# Principal Network Security Engineer **Company**: Leidos **Location**: Odenton, MD **Experience**: senior **Job type**: full-time **Category**: Security **Industry**: Technology **Apply**: https://leidos.wd5.myworkdayjobs.com/en-US/External/job/Odenton-MD/Principal-Network-Security-Engineer_R-00194243?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_c743f156-ccf ## Description Leidos is seeking an experienced Principal Network Security Engineer to design, engineer, and implement enterprise network security capabilities across a large, distributed network environment. The role is responsible for advancing network security architecture through the execution of strategic design and implementation efforts that improve the security posture, segmentation, access control, and resiliency of the enterprise network. The successful candidate serves as a technical leader and subject matter expert , assessing the current security architecture, defining the controls and segmentation model the enterprise needs, building practical implementation plans with realistic risk and rollback provisions, and directing a team of engineers to deliver them under aggressive timelines. **Primary Responsibilities:** - Design, engineer, and implement enterprise network security architecture spanning next-generation firewalls, intrusion detection and prevention, web and TLS proxies, VPN and encryption services, network access control, DNS security, and east-west security controls. - Evaluate the current network security architecture, identify gaps and improvement opportunities, estimate level of effort, assess implementation risk, and develop practical engineering plans to strengthen enterprise security capabilities. - Lead network segmentation and secure connectivity efforts, including data-flow mapping, security-zone and enclave design, firewall rule set and ACL review and rationalization, routing and security policy coordination, cutover sequencing, validation, and stakeholder approval. - Design and implement network access control and device-posture enforcement (Comply-to-Connect style), including identity and device authentication, posture assessment, policy enforcement points, remediation workflows, and phased enforcement rollout. - Advance zero-trust-aligned networking, micro-segmentation, least-privilege access policy, and encrypted-transport strategies across the enterprise. - Provide specifications for network security architecture, evaluate and recommend emerging security technologies, and perform needs assessments to inform design and investment decisions. - Engineer secure connectivity between on-premises, cloud, and remote environments, including IPsec and TLS VPN, secure cloud interconnects, and perimeter and boundary protection designs. - Tune and optimize security controls to reduce false positives, close coverage gaps, and improve detection and enforcement without degrading network performance or availability. **Project Execution** - Drive security engineering projects from concept through implementation, including architecture evaluation, requirements analysis, dependency identification, design coordination, planning, execution, validation, and transition to operations. - Develop and manage implementation plans, schedules, cutover strategies, contingency plans, rollback procedures, validation steps, stakeholder communications, and change documentation for mission-critical security changes. - Coordinate change windows, maintenance activities, test validation, and rollback procedures for high-impact security policy and infrastructure changes. - Partner with network architecture, cybersecurity, operations, project management, and technical SME teams to resolve blockers, manage dependencies, and reduce delivery risk. - Support accreditation and compliance activities, including security control implementation, STIG application, vulnerability remediation, POA&M support, and the technical artifacts required for authorization. **Technical Leadership** - Serve as the senior technical authority for network security design decisions, providing technical direction, mentoring, and day-to-day guidance to network and security engineers, administrators, and analysts. - Organize technical priorities, track details across concurrent efforts, manage competing demands, and maintain accountability against aggressive schedules. - Provide clear, well-reasoned technical information and recommendations to government stakeholders and approval authorities. - Continuously improve engineering processes, documentation standards, implementation playbooks, migration runbooks, technical standards, and execution models to accelerate delivery, reduce rework, improve operational handoff, and lower sustainment burden. **Documentation** - Develop and maintain engineering and operational documentation, including: + Network security architecture and logical/physical design diagrams + Data-flow diagrams, security-zone models, and segmentation designs + Firewall policy standards, rule set baselines, and ACL documentation + Port, protocol, and services (PPS) requirements + Implementation and cutover plans with rollback and contingency procedures + Test and validation plans + Risk, dependency, and decision registers + Security control implementation statements and accreditation artifacts + Technical standards, playbooks, runbooks, and standard operating procedures + As-built and operations transition documentation ## Skills ### Required - network security - next-generation firewalls - intrusion detection and prevention - VPN and encryption services - network access control - DNS security - TCP/IP - routing protocols - switching - VLANs - DNS/DHCP/IPAM - NAT - QoS - software-defined and cloud-connected network environments - Palo Alto - Cisco - Aruba - Dell - Infoblox - Brocade - NIST - FedRAMP - FISMA - RMF - DISA STIGs - DoD cybersecurity requirements ### Nice to have - CISSP - Palo Alto PCNSE - Cisco CCNP Security - Comply-to-Connect - 802.1X - zero-trust architecture - micro-segmentation - SASE - secure cloud connectivity designs - security automation - infrastructure-as-code - Python - Ansible - REST APIs --- Source: [Apply at leidos.wd5.myworkdayjobs.com](https://leidos.wd5.myworkdayjobs.com/en-US/External/job/Odenton-MD/Principal-Network-Security-Engineer_R-00194243?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)