Cyber Security Enigneer Jobs

Cyber Security Engineer (NAC / C2C Lead)

Level / experience

Mid–Senior, 5–8 years in cybersecurity; 2+ years enforcing NAC policy in production

Location

Onsite at the base

Reports to Engineering manager

Role summary

Hands-on engineer who configures and runs the C2C/NAC platform at the base: closes Step 1–3 gaps, builds and tunes policies, and executes Step 4 enforcement waves.

Key responsibilities

Close the remaining device discovery, classification, and interrogation gaps on the NAC platform.

Build and test posture checks and auto-remediation policies; validate on a pilot group before expanding.

Configure and validate integrations with ACAS, endpoint security/EDR, AD, SIEM, and ticketing.

Enable monitor mode, analyze failures, and tune policies before enforcement.

Execute enforcement waves with the network engineer; triage failures and roll back quickly when needed.

Identify, categorize, and document exception devices and support the base in getting waivers.

Document configurations, policies, and runbooks for handoff to base staff.

Required qualifications

Production experience administering and enforcing policy on a NAC platform (Forescout or Cisco ISE, matching the base) at scale of thousands of endpoints.

Solid understanding of 802.1X, MAB, RADIUS, Active Directory/GPO, and PKI/certificate deployment.

Familiar with STIGs, SCAP, ACAS/Tenable, and endpoint security tools.

Scripting or automation (PowerShell, Python, or REST APIs).

Comfortable working in a live DoD environment with strict change control.

Preferred qualifications

Experience on DoD/DISA C2C deployments.

Experience in a base NOC or with a base cyber/comm squadron.

Experience with SIEM/log analysis and troubleshooting user impact.

Certifications

Security+ (baseline)

CISSP, CEH, or CySA+ preferred

Forescout Certified Administrator/Engineer or Cisco ISE/CCNP Security

Network Engineer

Level / experience

Mid–Senior, 5–8 years in campus networking; 3+ years deploying 802.1X/MAB on wired and wireless

Location

Onsite at the base

Reports to Engineering manager

Role summary

Owns the switching side of Step 4: builds and deploys 802.1X/MAB configurations across the base, validates them, and handles the network side of enforcement and rollback.

Key responsibilities

Review switch inventory, firmware, and configurations to determine 802.1X/MAB/CoA readiness; identify non-capable or end-of-life gear.

Build standard 802.1X/MAB configuration templates and deploy them building by building, with a rollback plan.

Handle special ports: IP phones with daisy-chained PCs, printers, IoT, and other devices needing MAB or exceptions.

Configure AAA/RADIUS/TACACS+, VLAN assignments (including quarantine/remediation), DHCP snooping, and related settings.

Support monitor mode and enforcement waves; troubleshoot connectivity problems in real time.

Configure wireless authentication where in scope.

Produce as-built documentation, config backups, and network diagrams updates.

Required qualifications

Hands-on 802.1X, MAB, and CoA deployment on wired and wireless in a production campus network.

Deep configuration and troubleshooting experience on the base’s switch vendor (commonly Cisco IOS/IOS-XE): AAA, VLANs, DHCP snooping, DAI, port security.

Experience with bulk configuration deployment and rollback across hundreds of switches (Ansible, Python/Netmiko, or a config management tool).

Comfortable working in network closets and executing changes in after-hours windows.

Preferred qualifications

Experience in a DoD or base network operations environment.

Wireless controller experience (802.1X SSIDs).

Network automation and monitoring tool experience.

Certifications

CCNP Enterprise or CCNP Security (preferred); CCNA minimum