Cloud / Network Security Engineer

Design and advisory role supporting NIH Future State ZTA by co-authoring cloud and network security reference architectures, patterns, and control mappings.

Responsibilities

• Co-author cloud, on-premises, and hybrid reference architectures (Subtask 2.2) with the Senior ZT Architect as reusable design patterns with NIST SP 800-53 Rev 5 control mappings.
• Design microsegmentation and workload-identity patterns using NIST SP 800-207A and CISA and NSA Zero Trust guidance.
• Create software-defined perimeter patterns for HPC clusters and define isolated VLANs with brokered remote access for laboratory instruments.
• Document how centrally provided network, endpoint, and logging services are inherited as input to the Centrally Provided Services Matrix.
• Define technical policy anchors for the network and device pillars: segmentation policy in the controller and compliance policy in endpoint management.
• Map controls to telemetry to support continuous-monitoring evidence collection (not manual evidence writing).
• Support Task 3 network use cases: flow baselining to generate and validate microsegmentation policy, and lateral-movement anomaly detection.
• Support Task 4 gap assessment for the network, device, and cloud pillars, including evidence expectations in the ZTA Overlay.
• Validate patterns with IC engineering teams (CIT, HPC, and clinical platform owners).

Requirements

• Bachelor’s degree plus 7+ years of network and/or cloud security engineering.
• Hands-on experience with identity-aware access, microsegmentation, and cloud security patterns in enterprise environments.
• Experience with firewalls, SSE/ZTNA, and native AWS or Azure security services.
• Security+ or a higher security certification.
• Ability to obtain an NIH suitability determination and PIV credential; fluent in English.
• U.S. Citizenship required.
• All staff must obtain NIH suitability and a PIV credential and be fluent in English.
• Anyone performing risk or vulnerability testing needs a current T2 (BI) investigation or higher.

Tools & Technology Environment

• AWS, Azure (including GovCloud), cloud-native IAM, CSPM
• SSE/ZTNA (e.g., Zscaler, Palo Alto)
• Microsegmentation platforms (e.g., Illumio)
• Palo Alto/Fortinet/Cisco firewalls
• Microsoft Defender, CrowdStrike, Forescout
• Splunk/Microsoft Sentinel
• Terraform, IaC, Git, CloudFormation

Preferred Qualifications

• Cloud security certification (AWS Security Specialty, AZ-500, or CCSP); PCNSE or CCNP Security.
• Experience in FedRAMP-authorized or GovCloud environments.
• Experience with research networks, HPC (Linux/Slurm), or operational technology/IoT device segmentation.
• Infrastructure-as-code (Terraform, CloudFormation) and experience writing security patterns as code.
• Current NIH or U.S. Department of Health and Human Services (HHS) experience highly preferred.

Location & Work Schedule

• Hybrid role based in Bethesda, MD.
• On-site for workshops and pilots (typically 1–2 days/week during the first 120 days, then as scheduled).

Compensation

$130,000–$140,000 per year.

Equal Employment Opportunity

eTelligent Group provides equal employment opportunities (EEO) to all applicants without regard to race, color, religion, gender, sexual orientation, gender identity, nations origin, age, disability, genetic information, marital status, amnesty, status as a covered veteran, and any other characteristic provided in accordance with applicable federal, state and local laws.