Network Access Control (NAC) Engineer

Position Overview

This role supports a major financial services customer's global network security organization as part of a broader modernization initiative covering NAC, firewalls, IDS/IPS, proxy, remote access, and Zero Trust segmentation.

The engineer will work directly within the customer's existing Forescout and Cisco Client environment to mature how NAC is engineered and operationalized defining engineering standards, uplifting existing policy, closing known security gaps, and identifying automation opportunities. This is fundamentally a hands-on NAC engineering role: the person will need to understand endpoint access control at the mechanism and architecture level.

Key Responsibilities

• Engineer, deploy, and operationalize Forescout NAC across enterprise environments, including endpoint discovery, agentless device visibility, profiling, and policy enforcement

• Configure and maintain Cisco Client for 802.1X authentication, RADIUS authorization, dynamic VLAN assignment, and downloadable ACLs

• Design and support the coexistence and integration of Forescout and Cisco Client within a unified NAC architecture

• Define and uplift NAC engineering standards, policies, and operational documentation

• Handle non-802.1X-capable endpoints (printers, cameras, IoT, legacy equipment) using MAC Authentication Bypass (MAB), profiling-based classification, and restricted-access policy

• Integrate NAC with firewall platforms to align identity/device context with network segmentation and access enforcement

• Support Zero Trust initiatives, including continuous posture/compliance verification and least-privilege access design

• Identify and implement automation opportunities for NAC policy management and operations, using Python, Ansible, and related tooling

• Collaborate with engineering, architecture, operations, and security teams to deliver integrated infrastructure solutions

• Participate in incident response, troubleshooting, and root cause analysis for NAC and access-control issues

• Ensure adherence to change management, compliance, and operational governance processes

• Develop deployment documentation, implementation procedures, operational runbooks, and knowledge-transfer materials

Required Qualifications

• Hands-on Forescout experience: deployment, endpoint/device discovery, agentless profiling, policy creation and enforcement, posture/compliance assessment, and unmanaged device identification

• Hands-on Cisco Client experience: 802.1X, RADIUS, EAP-TLS, certificate-based authentication, profiling, posture, and policy design

• Strong understanding of NAC architecture end-to-end from endpoint connection through discovery, authentication, profiling, posture/compliance, authorization, access decisioning, and continuous monitoring

• Demonstrated experience handling non-802.1X devices via MAB, profiling, and restricted-access strategies (not simply MAC whitelisting)

• Working knowledge of Zero Trust principles: identity-based access, continuous verification, least privilege, and segmentation

• Understanding of how NAC and firewall platforms integrate to jointly enforce identity-, device-, and posture-based access control

• Ability to speak to specific, personally-built or personally-modified NAC/Forescout policies

• Experience working within formal change-management and incident-management processes

Preferred Qualifications

• Experience with Forescout and Cisco Client coexistence/integration in a production environment

• PKI/certificate management and Active Directory integration experience

• Experience with Security Group Tags (SGT), Cisco TrustSec, and pxGrid

• Automation/scripting experience (Python, Ansible, REST APIs, Terraform, GitLab CI/CD)

• Complementary firewall experience (Palo Alto, Fortinet, Check Point, Cisco) valuable as a secondary skill, not a substitute for NAC/Forescout depth

• SIEM/security operations exposure (Splunk, QRadar) for alerting and incident correlation

Tools and Technologies

• Forescout Platform (device visibility, profiling, policy enforcement, compliance)

• Cisco Client (802.1X, RADIUS, TrustSec, pxGrid)

• Firewall platforms (Palo Alto, Fortinet, Check Point, Cisco) for NAC integration

• Zero Trust / segmentation frameworks

• Python, Ansible, GitLab CI/CD, REST APIs

• ServiceNow / ITIL-based change and incident management