CSfC Network & Security Engineer - TS/SCI

Leidos LLC; Fort Belvoir (VA); On-site; USD 140,000 - 190,000; Full time

Job summary

Leidos seeks an experienced Network Engineer (SME) to support a CSfC-based modernization for the DTRA program at Fort Belvoir, VA. The role requires an active TS/SCI clearance and U.S. citizenship.

You will architect and operate secure, dual-layer cryptographic networks using Cisco and Aruba VPNs, implement dynamic routing (BGP/OSPF), and tune Palo Alto security policies. Collaboration with Leidos and government leadership is essential to ensure NSA CSfC compliance.

Qualifications

• 12+ years of progressive network engineering experience within DoD/DoW, federal, or defense contractor environments.
• Active TS/SCI clearance with DoD 8570.01-M / DoD 8140 IAT Level II/III baseline certification (e.g., Security+, CySA+, CASP+, CISSP).
• Hands-on experience with Cisco IOS-XE/ASR and Aruba IPsec/SSL VPNs, including IKEv2 and CNSA cryptography.

Responsibilities

• Architect and operate secure CSfC networks and VPNs across Cisco/Aruba platforms.
• Configure 802.1X, EAP-TLS, and posture assessment using Cisco ISE or Aruba ClearPass.
• Develop and audit CSfC artifacts and NSA CSfC registration packages.
• Tune Palo Alto NGFW policies, IDS/IPS, and App-ID/User-ID/URL filtering.
• Implement PKI/OCSP, NTP hardening, and certificate lifecycle management.

Skills

CSfC

BGP/OSPF

IPsec/SSL VPNs

Palo Alto PAN-OS

Cisco ISE / Aruba ClearPass

X.509 / PKI

NSA CSfC compliance

Ansible

Security+ / CISSP / CASP / CySA+

SCIF / DoD networks

Education

Bachelor's degree or higher in STEM

Tools

Cisco IOS-XE/ASR

Aruba Mobility Controllers

Palo Alto Networks PAN-OS

Cisco ISE / Aruba ClearPass

Job description

Leidos seeks an experienced Network Engineer (SME) to support a CSfC-based modernization for the DTRA program at Fort Belvoir, VA. The role requires an active TS/SCI clearance and U.S. citizenship.

You will architect and operate secure, dual-layer cryptographic networks using Cisco and Aruba VPNs, implement dynamic routing (BGP/OSPF), and tune Palo Alto security policies. Collaboration with Leidos and government leadership is essential to ensure NSA CSfC compliance.