Senior Security Engineer-Network Security Assessment & Post-Quantum Cryptography (PQC) - Hybrid

Position Summary:

We are seeking a Senior Security Engineer with a network focus to perform independent security assessments of a Federal Government enterprise network spanning on-premises and AWS/hybrid environments. The role centers on evaluating how network infrastructure and services implement security controls and cryptography, and on assessing the enterprise s readiness to migrate to post-quantum cryptography (PQC). The engineer will identify where cryptography is used across network technologies, determine how PQC requirements affect those implementations, and produce evidence-backed findings and recommendations. This is an assessment and security-engineering analysis role not primarily operational support, vulnerability remediation, or firewall administration.

Key Responsibilities:

• Plan and conduct security assessments of enterprise network architecture and infrastructure routers, switches, firewalls, VPN concentrators, load balancers/ADCs, wireless, NAC, and AWS cloud networking (VPC, Transit Gateway, Direct Connect) against Federal security baselines and configuration standards.
• Evaluate the effectiveness of segmentation, secure connectivity, Zero Trust controls, intrusion detection/prevention, and security monitoring, and identify control gaps.
• Reconstruct and validate an incompletely documented As-Is network and security environment using configuration reviews, traffic analysis, scan data, and stakeholder interviews; substantiate every finding with technical evidence.
• Discover and inventory cryptographic usage across network technologies, including TLS (with termination and offload points), IPsec/IKEv2, SSH, MACsec, 802.1X/EAP-TLS, SNMPv3, DNSSEC, RADIUS/TACACS+, and other management-plane protocols.
• Analyze cryptographic implementations key-exchange, digital-signature, and cipher-suite selections; certificate and PKI dependencies; key management and HSM integration; and FIPS 140-2/140-3 validated modules to identify components that rely on quantum-vulnerable public-key algorithms (RSA, Diffie-Hellman, ECDH, ECDSA).
• Assess the impact of PQC requirements on network implementations, including larger keys and signatures affecting packet size, fragmentation, MTU, and handshake latency; hardware, ASIC, and crypto-accelerator constraints; hybrid key-establishment options; and certificate-chain and protocol interoperability.
• Perform vendor and product readiness assessments to determine current PQC support by platform and firmware, vendor roadmaps for NIST-standardized algorithms (ML-KEM, ML-DSA, SLH-DSA), and associated hardware or software refresh dependencies.
• Develop prioritized cryptographic inventories, risk assessments (including harvest now, decrypt later exposure for long-lived data), cryptographic-agility recommendations, and phased migration inputs aligned with applicable Federal requirements.
• Coordinate findings and implementation planning with the Government s designated PQC, security, identity, application, and architecture leads.
• Lead discovery workshops, produce assessment reports and briefing packages, and explain and defend findings and recommendations to Government leadership.

Required Qualifications:

• 12+ years of IT security or enterprise network engineering experience, including at least five years of hands-on network security engineering or assessment.
• Strong routing, switching, and network-protocol fundamentals, with practical expertise in enterprise firewalls, VPNs, segmentation, and secure connectivity across on-premises and AWS/hybrid environments.
• Demonstrated working knowledge of applied cryptography in networking: TLS 1.2/1.3, IPsec/IKEv2, SSH, PKI and certificate lifecycle, key management, and FIPS-validated cryptographic modules.
• Familiarity with the NIST PQC standards (FIPS 203, 204, and 205) and the Federal PQC migration landscape, including NSM-10, OMB M-23-02, NIST transition guidance (NIST IR 8547), and applicable Executive Order requirements.
• Experience assessing network security against Federal frameworks and standards such as NIST SP 800-53 (e.g., SC-8, SC-12, SC-13), SP 800-52, SP 800-77, and DISA STIGs or CIS Benchmarks.
• Ability to analyze device configurations, packet captures, and scan output (e.g., Wireshark, Nmap, testssl.sh/sslscan) to verify cryptographic and security settings.
• Strong technical writing and customer communication skills.

Desired Qualifications:

• Experience supporting Federal Government enterprise networks, preferably at a civilian agency.
• Experience with cryptographic discovery and inventory tools or automated cryptographic asset management.
• Hands-on lab testing of PQC or hybrid key exchange (e.g., OpenSSL 3.5 or Open Quantum Safe libraries; hybrid TLS or IKEv2 with ML-KEM).
• Depth in a complementary specialty: network access control and identity integration, application-delivery security (e.g., F5/WAF), or HSM and enterprise key management.
• Relevant certifications such as CISSP, CCNP/CCIE Security, GIAC (e.g., GCIA), or CompTIA SecurityX (formerly CASP+). Certifications do not replace demonstrated assessment experience.

Additional Requirements:

• U.S. citizenship.
• Availability for required hybrid meetings in Suitland, Maryland.

ATD Technology, LLC is a certified minority woman owned business that creates opportunities to match qualified individuals with client programs while meeting all parties' financial and technical goals. ATD is a full service provider with offerings in Contract, Permanent and Temp-to-Perm staffing solutions. We serve Fortune 1000, mid cap and small cap companies in the Commercial, Public and Government sectors.