Lead Network Security Engineer
Location: Ft. Meade, MD
Work Type: Full Time
Clearance: Secret
Position Summary: GridIron IT is seeking an experienced Principal Network Security Engineer to design, engineer, and implement enterprise network security capabilities across a large, distributed network environment. The role advances network security architecture through strategic design and implementation efforts that improve enterprise security posture, segmentation, access control, and resiliency.
This position provides overall network security engineering support, including planning, designing, and evaluating network security components; developing architecture specifications; evaluating new technologies; performing needs assessments; and directing installation, configuration, testing, and tuning activities.
The successful candidate will serve as a technical leader and subject matter expert who can assess the current security architecture, define needed controls and segmentation, build practical implementation plans with realistic risk and rollback provisions, and direct engineers under aggressive timelines.
Primary Responsibilities
Network Security Engineering and Architecture
•
Design, engineer, and implement enterprise network security architecture spanning next-generation firewalls, intrusion detection and prevention, web and TLS proxies, VPN and encryption services, network access control, DNS security, and east-west security controls.
•
Evaluate the current network security architecture, identify gaps and improvement opportunities, estimate level of effort, assess implementation risk, and develop practical engineering plans.
•
Lead network segmentation and secure connectivity efforts, including data-flow mapping, security-zone and enclave design, firewall rule set and ACL review, routing and security policy coordination, cutover sequencing, validation, and stakeholder approval.
•
Design and implement network access control and device-posture enforcement, including identity and device authentication, posture assessment, policy enforcement points, remediation workflows, and phased enforcement rollout.
•
Advance zero-trust-aligned networking, micro-segmentation, least-privilege access policy, and encrypted-transport strategies.
•
Provide architecture specifications, evaluate emerging security technologies, and perform needs assessments to inform design and investment decisions.
•
Engineer secure connectivity between on-premises, cloud, and remote environments, including IPsec and TLS VPN, secure cloud interconnects, and perimeter and boundary protection designs.
•
Tune and optimize security controls to reduce false positives, close coverage gaps, and improve detection and enforcement without degrading network performance or availability.
Project Execution
•
Drive security engineering projects from concept through implementation, covering architecture evaluation, requirements analysis, dependency identification, design coordination, planning, execution, validation, and transition to operations.
•
Develop and manage implementation plans, schedules, cutover strategies, contingency plans, rollback procedures, validation steps, stakeholder communications, and change documentation for mission-critical changes.
•
Coordinate change windows, maintenance activities, test validation, and rollback procedures for high-impact security policy and infrastructure changes.
•
Partner with network architecture, cybersecurity, operations, project management, and technical SME teams to resolve blockers, manage dependencies, and reduce delivery risk.
•
Support accreditation and compliance activities, including security control implementation, STIG application, vulnerability remediation, POA&M support, and technical artifacts required for authorization.
Technical Leadership
•
Serve as the senior technical authority for network security design decisions, providing technical direction, mentoring, and day-to-day guidance to engineers, administrators, and analysts.
•
Organize technical priorities, track details across concurrent efforts, manage competing demands, and maintain accountability against aggressive schedules.
•
Provide clear, well-reasoned technical information and recommendations to government stakeholders and approval authorities.
•
Continuously improve engineering processes, documentation standards, implementation playbooks, migration runbooks, technical standards, and execution models.
Documentation
•
Network security architecture and logical/physical design diagrams
•
Data-flow diagrams, security-zone models, and segmentation designs
•
Firewall policy standards, rule set baselines, and ACL documentation
•
Port, protocol, and services requirements
•
Implementation and cutover plans with rollback and contingency procedures
•
Test and validation plans
•
Risk, dependency, and decision registers
•
Security control implementation statements and accreditation artifacts
•
Technical standards, playbooks, runbooks, and standard operating procedures
•
As-built and operations transition documentation
Key Success Factors
This role requires more than firewall administration. The engineer must be able to evaluate an enterprise network, identify meaningful exposure, design a segmentation and control model, and sequence implementation while maintaining enterprise availability.
