Senior Cisco Identity Services Engine (ISE) Engineer

Experience

10–15 years of relevant network/security engineering experience, with significant hands-on experience designing, operating, troubleshooting, upgrading, and supporting Cisco Identity Services Engine (ISE) in a large enterprise production environment.

Position Summary

We are seeking an experienced Cisco ISE Engineer to provide engineering and operational ownership of an enterprise Cisco Identity Services Engine environment. The engineer will be responsible for maintaining the health, security, resiliency, and availability of the ISE platform while supporting enterprise wired and wireless authentication, network access control, identity integrations, infrastructure migrations, security remediation, and production incidents.

The ideal candidate will be comfortable operating a multi-node, highly available ISE environment and independently leading complex production changes from planning through implementation, validation, troubleshooting, rollback, and post-change documentation.

This role requires someone who can work across Network Engineering, Wireless, Windows/Endpoint Engineering, Security, Firewall, DNS, Splunk, application teams, and Cisco TAC to resolve issues that span multiple technology domains.

Core Technical Skills

10–15 years of network/security engineering experience, with strong recent hands-on Cisco ISE experience.

Advanced administration and troubleshooting of Cisco ISE 3.x, including upgrades, patches, configuration changes, node maintenance, and platform health.

Experience supporting distributed, multi-node ISE deployments across production and non-production environments.

Strong knowledge of 802.1X, RADIUS, EAP/EAP-TLS, certificate-based authentication, Network Access Control (NAC), and AAA concepts.

Strong understanding of Cisco ISE authentication and authorization policies, policy sets, identity sources, endpoint access, and security-group-based access controls.

Experience creating, modifying, validating, and troubleshooting ISE authorization policies and AD/security group mappings.

Strong understanding of PKI and certificate lifecycle management, including:

ISE system/server certificates

Root and intermediate Certificate Authorities

Certificate chains and trust

Certificate thumbprints

Certificate renewal and replacement

EAP authentication certificates

Troubleshooting endpoint authentication following certificate changes

Ability to assess the impact of a certificate change across wireless profiles, Windows endpoints, authentication policies, and dependent systems before implementing a production change.

Experience planning and performing Cisco ISE version upgrades and patch installations, including node sequencing, service restarts, validation, rollback planning, and post-change shakeouts.

Experience identifying ISE security vulnerabilities, assessing exposure, reviewing Cisco advisories, and implementing the appropriate Cisco patches or software upgrades.

Strong troubleshooting capability using ISE logs, Live Logs, authentication records, packet captures, debug information, and system logs.

Hands-on experience using packet captures to validate DNS, authentication, network flows, and communication between ISE and dependent infrastructure.

Working knowledge of Splunk/syslog integration, including forwarding ISE logs, querying historical ISE events, and developing operational monitoring and alerting.

Experience integrating monitoring with ServiceNow incident creation, including automated generation of incidents based on critical or fatal ISE events.

Ability to troubleshoot authentication issues involving Active Directory, enterprise security groups, service accounts, and application/device access policies.

Experience integrating Cisco ISE with enterprise platforms and services such as Cisco Catalyst, Meraki, firewalls, F5, DNS, SIEM/Splunk, and other network/security platforms.

Understanding of firewall connectivity requirements, ports, protocols, and access rules required for ISE integrations.

Experience supporting syslog integrations, including UDP/TCP syslog destinations, facility configuration, firewall requirements, and log validation.

Experience troubleshooting wired and wireless enterprise access issues, particularly certificate-based enterprise Wi-Fi authentication.

Familiarity with Cisco Catalyst and enterprise wireless environments where ISE provides identity, authentication, and authorization services.

Production Change Management / ServiceNow Skills

The engineer must be capable of independently owning ServiceNow changes from engineering design through successful production validation.