Cloud / Network Security Engineer

Etelligent-Group-LLC; Bethesda (MD); Hybrid; USD 130,000 - 140,000; Full time

Job summary

eTel is seeking an experienced network and cloud security engineer to contribute to NIH's Future State ZTA design patterns under the NIH GRC Zero Trust Architecture project for the NIH OCIO. You will work in the Architecture Pod on Subtasks 2–4, crafting reference architectures, patterns, and control mappings for NIH teams to implement.

The role is design and advisory in nature, with hands-on engineering staying essential to validate patterns and ensure secure, scalable solutions.

Qualifications

• Bachelor's degree plus 7+ years of network and/or cloud security engineering.
• Hands-on experience with identity-aware access, microsegmentation, and cloud security patterns in enterprise environments.
• Experience with firewalls, SSE/ZTNA, and native AWS or Azure security services.
• Security+ or a higher security certification.
• Ability to obtain NIH suitability determination and PIV credential; fluent in English.

Responsibilities

• Co-author cloud, on-premises, and hybrid reference architectures with the Senior ZT Architect.
• Design microsegmentation and workload-identity patterns; secure lab instrument access.
• Document how centrally provided network, endpoint, and logging services are inherited.
• Define policy anchors for network and device pillars and map controls to telemetry.
• Support Task 3 network use cases: flow baselining and policy validation.
• Support Task 4 gap assessment for network, device and cloud pillars and evidence expectations.
• Validate patterns with IC engineering teams (CIT, HPC, and clinical platform owners).

Skills

Identity-aware access

Microsegmentation

Cloud security patterns

Firewalls

SSE/ZTNA

Security certifications

Education

Bachelor's degree

Tools

AWS/Azure

Terraform/CloudFormation

Illumio

Zscaler

Firewalls (Palo Alto/Cisco)

Splunk/Microsoft Sentinel

Job description

Over the past 15 years, eTel has delivered essential solutions for the federal government by securing and managing data, providing scalable identity access, modernizing legacy systems, and building high-performance platforms. By integrating new technologies and ensuring reliable operations we help agencies stay prepared for future challenges As a premier technology solutions and services company to the US federal government, eTel possesses longstanding relationships across the federal civilian marketplace. Other customers include the broader Treasury Department, Commerce Department, and State Department.

eTel offers integrated CMMI Level 3 processes, tools, and techniques with innovative, cost-efficient, and secure solutions to address complex challenges. eTel also holds ISO 9001:2015, ISO/IEC 27001:2013, and ISO/IEC 20000-1:2018 certifications, and offers dedicated subject matter experts (SMEs) and thought leaders that possess a deep understanding of customers’ environments and challenges.

Work Location and On-Site/Telework Requirements: Hybrid – NIH, Bethesda, MD. On site for workshops and pilots (typically 1–2 days/week during the first 120 days, then as scheduled).

Clearance: All staff must obtain NIH suitability and a PIV credential and be fluent in English. Anyone doing risk or vulnerability testing needs a current T2 (BI) or higher investigation.

Salary Range: $130,000-$140,000 yearly salary

Overview:

You will co-author the cloud, network, and identity design patterns behind NIH's Future State ZTA under the NIH Governance, Risk & Compliance (GRC) Zero Trust Architecture (ZTA) Support Services task order for the NIH Office of the Chief Information Officer (OCIO). You will work in the Architecture Pod on Tasks 2, 3, and 4. This is a design and advisory role: you will produce reference architectures, patterns, and control mappings for NIH teams to implement, not operate NIH production systems. Deep hands-on engineering experience is still essential.

Responsibilities:

• Co-author the cloud, on-premises, and hybrid reference architectures (Subtask 2.2) with the Senior ZT Architect, as reusable design patterns with NIST SP 800-53 Rev 5 control mappings.
• Design microsegmentation and workload-identity patterns (NIST SP 800-207A, CISA and NSA Zero Trust guidance), software-defined perimeter for HPC clusters, and isolated VLANs with brokered remote access for laboratory instruments.
• Document how centrally provided network, endpoint, and logging services are inherited, as input to the Centrally Provided Services Matrix.
• Define technical policy anchors for the network and device pillars (segmentation policy in the controller, compliance policy in endpoint management). Map controls to telemetry so continuous-monitoring evidence is collected rather than written by hand.
• Support Task 3 network use cases: flow baselining to generate and validate microsegmentation policy, and lateral-movement anomaly detection.
• Support the Task 4 gap assessment for the network, device, and cloud pillars, and the evidence expectations in the ZTA Overlay.
• Validate patterns with IC engineering teams (CIT, HPC, and clinical platform owners).

Tools & Technology Environment: AWS and Azure (including GovCloud), cloud-native IAM and CSPM; SSE/ZTNA (e.g., Zscaler, Palo Alto); microsegmentation platforms (e.g., Illumio); Palo Alto/Fortinet/Cisco firewalls; Microsoft Defender, CrowdStrike, Forescout; Splunk/Microsoft Sentinel; Terraform/IaC; Git.

Required Qualifications:

• Bachelor's degree plus 7+ years of network and/or cloud security engineering.
• Hands-on experience with identity-aware access, microsegmentation, and cloud security patterns in enterprise environments.
• Experience with firewalls, SSE/ZTNA, and native AWS or Azure security services.
• Security+ or a higher security certification.
• Ability to obtain an NIH suitability determination and PIV credential; fluent in English.

Preferred Qualifications:

• A cloud security certification (AWS Security Specialty, AZ-500, or CCSP); PCNSE or CCNP Security.
• Experience in FedRAMP-authorized or GovCloud environments.
• Experience with research networks, HPC (Linux/Slurm), or operational technology/IoT device segmentation.
• Infrastructure-as-code (Terraform, CloudFormation) and experience writing security patterns as code.
• Current National Institutes of Health (NIH) or U.S. Department of Health and Human Services (HHS) experience is highly preferred.

Commitment to Diversity -
eTelligent Group provides equal employment opportunities (EEO) to all applicants without regard to race, color, religion, gender, sexual orientation, gender identity, nations origin, age, disability, genetic information, marital status, amnesty, status as a covered veteran, and any other characteristic provided in accordance with applicable, federal, state and local laws.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in eTelligent Group LLC’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.