CMMC Network Engineer-NIST SP 800-171 & CUI || Remote with some travel in Portland, OR(local only)

Senior CMMC Network Engineer- experience implementing and supporting NIST SP 800-171 controls and Controlled Unclassified Information (CUI)
Duration: 3+months with possible extension
Location: Remote with some travel in Portland, OR (Local candidates requires as there is occasional onsite presence needed. Candidates in the Beaverton, OR area are highly preferred)

About the Role:
We are seeking a highly experienced Senior CMMC Network Engineer to design, implement, secure, and support enterprise network infrastructure across LAN, WAN, wireless, datacenter, and cloud environments within a Cybersecurity Maturity Model Certification (CMMC) regulated environment. The ideal candidate will possess deep expertise in enterprise networking and demonstrated experience implementing and supporting NIST SP 800-171 controls and Controlled Unclassified Information (CUI) boundary protection requirements.
Day to Day:

• Design, implement, and maintain enterprise network infrastructure (LAN/WAN/WLAN) aligned with CMMC and NIST 800-171 requirements.
• Lead Cisco Software-Defined Access (SDA) design and implementation, including Cisco DNA Center-managed fabrics, wired and wireless infrastructure, Security Group Tags (SGT), TrustSec segmentation, and fabric-based CUI boundary enforcement.
• Manage and optimize routing and switching environments, including:
  • SD-WAN
  • BGP
  • OSPF
  • EIGRP
  • VLANs
  • STP
  • HSRP/VRRP
• Configure and support firewalls, VPNs, and network security controls enforcing CUI segmentation requirements.
• Design and maintain network architecture supporting CUI enclaves, including:
  • Access controls
  • Encryption in transit
  • Audit logging requirements
  • DFARS compliance
• Lead network upgrades, migrations, and infrastructure projects while assessing impacts to compliance boundaries.
• Troubleshoot performance issues and outages, performing root cause analysis and implementing corrective actions.
• Monitor network health using tools such as SolarWinds, ThousandEyes, or similar platforms.
• Maintain network documentation including diagrams, IP schemas, standards, runbooks, and System Security Plan (SSP) artifacts.
• Support CMMC self-assessments and C3PAO audits by providing network evidence, diagrams, technical narratives, and compliance documentation.
• Partner with service providers to manage circuit turn-ups, escalations, and troubleshooting efforts.
• Ensure network availability, redundancy, resilience, and disaster recovery readiness.
• Mentor junior engineers and provide technical leadership.
• Participate in on-call rotations and after-hours maintenance activities.

Cloud Networking Responsibilities (AWS / Azure)

• Design and support AWS networking services including:
  • VPCs
  • Transit Gateway
  • Route Tables
  • NACLs
  • Security Groups
• Design and support Azure networking services including:
  • VNets
  • VNet Peering
  • User Defined Routes (UDRs)
  • Network Security Groups (NSGs)
  • Azure Firewall
• Implement secure hybrid connectivity using:
  • IPsec Site-to-Site VPNs
  • AWS Direct Connect
  • Azure ExpressRoute
• Implement cloud segmentation and secure routing patterns for CUI workloads.
• Support centralized logging, monitoring, traffic visibility, and alerting mapped to NIST 800-171 requirements.
• Collaborate with cloud engineering and Governance, Risk, and Compliance (GRC) teams to ensure compliant connectivity solutions.

Requirements:

• Bachelor’s degree in Information Technology, Computer Science, or equivalent professional experience.
• 7+ years of hands-on enterprise network engineering experience.
• Demonstrated experience supporting environments subject to:
  • CMMC
  • NIST SP 800-171
  • DFARS
• Experience supporting compliance implementations and/or assessment activities beyond general familiarity.
• Strong Cisco routing and switching expertise.
• Advanced knowledge of:
  • TCP/IP
  • Subnetting
  • DNS
  • DHCP
  • InfoBlox
• Experience with WAN technologies including:
  • DMVPN
  • SD-WAN
  • DIA
  • Broadband services
• Wireless networking experience with Cisco and/or Meraki solutions.
• Experience with Palo Alto, Cisco ASA, and/or Cisco FTD firewalls.
• Experience supporting:
  • Site-to-site VPNs
  • Remote access VPNs
  • Network segmentation within regulated environments
• Strong troubleshooting skills using Wireshark, tcpdump, and related tools.
• Experience contributing to SSPs, POA&Ms, or CMMC assessment documentation.
• Excellent communication, collaboration, and stakeholder management skills.

Preferred:

• CMMC Registered Practitioner (RP), Certified Professional (CCP), or Certified Assessor (CCA) certification.
• CCNP or CCIE (Enterprise or Security).
• Palo Alto PCNSE or Fortinet NSE certification.
• Cisco Viptela or other SD-WAN implementation experience.
• Network automation experience using:
  • ???????Python
  • Ansible
  • Terraform
  • API-driven networking
• Network Access Control (NAC) experience utilizing Cisco ISE or Aruba ClearPass.
• Prior experience supporting Department of Defense (DoD) or federal contractor environments undergoing active CMMC assessment cycles.