Astyra Corporation is seeking a Senior Network Security Engineer to help secure and support an enterprise hybrid IT environment. This hybrid role is based in Mechanicsville, VA (23116) for local candidates in the Richmond/Mechanicsville area only. You will implement and maintain the agency’s network cloud and computing infrastructure, partnering with Infrastructure Cloud Engineering and the Information Security Office to support the confidentiality, integrity, and availability of the network.
What you’ll be doing
- Ensure network security architecture aligns with operational security standards before and after deployment.
- Lead investigations and containment efforts for network security incidents.
- Review firewall rule requests and verify compliance with security standards.
- Design and maintain secure hybrid network architecture across on-premises and Azure environments.
- Monitor security events using SIEM technologies and coordinate incident response activities.
- Perform network security assessments and recommend remediation strategies.
- Develop and maintain network security standards diagrams and operational documentation.
- Support penetration testing and remediation activities.
- Participate in on-call support during critical security incidents.
- Conduct proactive threat hunting and anomaly detection.
- Validate WAF and firewall placement and integration exposure/connectivity, and lead implementation review and management of agency WAFs.
- Identify and diagnose system problems and threats using system logs, line monitors, SIEM diagnostic software, and test equipment.
- Identify, prioritize, and remediate network security vulnerabilities.
- Provide documentation including network architecture topology diagrams, IP schemes, firewall rules, and access controls as needed.
- Work independently on assigned projects.
Core environment and collaboration
You will support a hybrid enterprise environment that includes approximately 300 statewide locations, Palo Alto firewalls, Azure networking, ExpressRoute connectivity, WAF technologies, SD-WAN, Splunk SIEM, and mission-critical public-facing applications.
The role partners closely with Infrastructure Cloud Engineering and the Information Security Office to maintain the security and reliability of the agency’s network infrastructure.
Required experience
- Enterprise Networking: 8 years (required)
- Enterprise Security: 5 years (required)
- Azure Networking: 3 years (required)
- WAF/NGFW: 3 years (required)
- Experience supporting environments with 300+ network devices: 3 years (desired)
- Incident response, security investigations, log analysis, and security monitor (required)
- Threat intelligence (required)
- SIEM products such as Splunk or Microsoft Sentinel (required)
- Vulnerability management and remediation tracking, including vulnerability scanning tools such as Nessus, Tenable, and Def (required)
- Active Directory, MFA, Conditional Access, Certificates (required)
- SEC530, CIS Benchmarks, NIST CSF, NIST 800-53, and Zero Trust principles (required)
- Cisco ISE, NAC, 802.1X, RADIUS, TACACS (required)
- Experience with Palo Alto, F5 Distributed Cloud, Azure WAF, Cisco VPN, Global Protect, and F5 BIG-IP (required)
Additional expectations
- Experience working in highly regulated environments and leading technical troubleshooting during outages (required)
- Ability to communicate technical issues to technical and executive audiences and mentor junior engineers (required)
- Ability to achieve or has the following certifications: Azure Security Engineer (AZ-500) and Azure Network Engineer (AZ-700) (required)
Salary, schedule, and contract details
Location: Hybrid remote in Mechanicsville, VA 23116 (local candidates from the Richmond/Mechanicsville area only).
Job type: Contract (Full-time listed).
Pay: $70.00 to $75.00 per hour.
Benefits
- Dental insurance
- Health insurance
- Paid time off
- Vision insurance
Application notes
Proper email communication will only be done to and from @Astyra.com email addresses. Confirm you are communicating with approved Astyra recruiters by checking this point when receiving offers and messages.
