Network Engineer

Job Summary
We are seeking an experienced Network Engineer to design, secure, and operate a large-scale hybrid network spanning on-premises infrastructure and AWS. The role will support a major cloud migration initiative while maintaining secure, highly available connectivity for mission-critical systems across more than 500 remote locations. The engineer will focus on enterprise network engineering, AWS hybrid networking, VPN engineering, network security, automation, monitoring, disaster recovery, and operational support within a regulated environment.

Key Responsibilities
• Maintain a highly available, secure, and resilient network supporting more than 500 remote offices and mission-critical applications.
• Manage routing, switching, firewall policies, ACLs, and network device configurations.
• Conduct periodic reviews of routing policies, security controls, and network configurations to support compliance.
• Participate in a 24x7 on-call rotation and respond to critical production incidents within defined SLAs.
• Troubleshoot and resolve network outages, performance issues, and connectivity problems.
• Manage service requests, hardware moves/adds/changes, and ticket updates through ITSM tools.
• Perform site surveys, modernization assessments, and implementation planning for new locations.
• Install, terminate, test, and document structured cabling and network infrastructure.
• Support hardware refreshes, decommissioning efforts, and asset disposal activities.
• Design, implement, and support redundant IPsec VPN solutions connecting on-premises environments, state partner networks, VITA networks, and AWS.
• Engineer highly available VPN architectures that eliminate single points of failure across circuits and gateways.
• Configure and optimize BGP-based routing and failover for seamless traffic restoration during outages.
• Standardize and maintain VPN security configurations, including IKEv2, PFS groups, Phase 1/Phase 2 settings, and encryption standards.
• Implement DPD, tunnel monitoring, and proactive alerting for VPN health and availability.
• Build and manage AWS Site-to-Site VPNs using Transit Gateway and Virtual Private Gateway architectures.
• Perform scheduled failover testing and validate recovery objectives.
• Maintain VPN inventories, endpoint documentation, certificates, pre-shared keys, and maintenance schedules.
• Support enterprise cloud migration initiatives and post-migration operational stabilization.
• Design and manage AWS networking components, including VPCs, subnets, route tables, security groups, network ACLs, VPC endpoints, and PrivateLink.
• Build and support Transit Gateway hub-and-spoke architectures with segmented routing strategies.
• Implement AWS Direct Connect and hybrid DNS solutions using Route 53 Resolver.
• Deploy and support AWS Network Firewall, Gateway Load Balancer, and security inspection architectures.
• Assess and remediate on-premises network segmentation and connectivity issues prior to cloud migration.
• Monitor and optimize hybrid connectivity, routing, security controls, and network performance across AWS and on-premises environments.
• Collaborate with cloud engineering teams, vendors, and external partners to deliver secure and compliant network solutions.
• Apply Zero Trust, least-privilege, and secure-by-design networking principles.
• Support compliance with CJIS, Commonwealth of Virginia, FBI, and applicable security requirements.
• Implement centralized authentication, authorization, and auditing for network administration.
• Support vulnerability management, remediation activities, and periodic access reviews.
• Leverage VPC Flow Logs, Traffic Mirroring, CloudTrail, and GuardDuty for security monitoring and incident investigations.
• Identify and remediate network single points of failure.
• Ensure disaster recovery environments meet applicable operational and security standards.
• Maintain accurate hardware, software, and network asset inventories.
• Develop and manage Infrastructure-as-Code solutions using Terraform, CloudFormation, and Ansible.
• Automate network deployments, configuration management, compliance validation, and configuration drift detection.
• Maintain Git-based source control and peer review processes.
• Implement network observability using syslog, SNMP, telemetry, dashboards, and alerting platforms.
• Lead network-related root cause analyses and post-incident reviews.
• Create and maintain network diagrams, standards documentation, operational procedures, runbooks, and troubleshooting guides.
• Manage change control processes and coordinate network changes across internal and external stakeholders.

Required Qualifications
• 10+ years of hands-on enterprise network engineering experience.
• Strong expertise in enterprise routing, switching, firewalls, and secure remote connectivity.
• Extensive experience designing and supporting redundant IPsec VPNs with BGP failover.
• Strong understanding of network security, segmentation, encryption, MFA, and device hardening.
• Experience supporting 24x7 production environments and participating in on-call rotations.
• Strong knowledge of ITSM processes and tools such as ServiceNow or FootPrints.
• Advanced AWS networking experience, including VPC, Transit Gateway, Direct Connect, Site-to-Site VPN, Route 53, Security Groups, and Network ACLs.
• Experience delivering Infrastructure as Code using Terraform or CloudFormation.
• Familiarity with CJIS, Commonwealth of Virginia, or comparable regulatory and security frameworks.
• Ability to successfully pass applicable CJIS background investigation requirements.

Preferred Qualifications
• Experience supporting law enforcement or public safety environments.
• Familiarity with CJIS-regulated systems and public safety technology environments.
• Knowledge of VITA operational and change management processes.
• Experience with Juniper, Cisco, Palo Alto, Fortinet, or Check Point technologies.
• Strong understanding of WAN technologies, including SD-WAN, MPLS, and carrier network management.
• Experience designing AWS Network Firewall and inspection-layer architectures.
• Network automation expertise using Python, Ansible, and CI/CD pipelines.
• Experience with hybrid DNS, IPAM platforms, and large-scale CIDR strategy.
• Experience with monitoring and observability platforms such as CloudWatch, Prometheus, Grafana, Elastic Stack, SolarWinds, or Datadog.

Certifications
• Preferred certifications include CCNP, CCIE, JNCIP, JNCIE, PCNSE, AWS Certified Advanced Networking - Specialty, or AWS Certified Security - Specialty.