Network Security Engineer (Firewall & Vulnerability Management) Enterprise Firewall EngineeringCheck Point, Endpoint Security Administration

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the worlds leading mission capability integrator and transformative enterprise IT provider we deliver trusted highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land sea space air and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day our employees do the cant be done by solving the most daunting challenges facing our customers. Visit to learn how were keeping people around the world safe and secure.

Peraton is currently hiring an experiencedNetwork Security Engineer (Firewall & Vulnerability Management) with hands-on experience implementing security configurations for its Federal Strategic Cyber programs.

Location: Washington DC
Work Arrangement: Hybrid On-site Monday through Wednesday; up to two remote days per week
Security Requirement: Tier 2 Public Trust

Position Overview

We are seeking an experienced hands-onNetwork Security Engineer (Firewall & Vulnerability Management)to execute critical cybersecurity improvement initiatives within a hybrid Microsoft AWS and Azure federal enterprise environment.

• This is a project-driven cybersecurity engineering and implementation position not a traditional security assessment advisory compliance or steady-state security operations role.
• Serving as the single dedicated technical engineering resource the selected candidate will independently execute ten security improvement projects spanning vulnerability management endpoint protection patch management firewall and network security identity and access management and security governance.
• The successful candidate must demonstrate experience personally configuring implementing hardening troubleshooting and validating enterprise security technologies and controls. Responsibilities extend beyond identifying vulnerabilities and recommending corrective actions to directly implement approved security configuration changes executing technical remediation optimizing security platforms and delivering measurable improvements to the organizations security posture.
• The engineer will take ownership of technical deliverables from initial assessment and solution design through implementation testing validation documentation and completion. The customer retains responsibility for risk acceptance and policy approvals while the engineer is accountable for executing approved technical security improvements.
• The environment operates under federal cybersecurity requirements including IRS Publication 1075 NIST SP 800-53 Revision 5 and the NIST Risk Management Framework (RMF).

Key Responsibilities

Vulnerability Assessment Remediation & Governance

• Conduct authenticated and unauthenticated vulnerability assessments across enterprise servers endpoints network devices SQL Server virtual desktop infrastructure (VDI) and AWS/Azure workloads.
• Directly implement and validate technical remediation activities including secure configuration changes system hardening and vulnerability resolution.
• Develop a risk-based vulnerability prioritization matrix incorporating Common Vulnerability Scoring System (CVSS) ratings asset criticality and exploitability.
• Establish a comprehensive vulnerability remediation governance framework including ownership models service-level agreement (SLA) targets remediation closure standards and escalation workflows.
• Deliver a formal Vulnerability Remediation Governance Plan within the first 60 days.
• Drive vulnerability backlog reduction through root cause analysis of deferred findings targeted remediation plans direct technical remediation and measurable burn-down tracking.

Vulnerability Scanning Optimization & SIEM Correlation

• Configure tune and optimize Tenable Nessus vulnerability scanning policies and infrastructure.
• Troubleshoot and resolve credentialed-scan failures and eliminate scanning coverage gaps across on-premises cloud and VDI environments.
• Correlate vulnerability findings with Microsoft Sentinel Varonis and Splunk to validate results identify discrepancies and suppress false positives.
• Implement improvements to vulnerability scanning accuracy effectiveness and reporting.
• Develop and maintain dashboards and metrics for technical and executive audiences including:
• Mean Time to Remediate (MTTR)
• Vulnerability aging
• Patch compliance
• Security exception tracking

Endpoint Security & Server Patch Management

• Configure implement and optimize enterprise patch management solutions using Microsoft Endpoint Configuration Manager (MECM) Ivanti and Jamf.
• Design and implement patch deployment rings maintenance windows and automated patching workflows.
• Develop and execute risk-based Windows and Linux server patching plans.
• Implement endpoint and server security hardening measures to address identified vulnerabilities and configuration weaknesses.
• Prepare submit and track formal change requests including implementation procedures testing validation and rollback documentation.
• Update business continuity and disaster recovery documentation related to patch management activities.

Firewall Network & Cloud Security Engineering

• Directly configure implement and harden enterprise firewall security policies including remediation of misconfigurations overly permissive rules deprecated objects and unnecessary access permissions through approved change-control procedures.
• Work within the customers existing Check Point firewall environment to assess configure implement troubleshoot and validate security improvements.
• Apply hands-on enterprise firewall engineering experience with Check Point Palo Alto Networks or Cisco technologies to support firewall security configuration rule management access controls and system hardening.
• Configure implement and tune Microsoft Defender security policies for Windows and macOS endpoints in alignment with NIST SP 800-53 Revision 5.
• Assess troubleshoot and implement network security configuration improvements involving:
• Firewall rule sets and access control lists (ACLs)
• Network Address Translation (NAT)
• Domain Name System (DNS)
• Network segmentation and routing
• Virtual Private Networks (VPNs)
• Proxy services
• Intrusion Prevention and Detection Systems (IPS/IDS)
• Conduct AWS and Azure cloud security posture reviews and implement approved security configuration improvements.
• Assess Zero Trust Network Access (ZTNA) gateway configurations and recommend and implement appropriate security enhancements.

