Classified Network Engineer

Description

The company builds autonomous and intelligent platforms for use at sea.

The team is hiring a senior network engineer to design, build, run and maintain classified network infrastructure, along with the network and crypto path inside the company's products.

You will own the L2/L3 layer, firewalls, TACLANE setup and operation, and the technical side of CDS. You will also physically and logically integrate government-furnished information and equipment payloads onto company platforms while keeping the accredited architecture intact.

You will produce the as-built evidence the ISSO needs for facility and product ATOs.

Your lane is separate from other roles, but you will regularly overlap on TACLANE, CDS, COMSEC handling, and host and network bring-up.

Responsibilities

• Design and run classified LAN and WAN, including segmentation by classification and mission enclave, IP addressing, routing, QoS, and isolation of the management plane.
• Configure and maintain approved Cisco, Juniper, Palo Alto, or equivalent gear to DISA STIG standards. Set up AAA and ISE, and send logs to the accredited collector.
• Support circuit orders, turn-up, and acceptance testing for DISA SIPR, Navy JWICS and CWAN, and customer drops. Produce as-builts.
• Produce rack elevations, cabling plans, red/black separation designs, IDPs, and configuration baselines.
• Install, peer, update firmware on, and operate TACLANE-family devices (KG-175D/F/G/X, KG-250/X, and related) at sites and on platforms. Set up HA and failover and manage encryptors per the approved architecture.
• Load and manage operational keying only with the appointed COMSEC Account Manager. Protect CIKs and tokens, and carry out zeroize and reconstitution when authorized. This role is not the CAM or CRO unless separately appointed.
• Install and maintain approved CDS hardware and software under ISSO and AO rules. Set up interfaces, NTP, logging, HA, and the filter-update process, and collect ConMon evidence. Never change CDS filters, transfer rules, or accredited data flows on your own.
• Engineer the network, crypto, and data-path integration of GFI/GFE payloads onto company platforms, covering physical install, addressing, VLANs, encryptor placement, RF and data interfaces, and cable and power limits.
• Build integration baselines (configs, versions, serial numbers, crypto suites, and ports, protocols and services) that the ISSO can place in the ATO package. Support integration in labs, factories, shipyards, and underway, including bring-up, interoperability testing, fault isolation, and restoring the accredited baseline.
• Produce implementation evidence such as diagrams, configs, STIG results, scan artifacts, PPSM records, hardware inventory, and change records. Carry out assigned technical POA&M mitigations on network and payload interfaces. You do not own the SSP or the AO relationship.
• Handle Tier 2 and Tier 3 break/fix for classified transport, take part in change control, and support CCRI and inspection technical evidence. Travel to install, test, and hand over the classified path for facility and product ATO deployments.

Requirements

• Required: U.S. citizen with active TS clearance and SCI eligibility.
• Required: 5+ years in enterprise or mission network engineering.
• Preferred: 3+ years in classified environments.
• Required: hands-on work configuring and operating TACLANE (KG-175 and KG-250 family) devices.
• Required: solid understanding of OSI, IPv4/IPv6, routing and switching, firewalls, and VPNs. Strong red/black discipline.
• Required: experience applying STIGs to network equipment and working familiarity with RMF evidence needs.
• Required: DoD 8140 IAT II certification (Security+ CE or higher). CCNA or equivalent experience required; CCNP preferred.
• Required: able to rack and cable equipment and lift about 30 lbs. Willing to work in SCIFs, shops, and shipyard or waterfront settings.
• Required: able to travel 30-40% on short notice for circuit turn-up, inspections, and payload integration.
• Preferred: JWICS or SIPR circuit experience with DISA or Navy. Experience with CANES, ADNS, or afloat or ashore Navy networks.
• Preferred: Palo Alto and Cisco in the same environment. ISE, DNA Center, or equivalent. CDS implementation. CSfC. Secure voice or SVTC.
• Preferred: unmanned or autonomous platform, payload, or PIT integration. GDMS TACLANE operator training. COMSEC handling experience.
• Preferred: comfortable with shipyard, range, or field integration work.
• Physical demands: long periods sitting at a desk and using a computer. Occasional standing and walking in the office.
• Physical demands: good manual dexterity for keyboard, mouse, and office equipment, and good visual acuity for screens, documents, and reports.
• Physical demands: occasional reaching, bending, or stooping to reach file drawers, cabinets, or supplies. Occasionally lift and carry up to 20 pounds.

Conditions

Travel of 30-40% on short notice is required.

If this role is based in the United States, it requires access to export-controlled information or items, which requires U.S. Person status. U.S. Persons are U.S. citizens, lawful permanent residents, and certain protected asylees and refugees under 8 U.S.C. 1324b(a)(3).

The company does not discriminate in employment based on protected characteristics and provides reasonable accommodations for qualified individuals with disabilities.

A candidate privacy notice for California residents is available.

Benefits

• Medical insurance: the company pays 100% of the employee premium and 80% of dependent premiums.
• Dental and vision insurance: the company pays 100% of the basic plan premium for employees and 80% for dependents. Coverage includes routine dental care, orthodontics, and vision care.
• Generous paid time off and holidays.
• Paid maternity and paternity leave.
• Competitive, industry-standard salary with opportunities for performance-based bonuses.
• 401(k) retirement plan with a company match.
• Equity options in the company.
• Basic life insurance and short- and long-term disability coverage.
• Discounted pet insurance, including a 24/7 telehealth helpline.
• Free lunch, and unlimited free drinks and snacks in the office.