Network Architect

Validatek; Fort Belvoir (VA); On-site; USD 120,000 - 140,000; Full time

Job summary

ValidaTek is seeking an experienced Network Engineer (SME) to join the I3TS team supporting a Defense program in Fort Belvoir, VA. You will collaborate with government leaders to drive modernization in networking and security services.

The role emphasizes CSfC architecture, NSA package alignment, and CA/PKI integration. Requires TS/SCI clearance, DoD experience, and advanced certifications. On-site work with strict security controls.

Qualifications

• Bachelor's degree or higher in a STEM field with 12–15 years of relevant experience.
• 12+ years of progressive network engineering in DoD/federal/defense contractor environments.
• Active TS/SCI Clearance.
• DoD 8570.01-M/8140 IAT Level II or III baseline certification (e.g., Security+ CE, CySA+, CASP+, or CISSP).
• Active Cisco/Aruba/Palo Alto certifications (CCNA/CCNP or similar).
• Experience with Cisco/Aruba IPsec and SSL VPNs, IKEv2, cryptography, and dynamic routing.

Responsibilities

• The CSfC Network & Security Engineer will architect and operate secure, dual-layer cryptographic boundaries using Cisco and Aruba VPNs and dynamic routing in NSA CSfC compliance.
• Architect, deploy, and maintain CSfC infrastructure within Black/Gray/Red networks.
• Design, configure, and maintain CSfC architectures aligned with NSA packages, MA/MSC, and CWLAN requirements.
• Implement enterprise routing protocols (BGP/OSPF) with redundant IPsec VPN tunnels and remote SSL VPNs.
• Author, optimize, and audit Palo Alto NGFW policies, IDS/IPS signatures, and vulnerability protections.
• Manage Cisco ISE and Aruba ClearPass for 802.1X NAC, RADIUS/TACACS+, posture assessment, and endpoint profiling.
• Integrate PKI components, managing certificates, CAs, and OCSP validation.
• Prepare CSfC compliance artifacts and registration packages for NSA PMO submission.

Skills

CSfC Networking

BGP/OSPF

VPN & PKI

NSA CSfC

I3TS teamwork

Education

Bachelor's degree or higher

Tools

Cisco IOS-XE

Aruba Mobility Controllers

Palo Alto PAN-OS

Cisco ISE

Aruba ClearPass

PKI/OCSP

NTP

Job description

If you are a job seeker with a disability and require a reasonable accommodation to apply for one of our jobs, you will find the contact information to request the appropriate accommodation by visiting the following our Accessibility Accomodation for Applicants page.

Network Architect

• Posted on September 8, 2026

Locations

Showing 1 location

• On-site
• Pay or shift range: $120,000 USD to $140,000 USD
  Actual salary will be based on a variety of factors including but not limited to experience, geographic location, contract affordability, internal equity, education, and certifications.The upper end of the salary range may be reserved for individuals who have demonstrated tenure with the company, seniority, and proven excellent performance. This includes factors such as education, certifications, and extensive/unique experience beyond what is required.
• Information Systems
• Full-Time
• Requisition #: NETWO001948

Description

Company Overview:

At ValidaTek, we modernize and optimize IT services to solve some of the most critical challenges facing federal civilian and defense agencies. From customers to partners to top-talent employees, ValidaTek puts people first, empowering them to exceed expectations and transform government organizations. Our employees are building purpose-driven careers, not just filling jobs. We bring together people with many different perspectives, experiences, and talents to drive innovation and achieve more together than we can individually. Our commitment to quality and performance optimization is the reason why our IT Service Projects and New Development Projects have been appraised at CMMI Maturity Level 5, positioning us as one of a handful of elite companies to receive the highest form of third-party validation. www.validatek.com

Summary:

ValidaTek is seeking an experienced Network Engineer (SME) to join our Integrated Information Technology Support Services (I3TS) team, who will support an extensive digital modernization program critical to Defense Threat Reduction Agency (DTRA) in Fort Belvoir, VA. The Network Engineer will work closely with the government technical leadership team to help drive innovation, growth, and efficiencies within the I3TS portfolio.
Responsibilities:

• The Commercial Solutions for Classified (CSfC) Network & Security Engineer will architect and operate secure, dual-layer cryptographic boundaries utilizing Cisco and Aruba IPsec/SSL VPNs and dynamic routing (BGP/OSPF) in strict compliance with NSA Capability Packages. In this role, you will author and tune Palo Alto NGFW security policies and IDS/IPS threat prevention signatures, implement enterprise network access control and 802.1X policies via Cisco ISE and Aruba ClearPass, integrate enterprise PKI/OCSP services and hardened NTP, and generate key engineering artifacts required for NSA CSfC PMO registration and compliance auditing.
• Architect, deploy, and maintain CSfC infrastructure operating within Black/Gray/Red networks.
• Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Mobile Access (MA), Multi-Sight (MSC) Capability Packages, with Campus Wireless LAN (WLAN) experience a bonus. Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates.
• Understanding of NIAP approved list and monitors for changes
• Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Capability Packages (MSC, MA, and CWLAN). Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates.
• Implement enterprise routing protocols (BGP, OSPF) alongside redundant outer and inner IPsec VPN tunnels across Cisco and Aruba appliances. Configure remote access SSL VPNs and ensure end-to-end traffic separation.
• Author, optimize, and audit Palo Alto Next-Generation Firewall (NGFW) security policies, App-ID, User-ID, and URL filtering. Configure and tune Palo Alto IDS/IPS threat signatures, anti-spyware, and vulnerability protection.
• Architect and manage Cisco Identity Services Engine (ISE) and Aruba ClearPass policy managers for 802.1X network access control, RADIUS/TACACS+ administration, posture assessment, and endpoint profiling.
• Integrate enterprise Public Key Infrastructure (PKI) components, managing X.509 certificate lifecycles, Certificate Authorities (CAs), CRL/OCSP validation, and hardened, authenticated Network Time Protocol (NTP) infrastructure.
• Prepare CSfC compliance artifacts, Key Management Plans (KMPs), Continuous Monitoring Plans (CMPs), and registration packages for NSA CSfC PMO submission.

Qualifications:

• Bachelor's degree or higher in Computer Science, Information Technology, Engineering, Engineering Management, Management Information Systems, or related STEM degree program, and 12-15 years of relevant experience. Specific experience, education and training may be considered in lieu of degree.
• 12+ years of progressive network engineering experience within DoD/DoW, federal, or defense contractor enterprise environments
• Active TS/SCI Clearance
• Active DoD 8570.01-M / DoD 8140 IAT Level II or III baseline certification (e.g., Security+ CE, CySA+, CASP+, or CISSP).
• Active Computing Environment certification, including one or more of: Cisco CCNA, CCNP, Aruba ACSA or ACSP
• Proven expertise configuring Cisco (IOS-XE/ASR) and Aruba (Mobility Controllers/Gateways) IPsec and SSL VPNs, including IKEv2, Suite B/CNSA cryptography, and dynamic routing (BGP, OSPF).
• Demonstrated engineering experience with Palo Alto Networks firewalls (PAN-OS), Panorama central management, and advanced IDS/IPS