Identity & Access Management (IAM)

• Configure implement and enhance Microsoft Entra ID and Active Directory security controls including Conditional Access policies.
• Assess and improve Privileged Identity Management (PIM) configurations and Multi-Factor Authentication (MFA) enforcement.
• Identify and remediate identity and access management security gaps through approved configuration changes.
• Support penetration testing and red team exercises including findings validation and technical remediation.
• Prepare formal Security Assessment Reports documenting identified risks implemented remediation measures and remaining security considerations.

Technical Documentation Reporting & Knowledge Transfer

• Develop and maintain comprehensive technical documentation including:
• Security engineering runbooks and playbooks
• Standard Operating Procedures (SOPs)
• Secure configuration baselines and references
• Technical implementation and validation procedures
• Knowledge transfer and operational transition documentation
• Prepare and deliver weekly project status reports.
• Produce monthly patch compliance and vulnerability management reports.
• Provide critical vulnerability notifications in accordance with customer-defined SLAs.
• Document implemented security configuration changes remediation outcomes and technical deliverables to support operational continuity and audit readiness.

Strong technical writing and documentation skills are essential functional requirements of this position.

Required Qualifications:

Education & Professional Experience:

• Bachelors degree and 12 years of relevant experience. An additional 4 years of experience will be considered in lieu of the bachelors degree.
• Must have a minimum of 5 years of hands-on enterprise cybersecurity experience including vulnerability assessment endpoint security system hardening and penetration testing.
• Demonstrated experience directly configuring implementing hardening troubleshooting and validating enterprise security technologies and controls.
• Proven ability to independently execute technical security improvement initiatives from assessment and design through implementation validation and documentation.
• Experience performing security configuration changes and remediation activities within production enterprise environments

Technical Skills & Experience: Must have strong hands-on implementation experience in and with:

Firewall Security Engineering:

• Hands-on enterprise firewall configuration and implementation experience with at least one of the following technologies:
• Check Point firewalls
• or Palo Alto Networks or Cisco acceptable alternative
• Demonstrated experience personally configuring modifying implementing troubleshooting and validating firewall security policies rules access controls and security hardening measures.
• Experience performing firewall security remediation and configuration changes within production enterprise environments using formal change-management procedures.
• Ability to apply existing firewall engineering expertise to the customers Check Point environment.

Endpoint Security & Vulnerability Management Tools:

Hands-on configuration and implementation experience involving:

• Microsoft Defender: Endpoint protection configuration policy implementation and security tuning for Windows and macOS.
• Tenable Nessus: Vulnerability scan configuration credentialed scanning troubleshooting and optimization.
• MECM Ivanti and Jamf: Endpoint management patch deployment configuration management and automation.
• Microsoft Entra ID / Active Directory: Conditional Access Privileged Identity Management (PIM) Multi-Factor Authentication (MFA) and identity security controls.

Vulnerability Management Remediation & Governance:

• Experience identifying prioritizing and directly remediating enterprise security vulnerabilities.
• Ability to develop remediation governance frameworks patching workflows ownership models and escalation procedures.
• Experience implementing and validating security hardening configurations and remediation changes.
• Knowledge of formal change-management processes including testing implementation rollback planning and documentation.
• Experience developing technical runbooks SOPs and secure configuration documentation.

Security Frameworks & Compliance:

Working knowledge of:

• NIST SP 800-53 Revision 5
• NIST Risk Management Framework (RMF)
• Zero Trust security principles
• IRS Publication 1075

Security Monitoring & SIEM:

Experience with at least one of the following:

• Microsoft Sentinel
• Varonis
• Splunk

Scripting & Automation:

Hands-on scripting experience using one or more of the following:

• Python
• PowerShell
• C#

Network & Cloud Security:

• Experience analyzing and implementing security configurations involving firewall rules network segmentation DNS routing and cloud networking.
• Experience supporting security engineering activities within hybrid on-premises and AWS/Azure environments.
• Ability to troubleshoot and remediate network and cloud security configuration weaknesses.

Identity & Access Management:

• Experience configuring and implementing Conditional Access policies.
• Familiarity with PIM configuration and privileged access controls.
• Experience assessing and improving MFA enforcement and identity security configurations.

Additional Requirements:

• Must be a U.S. citizen
• Must meet the requirements for a Tier 2 Public Trust background investigation.
• Must be able to work on-site in Washington DC Monday through Wednesday with up to two remote workdays per week.
• Must demonstrate the ability to work independently manage multiple technical deliverables and communicate effectively with technical and customer stakeholders.

Preferred Qualifications:

Education

• Bachelors degree in Information Technology Computer Science Cybersecurity or a closely related technical discipline.

Professional Certifications

One or more of the following certifications:

• Certified Information Systems Security Professional (CISSP)
• Offensive Security Certified Professional (OSCP)
• Global Information Assurance Certification (GIAC)
• Certified Ethical Hacker (CEH)
• CompTIA Security
• Microsoft Certified: Azure Security Engineer Associate (AZ-500)
• AWS Certified Security Specialty
• Certified Information Security Manager (CISM)

Additional Experience

• Previous cybersecurity engineering experience supporting federal agencies or environments governed by IRS Publication 1075.
• Experience supporting Security Operations Center (SOC) operations incident response penetration testing or red team exercises.
• Residency within the Washington DC metropolitan area.
• Direct experience configuring and implementing security controls within Check Point firewall environments.

Peraton offers eligible employees a variety of benefits including medical dental vision life health savings account short/long term disability EAP parental leave 401(k) paid time off (PTO) for vacation and company paid holidays. A full listing of available benefits can be viewed at Statements