Network Engineer

Apex Systems; Richmond (VA); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Medical, dental, vision

401K with company match

HSA

Employee Assistance Program (EAP)

Job summary

Everforth Apex is seeking an experienced Network Engineer to design, secure, and operate a hybrid network spanning on-premise infrastructure and AWS for a major migration. You will own end-to-end connectivity for 500+ remote sites and mission-critical state police applications, engineering VPNs with high availability and secure, scalable networking.

You will work with Infrastructure, Platform Engineering, and state partners to ensure CJIS, COV, and FBI security compliance while supporting 24x7

Qualifications

• 10+ years of hands-on enterprise network engineering across routing, switching, firewalling, and secure remote connectivity.
• Experience designing and operating IPsec VPNs with BGP-based failover.
• Familiarity with CJIS, COV, FBI security requirements and audits.

Responsibilities

• Design, secure, and operate hybrid network across on-premise and AWS.
• Own end-to-end connectivity for 500+ remote sites and mission-critical applications.
• Engineer site-to-site VPNs, high availability, and multi-path connectivity.
• Manage security, ACLs, routing policies, and device configurations.
• Perform on-call rotation and incident management in ITSM environments.

Skills

Enterprise network engineering

AWS networking

VPC design

Site-to-Site VPN

BGP routing

Security controls & least privilege

CJIS/COV/FBI security

ITSM tooling (FootPrints, ServiceNow)

Infrastructure as code (Terraform, CFN

On-call incident response

Education

Bachelor's degree in IT or related field

Tools

FootPrints

ServiceNow

Terraform

CloudFormation

Ansible

Route 53 / AWS networking tools

Transit Gateway

Direct Connect

Job description

Job Description

Client is seeking an experienced Network Engineer to design, secure, and operate the agency’s hybrid network across on-premise infrastructure and AWS as part of a major migration from on-premise systems to AWS. This role owns end-to-end connectivity for mission-critical state police systems spanning 500+ remote sites and applications including VCIN, CCH, and LiveScan while engineering the highly available site-to-site VPN and hybrid connectivity fabric that links VSP facilities, VITA and partner networks, and AWS. You will work closely with Infrastructure, Platform Engineering, and with state partners, to ensure all network components meet CJIS, COV, and FBI security requirements. Hybrid Network Operations & Secure Connectivity

