CSfC Network Engineer Subject Matter Expert (SME)

Leidos; Fort Belvoir (VA); On-site; USD 120,000 - 150,000; Full time

Job summary

Leidos is seeking an experienced Network Engineer (SME) to support a major DoD modernization program at Fort Belvoir, VA. The role focuses on CSfC network design, secure VPNs, and multi-layer security across Cisco/Aruba platforms.

Candidates must hold an active TS/SCI clearance, DoD 8570 IAT Level II/III, and extensive DoD network engineering experience. Strong PKI, ISE/ClearPass, and CNSA familiarity are required for this critical mission role.

Qualifications

• Active TS/SCI clearance required at time of consideration.
• DoD 8570.01-M / DoD 8140 IAT Level II or III baseline certs required (e.g., Security+ CE, CySA+, CASP+, CISSP).
• Experience configuring Cisco IOS-XE/ASR and Aruba VPNs with IKEv2.
• Experience with Palo Alto NGFW, App-ID, User-ID, and URL filtering.
• Experience deploying 802.1X with Cisco ISE or Aruba ClearPass.

Responsibilities

• Architect, deploy, and maintain CSfC infrastructure across multi-layer networks.
• Configure CSfC architectures aligned with NSA packages; ensure compliance and encryption mandates.
• Implement and tune IPsec/SSL VPNs and dynamic routing (BGP/OSPF).
• Audit NGFW policies, IDS/IPS, and network access control.
• Prepare CSfC compliance artifacts and PMO submission packages.

Skills

CSfC Architecture

BGP/OSPF

802.1X/EAP-TLS

ISE/ClearPass

IPsec VPN

Palo Alto NGFW

PKI/OCSP

NSA CSfC

Education

Bachelor's degree or higher in STEM

DoD 8570 IAT Level II/III

Active TS/SCI

CCNP/CCIE or equivalent

Tools

Cisco IOS-XE/ASR

Aruba Mobility Controllers

Palo Alto PAN-OS

Cisco ISE

Aruba ClearPass

PKI management tools

Job description

Description

Leidos is seeking an experienced Network Engineer (SME) to join our Integrated Information Technology Support Services (I3TS) team, who will support an extensive digital modernization program critical to Defense Threat Reduction Agency (DTRA) in Fort Belvoir, VA. The Network Engineer will work closely with the Leidos and Government technical leadership team to help drive innovation, growth, and efficiencies within the I3TS portfolio.

Clearance: Must have an active TS/SCI clearance at time of consideration. U.S. Citizen is a must.

Primary Responsibilities:

TheCommercial Solutions for Classified (CSfC) Network & Security Engineerwill architect and operate secure, dual-layer cryptographic boundaries utilizingCisco and Aruba IPsec/SSL VPNsand dynamic routing (BGP/OSPF) in strict compliance with NSA Capability Packages. In this role, you will author and tunePalo Alto NGFW security policies and IDS/IPS threat prevention signatures, implement enterprise network access control and 802.1X policies viaCisco ISE and Aruba ClearPass, integrate enterprisePKI/OCSP services and hardened NTP, and generate key engineering artifacts required for NSA CSfC PMO registration and compliance auditing.

• Architect, deploy, and maintain CSfC infrastructure operating within Black/Gray/Red networks.

• Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Mobile Access (MA), Multi-Sight (MSC) Capability Packages, with Campus Wireless LAN (WLAN) experience a bonus. Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates.

• Understanding of NIAP approved list and monitors for changes

• Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Capability Packages (MSC, MA, and CWLAN). Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates.

• Implement enterprise routing protocols (BGP, OSPF) alongside redundant outer and inner IPsec VPN tunnels across Cisco and Aruba appliances. Configure remote access SSL VPNs and ensure end-to-end traffic separation.

• Author, optimize, and audit Palo Alto Next-Generation Firewall (NGFW) security policies, App-ID, User-ID, and URL filtering. Configure and tune Palo Alto IDS/IPS threat signatures, anti-spyware, and vulnerability protection.

• Architect and manage Cisco Identity Services Engine (ISE) and Aruba ClearPass policy managers for 802.1X network access control, RADIUS/TACACS+ administration, posture assessment, and endpoint profiling.

• Integrate enterprise Public Key Infrastructure (PKI) components, managing X.509 certificate lifecycles, Certificate Authorities (CAs), CRL/OCSP validation, and hardened, authenticated Network Time Protocol (NTP) infrastructure.

• Prepare CSfC compliance artifacts, Key Management Plans (KMPs), Continuous Monitoring Plans (CMPs), and registration packages for NSA CSfC PMO submission.

Basic Qualifications:

• Bachelor's degree or higher in Computer Science, Information Technology, Engineering, Engineering Management, Management Information Systems, or related STEM degree program, and 12-15 years of relevant experience. Specific experience, education and training may be considered in lieu of degree.

• 12+ years of progressive network engineering experience within DoD/DoW, federal, or defense contractor enterprise environments

• Active TS/SCI Clearance

• Active DoD 8570.01-M / DoD 8140 IAT Level II or III baseline certification (e.g., Security+ CE, CySA+, CASP+, or CISSP).

• Active Computing Environment certification, including one or more of: Cisco CCNA, CCNP, Aruba ACSA or ACSP

• Proven expertise configuring Cisco (IOS-XE/ASR) and Aruba (Mobility Controllers/Gateways) IPsec and SSL VPNs, including IKEv2, Suite B/CNSA cryptography, and dynamic routing (BGP, OSPF).

• Demonstrated engineering experience with Palo Alto Networks firewalls (PAN-OS), Panorama central management, and advanced IDS/IPS inspection profiles.

• Hands-on deployment experience with both Cisco ISE and/or Aruba ClearPass implementing 802.1X, EAP-TLS authentication, and role-based access policies.

• Strong working knowledge of X.509 certificates, CA hierarchy integration, certificate revocation lists (CRLs), OCSP, and secure NTP stratum synchronization.

• Direct prior experience preparing and successfully registering NSA CSfC Capability Package solutions (Mobile Access, Multi-Site Connectivity, or Campus WLAN).

• Deep understanding of Commercial National Security Algorithm (CNSA) Suite requirements, post-quantum readiness considerations, and hardware security modules (HSMs).

• Familiarity with Ansible, for automating network device configuration backups, policy compliance checks, and certificate rotations.

• Certified in any of the following - Cisco CCNP/CCIE (Security or Enterprise), Palo Alto PCNSE, Aruba Certified ClearPass Expert (ACCX), or Aruba Certified Mobility Expert (ACMX).

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 — and moving faster than anyone else dares.

Pay Range:

Pay Range -

The Leidos pay range for this job level is a general guideline onlyand not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.

Pay and Benefits

Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits.

Securing Your Data

Beware of fake employment opportunities using Leidos’ name. Leidos will never ask you to provide payment-related information during any part of the employment application process (i.e., ask you for money), nor will Leidos ever advance money as part of the hiring process (i.e., send you a check or money order before doing any work). Further, Leidos will only communicate with you through emails that are generated by the Leidos.com automated system – never from free commercial services (e.g., Gmail, Yahoo, Hotmail) or via WhatsApp, Telegram, etc. If you received an email purporting to be from Leidos that asks for payment-related information or any other personal information (e.g., about you or your previous employer), and you are concerned about its legitimacy, please make us aware immediately by emailing us at [e-mail].

If you believe you are the victim of a scam, contact your local law enforcement and report the incident to the U.S. Federal Trade Commission.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.