Network Engineer/Architect with Security Clearance

Sarela Technology Solutions; Fort Belvoir (VA); On-site; USD 155,000 - 165,000; Full time

Job summary

SarelaTech is seeking an experienced Network Engineer (SME) to support a Defense Threat Reduction Agency program at Fort Belvoir, VA. You will work with Leidos and government leadership to drive modernization within the I3TS portfolio.

Responsibilities include CSfC design, CSfC policy management, and PKI/IKEv2-based VPN engineering across Cisco/Aruba platforms, with a focus on secure, layered networking and compliance.

Qualifications

• Bachelor's degree or higher in a STEM field and 12–15 years of relevant experience.
• 12+ years of progressive network engineering experience within DoD/DoW, federal, or defense contractor environments.
• Active TS/SCI Clearance.
• Active DoD 8570.01-M / DoD 8140 IAT Level II or III baseline certification (e.g., Security+ CE, CySA+, CASP+, or CISSP).
• Active certifications: Cisco CCNP/CCIE (Security or Enterprise), Palo Alto PCNSE, Aruba ACCX/ACMX.

Responsibilities

• Architect CSfC infrastructure across Black/Gray/Red networks.
• Configure CSfC architectures aligned with NSA MSC/MA/CWLAN guidance.
• Implement enterprise routing with BGP/OSPF and IPsec VPNs; manage SSL VPNs.

Skills

TS/SCI Clearance

DoD network experience

IAT Level II/III

Cisco IOS-XE/ASR

Palo Alto PAN-OS

802.1X EAP-TLS

ISE/ClearPass

CSfC knowledge

Education

Bachelor's degree or higher in CS/IT/Engineering

Tools

Cisco ISE

Aruba ClearPass

Palo Alto Panorama

Job description

Job Description

SarelaTech is seeking an experienced Network Engineer (SME) to join our Integrated Information Technology Support Services (I3TS) team, who will support an extensive digital modernization program critical to Defense Threat Reduction Agency (DTRA) in Fort Belvoir, VA. The Network Engineer will work closely with the Leidos and Government technical leadership team to help drive innovation, growth, and efficiencies within the I3TS portfolio.

Primary Responsibilities

• Architect, deploy, and maintain CSfC infrastructure operating within Black/Gray/Red networks.
• Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Mobile Access (MA), Multi-Sight (MSC) Capability Packages, with Campus Wireless LAN (WLAN) experience a bonus. Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates.
• Understanding of NIAP approved list and monitors for changes
• Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Capability Packages (MSC, MA, and CWLAN). Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates.
• Implement enterprise routing protocols (BGP, OSPF) alongside redundant outer and inner IPsec VPN tunnels across Cisco and Aruba appliances. Configure remote access SSL VPNs and ensure end-to-end traffic separation.
• Author, optimize, and audit Palo Alto Next-Generation Firewall (NGFW) security policies, App-ID, User-ID, and URL filtering. Configure and tune Palo Alto IDS/IPS threat signatures, anti-spyware, and vulnerability protection.
• Architect and manage Cisco Identity Services Engine (ISE) and Aruba ClearPass policy managers for 802.1X network access control, RADIUS/TACACS+ administration, posture assessment, and endpoint profiling.
• Integrate enterprise Public Key Infrastructure (PKI) components, managing X.509 certificate lifecycles, Certificate Authorities (CAs), CRL/OCSP validation, and hardened, authenticated Network Time Protocol (NTP) infrastructure.
• Prepare CSfC compliance artifacts, Key Management Plans (KMPs), Continuous Monitoring Plans (CMPs), and registration packages for NSA CSfC PMO submission.

Required Qualifications

• Bachelor's degree or higher in Computer Science, Information Technology, Engineering, Engineering Management, Management Information Systems, or related STEM degree program, and 12-15 years of relevant experience. Specific experience, education and training may be considered in lieu of degree.
• 12+ years of progressive network engineering experience within DoD/DoW, federal, or defense contractor enterprise environments
• Active TS/SCI Clearance
• Active DoD 8570.01-M / DoD 8140 IAT Level II or III baseline certification (e.g., Security+ CE, CySA+, CASP+, or CISSP).
• Active Computing Environment certification, including one or more of: Cisco CCNA, CCNP, Aruba ACSA or ACSP
• Proven expertise configuring Cisco (IOS-XE/ASR) and Aruba (Mobility Controllers/Gateways) IPsec and SSL VPNs, including IKEv2, Suite B/CNSA cryptography, and dynamic routing (BGP, OSPF).
• Demonstrated engineering experience with Palo Alto Networks firewalls (PAN-OS), Panorama central management, and advanced IDS/IPS inspection profiles.
• Hands-on deployment experience with both Cisco ISE and/or Aruba ClearPass implementing 802.1X, EAP-TLS authentication, and role-based access policies.
• Strong working knowledge of X.509 certificates, CA hierarchy integration, certificate revocation lists (CRLs), OCSP, and secure NTP stratum synchronization.
• Direct prior experience preparing and successfully registering NSA CSfC Capability Package solutions (Mobile Access, Multi-Site Connectivity, or Campus WLAN).
• Deep understanding of Commercial National Security Algorithm (CNSA) Suite requirements, post-quantum readiness considerations, and hardware security modules (HSMs).
• Familiarity with Ansible, for automating network device configuration backups, policy compliance checks, and certificate rotations.
• Certified in any of the following - Cisco CCNP/CCIE (Security or Enterprise), Palo Alto PCNSE, Aruba Certified ClearPass Expert (ACCX), or Aruba Certified Mobility Expert (ACMX).

Compensation

$155,000.00 - $165,000.00 per year

We are an equal opportunity employer. All aspects of employment including the decision to hire, promote, discipline, or discharge, will be based on merit, competence, performance, and business needs. We do not discriminate on any basis or status protected under federal, state, or local law