• Maintain a stable, resilient, and secured network across 500+ remote offices, ensuring reliable connectivity for mission-critical state police applications (VCIN, CCH, LiveScan, and similar).
• Govern ACLs, routing policies, and device configurations through quarterly reviews evidencing alignment with security and compliance requirements.
• Provide support on a 24x7 on-call rotation, returning critical production calls within 30 minutes and driving network incidents to resolution.
• Review and update assigned FootPrints and other tickets on receipt and work with Help Desk, Procurement and other teams on equipment moves, adds, and changes.
• Perform onsite surveys for site modernization, new site implementations, and decommissioning. Install, terminate, and test structured cabling for new deployments and office expansions, and safely remove outdated hardware and cabling in compliance with asset disposal protocols. Site-to-Site VPN Engineering & High Availability
• Design, build, and operate redundant IPsec site-to-site VPNs connecting clients facilities, VITA and partner networks, and Cloud, including the tunnels supporting clients operational, and law enforcement systems.
• Ensure resilience across customer gateways and diverse carrier paths so no single device, circuit is a point of failure.
• Set up dynamic failover using BGP over VPN by tuning basic route settings and filters so traffic automatically moves to the backup connection when needed.
• Standardize IKEv2 settings including Phase 1/Phase 2 timers, PFS groups, rekey behavior, and retire outdated cipher suites to improve VPN security and consistency
• Enable DPD, tunnel state monitoring, and per-tunnel alerting so partial failures surface before users report them.
• Build and manage AWS Site-to-Site VPN attachments to Transit Gateway and Virtual Private Gateway, using accelerated VPN where latency or jitter sensitivity requires it.
• Execute scheduled failover tests against RTO targets, manage pre-shared keys and certificates through approved secrets management, and maintain a complete VPN inventory of endpoints, tunnel pairs, encryption domains, and maintenance windows.
• Support AWS Cloud migration efforts, hybrid connectivity setup, and post-migration stabilization.
• Design, document, and validate VPC networking subnets, route tables, security groups, network ACLs, VPC endpoints and PrivateLink under an IP address management and CIDR strategy.
• Build and operate Transit Gateway hub-and-spoke topologies with route table segmentation and controlled inter-VPC and inter-account routing.
• Implement AWS Direct Connect and hybrid DNS using Route 53 Resolver endpoints and forwarding rules.
• Deploy ingress and egress inspection using AWS Network Firewall, Gateway Load Balancer, or approved third-party virtual appliances.
• Perform discovery and remediate on-prem network gaps and segmentation issues that could affect a secure cloud migration.
• Monitor post-migration connectivity, routing, access controls, network performance, and collaborate with state partners, cloud teams, and vendors to ensure secure, compliant, and resilient hybrid designs.
• Apply secure-by-design, least-privilege, and Zero Trust principles to routing, segmentation, encrypted transport, and access controls, including MFA for all admin access.
• Align network configurations and audit evidence with CJIS Security Policy, COV, and FBI security requirements.
• Strengthen device access controls by using centralized login and auditing systems, ensuring only authorized users can manage network equipment.
• Support ongoing vulnerability scanning, remediation planning, and periodic access reviews across the network estate.
• Use VPC Flow Logs, Traffic Mirroring, CloudTrail, and GuardDuty findings for network threat detection, investigation, and forensics.
• Identify network single points of failure across infrastructure and routing, and ensure DR segments and backup paths meet the same security standards.
• Maintain accurate hardware and software inventory for SPHQ and DR, documenting new network equipment in FootPrints within two weeks of arrival.
• Deliver network components as code using Terraform, CloudFormation, Ansible under Git-based version control with peer review, automating configuration deployment, compliance checking, and drift detection across on-premise and cloud estates.
• Build and improve monitoring dashboards, syslog feeds, SNMP and streaming telemetry, and alert thresholds for proactive detection of outages and anomalies.
• Participate in bi-weekly incident reviews, lead network-related post-mortems, and ensure corrective actions are implemented.
• Create and maintain network diagrams, inventories, standards, desk procedures, and troubleshooting guides current.
• Manage service requests, change control, ticket workflows, and coordinate connectivity changes with agency teams and partners with procurement to optimize network-related costs.
• 10+ years of hands-on enterprise network engineering across routing, switching, firewalling, and secure remote connectivity.
• Proven design and operation of redundant IPsec site-to-site VPNs with BGP-based failover between on-premise and cloud environments.
• Working command of network security controls: segmentation, least privilege, encryption in transit, MFA for administrative access, and device hardening.
• Experience supporting 24x7 operations, on-call rotation, and structured incident and change management using ITSM tooling such as FootPrints or ServiceNow.
• Strong AWS networking experience across VPC design, Transit Gateway, Direct Connect, Site-to Site VPN, Route 53, security groups, and network ACLs.
• Demonstrated delivery of network infrastructure as code using Terraform or CloudFormation under version control.
• Familiarity with CJIS, COV, or similar security frameworks, and ability to meet CJIS personnel security requirements including a background investigation.

Everforth Apex is a world-class IT services company that serves thousands of clients across the globe. When you join Everforth Apex, you become part of a team that values innovation, collaboration, and continuous learning. We offer quality career resources, training, certifications, development opportunities, and a comprehensive benefits package. Our commitment to excellence is reflected in many awards, including ClearlyRateds Best of Staffing® in Talent Satisfaction in the United States and Great Place to Work® in the United Kingdom and Mexico.

Everforth Apex benefits overview: Everforth Apex offers a range of supplemental benefits, including medical, dental, vision, life, disability, and other insurance plans that offer an optional layer of financial protection. We offer an ESPP (employee stock purchase program) and a 401K program which allows you to contribute typically within 30 days of starting, with a company match after 12 months of tenure. Everforth Apex also offers a HSA (Health Savings Account on the HDHP plan), a SupportLinc Employee Assistance Program (EAP) with up to 8 free counseling sessions, a corporate discount savings program and other discounts. In terms of professional development, Everforth Apex hosts an on‑demand training program, provides access to certification prep and a library of technical and leadership courses/books/seminars once you have 6+ months of tenure, and certification discounts and other perks to associations that include CompTIA and IIBA. Everforth Apex has a dedicated customer service team for our Consultants that can address questions around benefits and other resources, as well as a certified Career Coach. You can access a full list of our benefits, programs, support teams and resources within our ‘Welcome Packet’ as well, which an Everforth Apex team member can provide.

Everforth Apex Systems is an equal opportunity employer. We do not discriminate or allow discrimination on the basis of race, color, religion, creed, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law. Everforth Apex will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable law.