Network Engineer - CBO

Innovim; Washington, Northern (District of Columbia, KY); Hybrid; USD 92,000 - 110,000; Full time

Job summary

Innovim is seeking a Network Engineer to provide secure engineering and operational support for a Cisco-based enterprise network within a U.S. legislative branch agency. The role emphasizes Zero Trust, least-privilege access, and continuous monitoring in compliance with NIST standards.

The position offers hybrid work in Washington, DC, with potential on-site requirements and opportunities for data-center involvement in Ashburn, VA. Requires 8+ years of Cisco experience and U.S.

Qualifications

• Bachelor's degree in a related field or equivalent experience.
• 8+ years of hands-on enterprise network engineering in Cisco environments.
• Proficiency in routing, switching, VLANs, DNS/DHCP, VPNs, and 802.1X network access control.
• Knowledge of NIST SP 800-53 controls and NIST SP 800-207 Zero Trust Architecture.
• Active Cisco certification (CCNP or CCNA) or equivalent demonstrable expertise.
• U.S. citizenship or permanent residence status; ability to obtain a Public Trust (Tier 2).

Responsibilities

• Operate, optimize, and troubleshoot Cisco core, distribution, access, and edge network infrastructure.
• Configure routing, switching, VLANs, DNS, DHCP, and VPN services securely.
• Implement and maintain network security controls aligned with NIST SP 800-53 (AC, CM, SC, AU).
• Enforce Zero Trust architecture with segmentation and least-privilege access.
• Deploy and manage 802.1X NAC and identity-aware access across all layers.
• Harden devices to secure baselines and MFA for admin access.
• Configure centralized logging and forward logs to the enterprise SIEM; support 24/7 monitoring.
• Conduct vulnerability assessments aligned with RMF; coordinate patching.
• Support incident response with network-level analysis and data collection.
• Develop network diagrams, baselines, and SOPs.
• Serve as adviser on tickets with cloud, Microsoft, and cybersecurity teams.

Skills

Routing & Switching

VLANs

VPNs

Zero Trust

Security best practices

Incident response

Education

Bachelor's degree in CS/IT/Engineering

Tools

Cisco CCNP/CCNA

Cisco ISE

Check Point / Palo Alto

Microsoft Sentinel / Splunk

SolarWinds

Job description

Location Washington, DC — hybrid; on-site as required by task assignment
Employment Type Full-time — contingent upon contract award
Salary Range $92,000 – $110,000
Clearance / Suitability Public Trust (Tier 2); U.S. citizenship or permanent residence required

Position Summary

The Network Engineer provides secure engineering and operational support for a U.S. legislative branch agency's Cisco-based enterprise network. The role designs, implements, and sustains secure network architectures that enforce Zero Trust principles — segmentation, micro-segmentation, and least-privilege access — while hardening and continuously monitoring switches, routers, and perimeter systems in accordance with federal cybersecurity standards (NIST SP 800-53 and NIST SP 800-207) and Cisco best practices.

Key Responsibilities

• Operate, optimize, and troubleshoot the Cisco core, distribution, access, and edge network infrastructure to ensure reliability, performance, and availability.
• Configure and manage routing, switching, VLANs, DNS, DHCP, and VPN services with secure, standards-aligned configurations.
• Implement and maintain network security controls aligned with NIST SP 800-53 (AC, CM, SC, AU control families).
• Enforce Zero Trust architecture per NIST SP 800-207, including network segmentation, micro-segmentation, and continuous verification of users and devices.
• Deploy and manage 802.1X port-based network access control (NAC) and least-privilege, identity-aware access across all network layers.
• Harden network devices to secure configuration baselines (e.g., Cisco Secure Configuration Guides); secure perimeter and public-facing assets through ingress/egress filtering, firewall rule optimization, and MFA for administrative access.
• Configure centralized logging and forward logs to the enterprise SIEM; support continuous, real-time (24/7) monitoring and alerting.
• Conduct continuous monitoring and vulnerability assessments aligned with the NIST Risk Management Framework (RMF); coordinate patching, firmware updates, and remediation.
• Support incident response with network-level analysis, containment actions, and forensic data collection.
• Perform root cause analysis (RCA) for network incidents; develop and maintain network diagrams, configuration baselines, and Standard Operating Procedures (SOPs).
• Serve as technical adviser on complex service-desk tickets, collaborating with cloud, Microsoft engineering, and cybersecurity teams.

Required Qualifications

• Bachelor's degree in Computer Science, Information Technology, Engineering, or a related field (equivalent experience considered).
• Minimum 8 years of hands-on enterprise network engineering experience in Cisco environments.
• Demonstrated expertise in routing and switching, VLANs, DNS/DHCP, VPNs, and 802.1X network access control.
• Working knowledge of NIST SP 800-53 controls and NIST SP 800-207 Zero Trust Architecture.
• Active Cisco certification (CCNP or CCNA) or equivalent demonstrable expertise.
• S. citizenship or permanent residence status; ability to obtain a Public Trust (Tier 2) determination.

Preferred Qualifications

• CCNP Enterprise or CCNP Security; CompTIA Security+ (DoD 8140/8570 IAT Level II).
• Experience with Cisco ISE, TrustSec/MACsec, and Catalyst 9300 StackWise environments.
• Experience with next-generation firewalls (Check Point or Palo Alto) and secure web gateways (e.g., iBoss).
• Familiarity with SIEM (Microsoft Sentinel or Splunk) and network monitoring tools (SolarWinds, ThousandEyes).
• Prior experience supporting federal or Congressional / legislative branch environments.

Clearance, Suitability & Security

U.S. citizenship or permanent residence status is required. The selected candidate must be able to obtain and maintain a Public Trust (Tier 2) suitability determination and will undergo an FBI criminal background check and U.S. Capitol Police fingerprinting prior to starting work, in accordance with the contract's security requirements. Remote work is authorized; however, on-site presence at the customer's facilities in Washington, DC (and, as needed, data-center/computing facilities in Ashburn, VA and Manassas, VA) may be required based on task assignment. Local travel to these sites is non-reimbursable. Core hours are 9:00 AM–6:00 PM ET, Monday–Friday; occasional after-hours or weekend maintenance activity may be required.

Compensation

Salary Range: $92,000 – $110,000, commensurate with experience, education, and certifications. INNOVIM offers a comprehensive benefits package including health, dental, and vision coverage, retirement savings, paid time off, and professional development support.

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities
This employer is required to notify all applicants of their rights pursuant to federal employment laws.For further information, please review the Know Your Rights notice from the Department of Labor.