The successful engineer will be equally comfortable with technical detail, including policy, routing, identity, certificates, inspection, and automation, and with presenting to cybersecurity authorities and approval boards to defend a design, its residual risk, and its dependencies.
Required Qualifications
•
Bachelor’s degree or equivalent experience and 12+ years of prior relevant experience, or Master’s degree with 10+ years of experience. Specific experience, education, and training may be considered in lieu of a degree.
•
Significant experience designing and implementing network security architecture in complex, large-scale enterprise environments.
•
Experience serving as a senior technical lead directing network and security engineers, administrators, analysts, or implementation resources.
•
Experience leading security engineering projects from planning through implementation, including requirements analysis, dependency management, contingency planning, execution oversight, validation, and operational transition.
•
Hands-on engineering experience with next-generation firewalls, intrusion detection and prevention systems, proxies and TLS inspection, VPN and encryption services, and network access control platforms.
•
Experience with network segmentation or similar secure connectivity efforts, including data-flow analysis, firewall and ACL policy review, routing changes, security-zone design, stakeholder coordination, and implementation planning.
•
Strong working knowledge of TCP/IP, routing protocols, switching, VLANs, DNS/DHCP/IPAM, NAT, QoS, and software-defined and cloud-connected network environments.
•
Hands-on experience with two or more of the following: Palo Alto, Cisco, Aruba, Dell, Infoblox, and Brocade.
•
Working knowledge of Federal Government application, server, and network security requirements, including NIST, FedRAMP, FISMA, RMF, DISA STIGs, and DoD cybersecurity requirements.
•
Demonstrated ability to organize work, track details, manage competing priorities, meet aggressive schedules, and drive complex technical efforts to completion.
•
Experience documenting security and network designs, implementation plans, risks, dependencies, and technical recommendations using Visio, PowerPoint, Cameo, or similar tools.
•
Excellent written and verbal communication skills, including experience briefing technical leadership, cybersecurity authorities, stakeholders, and approval boards.
•
Current IAT Level II or higher certification, such as Security+ or CISSP.
•
Active DoD Secret clearance.
Desired Qualifications
•
CISSP, Palo Alto PCNSE, Cisco CCNP Security, or equivalent advanced security certification.
•
Experience implementing Comply-to-Connect, 802.1X, or comparable network access control and device-posture enforcement at enterprise scale.
•
Experience with zero-trust architecture, micro-segmentation, SASE, or secure cloud connectivity designs.
•
Experience integrating network security platforms with SIEM, SOAR, ITSM, and analytics tooling.
•
Experience with security automation and infrastructure-as-code using Python, Ansible, REST APIs, or similar, including automated firewall policy management.
•
Experience with certificate and PKI management, encrypted-traffic inspection, and key management in enterprise environments.
•
Experience supporting RMF, eMASS, continuous monitoring, and audit or inspection activities.
•
Experience with Jira, Confluence, or other project and knowledge-management tools used to coordinate technical work across distributed engineering teams.
•
Experience developing repeatable engineering execution frameworks, implementation playbooks, migration runbooks, technical standards, and risk-reduction processes.
Clearance: Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information.
Compensation and Benefits
Salary Range: $110,000-$155,000 (Compensation is determined by various factors, including but not limited to location, work experience, skills, education, certifications, seniority, and business needs. This range may be modified in the future.)
Benefits: Gridiron offers a comprehensive benefits package including medical, dental, vision insurance, HSA, FSA, 401(k), disability & ADD insurance, life and pet insurance to eligible employees. Full-time and part-time employees working at least 30 hours per week on a regular basis are eligible to participate in Gridiron’s benefits programs.
Gridiron IT Solutions is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status or disability status.
Gridiron IT is a Women Owned Small Business (WOSB) headquartered in the Washington, D.C. area that supports our clients' missions throughout the United States. Gridiron IT specializes in providing comprehensive IT services tailored to meet the needs of federal agencies. Our capabilities include IT Infrastructure & Cloud Services, Cyber Security, Software Integration & Development, Data Solution & AI, and Enterprise Applications. These capabilities are backed by Gridiron IT's experienced workforce and our commitment to ensuring we meet and exceed our clients' expectations.