Cyber security Architect with Security Clearance

Cyber Security Architect
Level / experience
Senior / Principal, 10+ years in cybersecurity or network security; 5+ years designing NAC, zero trust, or C2C solutions
Location
Onsite at the base
Reports to
Engineering manager
Role summary
Designs the C2C policy set and enforcement strategy for each base, and is the technical authority for Step 4. Turns each base’s current state into a plan the team and the change board can execute. Key responsibilities
Design device profiling, posture/interrogation, auto-remediation, and enforcement policies for Steps 1–4.

Define the Step 4 enforcement approach: monitor mode, wave sequencing by building or VLAN, quarantine and remediation VLANs, and rollback criteria. Produce the gap analysis, design documents, and technical content for change board packages. Design handling for exception devices (MAB, exception policies, segmentation) with base stakeholders. Design integrations with ACAS/vulnerability tools, endpoint security, AD/PKI, RADIUS, SIEM, and CMDB. Review the team’s work, resolve technical blockers, and capture lessons learned and reusable policy templates across bases.

Required qualifications
Designed and deployed a NAC or C2C solution enforcing access for thousands of endpoints in a production environment. Deep knowledge of 802.1X, EAP-TLS, MAB, CoA, RADIUS/TACACS+, and PKI/CAC-based authentication. Knowledge of the DoD C2C framework and the DoD CIO C2C steps, plus RMF, STIGs, and ACAS. Experience with the platform used at the base (commonly Forescout and/or Cisco ISE) [confirm per base]. Able to explain risk and tradeoffs clearly to non-technical base leadership. Preferred qualifications
Prior DoD/DISA C2C or zero trust experience.

Experience with the enterprise integration side (orchestration, APIs, SIEM). Experience writing ATO/RMF artifacts or supporting authorization packages. Certifications
CISSP or CASP+ (preferred)
Security+ baseline
Vendor architect/professional certification for the C2C platform (Forescout or Cisco Security/ISE)