-Site/Telework Requirements: Hybrid – NIH, Bethesda, MD. On site for workshops and pilots (typically 1–2 days/week during the first 120 days, then as scheduled).
Citizenship: U.S. Citizenship required
Clearance: All staff must obtain NIH suitability and a PIV credential and be fluent in English. Anyone doing risk or vulnerability testing needs a current T2 (BI) or higher investigation.
Salary Range: $130,000-$140,000 yearly salary

Overview:

You will co-author the cloud, network, and identity design patterns behind NIH's Future State ZTA under the NIH Governance, Risk & Compliance (GRC) Zero Trust Architecture (ZTA) Support Services task order for the NIH Office of the Chief Information Officer (OCIO). You will work in the Architecture Pod on Tasks 2, 3, and 4. This is a design and advisory role: you will produce reference architectures, patterns, and control mappings for NIH teams to implement, not operate NIH production systems. Deep hands‑on engineering experience is still essential.

Responsibilities:

• Co-author the cloud, on-premises, and hybrid reference architectures (Subtask 2.2) with the Senior ZT Architect, as reusable design patterns with NIST SP 800-53 Rev 5 control mappings.
• Design microsegmentation and workload-identity patterns (NIST SP 800-207A, CISA and NSA Zero Trust guidance), software-defined perimeter for HPC clusters, and isolated VLANs with brokered remote access for laboratory instruments.
• Document how centrally provided network, endpoint, and logging services are inherited, as input to the Centrally Provided Services Matrix.
• Define technical policy anchors for the network and device pillars (segmentation policy in the controller, compliance policy in endpoint management). Map controls to telemetry so continuous‑monitoring evidence is collected rather than written by hand.
• Support Task 3 network use cases: flow baselining to generate and validate microsegmentation policy, and lateral‑movement anomaly detection.
• Support the Task 4 gap assessment for the network, device, and cloud pillars, and the evidence expectations in the ZTA Overlay.
• Validate patterns with IC engineering teams (CIT, HPC, and clinical platform owners).

Tools & Technology Environment: AWS and Azure (including GovCloud), cloud-native IAM and CSPM; SSE/ZTNA (e.g., Zscaler, Palo Alto); microsegmentation platforms (e.g., Illumio); Palo Alto/Fortinet/Cisco firewalls; Microsoft Defender, CrowdStrike, Forescout; Splunk/Microsoft Sentinel; Terraform/IaC; Git.

Required Qualifications:

• Bachelor's degree plus 7+ years of network and/or cloud security engineering.
• Hands‑on experience with identity‑aware access, microsegmentation, and cloud security patterns in enterprise environments.
• Experience with firewalls, SSE/ZTNA, and native AWS or Azure security services.
• Security+ or a higher security certification.
• Ability to obtain an NIH suitability determination and PIV credential; fluent in English.

Preferred Qualifications:

• A cloud security certification (AWS Security Specialty, AZ-500, or CCSP); PCNSE or CCNP Security.
• Experience in FedRAMP‑authorized or GovCloud environments.
• Experience with research networks, HPC (Linux/Slurm), or operational technology/IoT device segmentation.
• Infrastructure-as-code (Terraform, CloudFormation) and experience writing security patterns as code.
• Current National Institutes of Health (NIH) or U.S. Department of Health and Human Services (HHS) experience is highly preferred.

Commitment to Diversity:

eTelligent Group provides equal employment opportunities (EEO) to all applicants without regard to race, color, religion, gender, sexual orientation, gender identity, nations origin, age, disability, genetic information, marital status, amnesty, status as a covered veteran, and any other characteristic provided in accordance with applicable, federal, state and local laws.