Cloud / Network Security Engineer

Work Location and On-Site/Telework Requirements: Hybrid – NIH, Bethesda, MD. On site for workshops and pilots (typically 1–2 days/week during the first 120 days, then as scheduled).

Citizenship: U.S. Citizenship required

Clearance: All staff must obtain NIH suitability and a PIV credential and be fluent in English. Anyone doing risk or vulnerability testing needs a current T2 (BI) or higher investigation.

Salary Range: $130,000-$140,000 yearly salary

Overview:

You will co-author the cloud, network, and identity design patterns behind NIH's Future State ZTA under the NIH Governance, Risk & Compliance (GRC) Zero Trust Architecture (ZTA) Support Services task order for the NIH Office of the Chief Information Officer (OCIO). You will work in the Architecture Pod on Tasks 2, 3, and 4. This is a design and advisory role: you will produce reference architectures, patterns, and control mappings for NIH teams to implement, not operate NIH production systems. Deep hands-on engineering experience is still essential.

Responsibilities:

• Co-author the cloud, on-premises, and hybrid reference architectures (Subtask 2.2) with the Senior ZT Architect, as reusable design patterns with NIST SP 800-53 Rev 5 control mappings.
• Design microsegmentation and workload-identity patterns (NIST SP 800-207A, CISA and NSA Zero Trust guidance), software-defined perimeter for HPC clusters, and isolated VLANs with brokered remote access for laboratory instruments.
• Document how centrally provided network, endpoint, and logging services are inherited, as input to the Centrally Provided Services Matrix.
• Define technical policy anchors for the network and device pillars (segmentation policy in the controller, compliance policy in endpoint management). Map controls to telemetry so continuous-monitoring evidence is collected rather than written by hand.
• Support Task 3 network use cases: flow baselining to generate and validate microsegmentation policy, and lateral-movement anomaly detection.
• Support the Task 4 gap assessment for the network, device, and cloud pillars, and the evidence expectations in the ZTA Overlay.
• Validate patterns with IC engineering teams (CIT, HPC, and clinical platform owners).

Tools & Technology Environment: AWS and Azure (including GovCloud), cloud-native IAM and CSPM; SSE/ZTNA (e.g., Zscaler, Palo Alto); microsegmentation platforms (e.g., Illumio); Palo Alto/Fortinet/Cisco firewalls; Microsoft Defender, CrowdStrike, Forescout; Splunk/Microsoft Sentinel; Terraform/IaC; Git.

Required Qualifications:

• Bachelor's degree plus 7+ years of network and/or cloud security engineering.
• Hands-on experience with identity-aware access, microsegmentation, and cloud security patterns in enterprise environments.
• Experience with firewalls, SSE/ZTNA, and native AWS or Azure security services.
• Security+ or a higher security certification.
• Ability to obtain an NIH suitability determination and PIV credential; fluent in English.

Preferred Qualifications:

• A cloud security certification (AWS Security Specialty, AZ-500, or CCSP); PCNSE or CCNP Security.
• Experience in FedRAMP-authorized or GovCloud environments.
• Experience with research networks, HPC (Linux/Slurm), or operational technology/IoT device segmentation.
• Infrastructure-as-code (Terraform, CloudFormation) and experience writing security patterns as code.
• Current National Institutes of Health (NIH) or U.S. Department of Health and Human Services (HHS) experience is highly preferred.