Network Security Engineer CLEARED

Take2 Consulting, LLC; Fort Belvoir (VA); On-site; USD 140,000 - 200,000; Full time

Job summary

Take2 Consulting, LLC is seeking a Network Security Engineer to join our Fort Belvoir team. You will architect and operate CSfC-based networks with dual-layer cryptographic boundaries using Cisco and Aruba VPNs and dynamic routing in strict NSA-aligned packages.

You will implement 802.1X, PKI, and ISE/ClearPass for access control, build Palo Alto NGFW policies, and ensure compliance with CNSA and NSA CSfC requirements in a DoD environment.

Qualifications

• / Bachelor’s degree or higher in Computer Science, IT, Engineering, E/M or MIS, plus 12–15 years’ experience.
• / 12+ years of progressive network engineering experience in DoD/DoW, federal, or defense contractor environments.
• / Active TS/SCI Clearance.
• / DoD 8570.01-M / DoD 8140 IAT Level II/III baseline certification.
• / Proven expertise configuring Cisco/Aruba VPNs and IPsec/SSL.
• / Experience with Palo Alto firewalls, Panorama and IDS/IPS.
• / Experience with 802.1X, EAP-TLS, and ISE/ClearPass.
• / X.509 PKI, CA hierarchies, CRLs/OCSP, and secure NTP.

Responsibilities

• Architect and operate CSfC-based networks with dual-layer cryptographic boundaries.
• Author and tune Palo Alto security policies, configure 802.1X and PKI services.
• Design, deploy, and maintain CSfC architectures aligned with NSA packages.
• Implement routing protocols (BGP/OSPF) with redundant VPN tunnels.
• Prepare CSfC compliance artifacts and registration packages.

Skills

Top-Secret Clearance

Networking expertise

DoD/Federal experience

IPsec/SSL VPN

802.1X authentication

Education

Bachelor's degree or higher in Computer Science / IT / Engineering / MIS or related STEM

Tools

Cisco IOS-XE/ASR

Aruba Mobility Controllers/Gateways

Palo Alto PAN-OS

Cisco ISE / Aruba ClearPass

NSA CSfC compliance tools

Job description

Take2 has proven experience bridging the intersection of technology and people solutions. As a proven, trusted provider for our Federal and commercial clients, we provide the right solutions, at the right time through trusted partnerships, customized to solve our client’s unique business challenges. Take2 invests time, discipline, and rigor into our technology and people solutions, as well as utilizes our proprietary People Cloud. Whether we are bridging the gap between IT talent and our customers’ business challenges, Take2 will work as a partner to best resolve client needs.

Take2 is hiring a Network Security Engineerwho currently holds a minimum of a Top-Secret Clearance. This position is fully onsite, and it requires you to work out of Fort Belvoir, VA.

Job Description: Network Security Engineer

Primary Responsibilities

• The Commercial Solutions for Classified (CSfC) Network & Security Engineer will architect and operate secure, dual-layer cryptographic boundaries utilizing Cisco and Aruba IPsec/SSL VPNs and dynamic routing (BGP/OSPF) in strict compliance with NSA Capability Packages.
• In this role, you will author and tune Palo Alto NGFW security policies and IDS/IPS threat prevention signatures, implement enterprise network access control and 802.1X policies via Cisco ISE and Aruba ClearPass, integrate enterprise PKI/OCSP services and hardened NTP, and generate key engineering artifacts required for NSA CSfC PMO registration and compliance auditing.
• Architect, deploy, and maintain CSfC infrastructure operating within Black/Gray/Red networks.
• Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Mobile Access (MA), Multi-Sight (MSC) Capability Packages, with Campus Wireless LAN (WLAN) experience a bonus. Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates.
• Understanding of NIAP approved list and monitors for changes
• Design, configure, and maintain multi-layered Commercial Solutions for Classified (CSfC) architectures in alignment with NSA Capability Packages (MSC, MA, and CWLAN).
• Ensure strict compliance with vendor diversity and dual-tunnel encryption mandates.
• Implement enterprise routing protocols (BGP, OSPF) alongside redundant outer and inner IPsec VPN tunnels across Cisco and Aruba appliances. Configure remote access SSL VPNs and ensure end-to-end traffic separation.
• Author, optimize, and audit Palo Alto Next-Generation Firewall (NGFW) security policies, App-ID, User-ID, and URL filtering. Configure and tune Palo Alto IDS/IPS threat signatures, anti-spyware, and vulnerability protection.
• Architect and manage Cisco Identity Services Engine (ISE) and Aruba ClearPass policy managers for 802.1X network access control, RADIUS/TACACS+ administration, posture assessment, and endpoint profiling.
• Integrate enterprise Public Key Infrastructure (PKI) components, managing X.509 certificate lifecycles, Certificate Authorities (CAs), CRL/OCSP validation, and hardened, authenticated Network Time Protocol (NTP) infrastructure.
• Prepare CSfC compliance artifacts, Key Management Plans (KMPs), Continuous Monitoring Plans (CMPs), and registration packages for NSA CSfC PMO submission.

Required Qualifications

• Bachelor's degree or higher in Computer Science, Information Technology, Engineering, Engineering Management, Management Information Systems, or related STEM degree program, and 12-15 years of relevant experience. Specific experience, education and training may be considered in lieu of degree.
• 12+ years of progressive network engineering experience within DoD/DoW, federal, or defense contractor enterprise environments
• Active TS/SCI Clearance
• Active DoD 8570.01-M / DoD 8140 IAT Level II or III baseline certification (e.g., Security+ CE, CySA+, CASP+, or CISSP).
• Active Computing Environment certification, including one or more of: Cisco CCNA, CCNP, Aruba ACSA or ACSP
• Proven expertise configuring Cisco (IOS-XE/ASR) and Aruba (Mobility Controllers/Gateways) IPsec and SSL VPNs, including IKEv2, Suite B/CNSA cryptography, and dynamic routing (BGP, OSPF).
• Demonstrated engineering experience with Palo Alto Networks firewalls (PAN-OS), Panorama central management, and advanced IDS/IPS inspection profiles.
• Hands-on deployment experience with both Cisco ISE and/or Aruba ClearPass implementing 802.1X, EAP-TLS authentication, and role-based access policies.
• Strong working knowledge of X.509 certificates, CA hierarchy integration, certificate revocation lists (CRLs), OCSP, and secure NTP stratum synchronization.
• Direct prior experience preparing and successfully registering NSA CSfC Capability Package solutions (Mobile Access, Multi-Site Connectivity, or Campus WLAN).
• Deep understanding of Commercial National Security Algorithm (CNSA) Suite requirements, post-quantum readiness considerations, and hardware security modules (HSMs).
• Familiarity with Ansible, for automating network device configuration backups, policy compliance checks, and certificate rotations.
• Certified in any of the following - Cisco CCNP/CCIE (Security or Enterprise), Palo Alto PCNSE, Aruba Certified ClearPass Expert (ACCX), or Aruba Certified Mobility Expert (ACMX)