Note: The job is a remote job and is open to candidates in USA. Aether Aerospace is a defense technology platform delivering advanced technologies, technology-enabled services, and manufacturing solutions to U.S. Department of Defense and national security customers. The Network Engineer IV will design, secure, implement, document, automate, and sustain a hybrid Azure Government network supporting a Digital Engineering Ecosystem, while leading connectivity, segmentation, monitoring, cybersecurity, RMF support, troubleshooting, and technical coordination.
Responsibilities
- Design, implement, and maintain the hybrid Azure Government network architecture connecting cloud-hosted DEE services with authorized on-premises systems, enterprise services, remote users, and approved external mission partners
- Engineer resilient private connectivity using approved technologies such as Azure ExpressRoute, site-to-site VPN, redundant gateways, and approved network virtual appliances
- Configure and troubleshoot Border Gateway Protocol routing, route propagation, user-defined routes, gateway transit, route filtering, failover, and asymmetric-routing conditions
- Develop and maintain IP address-management, subnetting, route-table, resiliency, and capacity plans that prevent address conflicts and support future environment growth
- Design and administer Azure virtual networks, subnets, peering, route tables, NAT, load-balancing services, gateways, and approved hub-and-spoke or Virtual WAN patterns
- Design and implement secure network segmentation and communication between DEE functional environments using Azure networking services and approved security controls
- Design and maintain the networks for the Cloud Upload & Staging service that serves as the controlled network boundary between external content sources and the private DEE environment, supporting secure content ingestion and transfer
- Develop and maintain network architecture diagrams, authorization-boundary diagrams, trust-zone diagrams, data-flow diagrams, ports/protocols/services matrices, and interface-control information
- Enforce least-privilege north-south and east-west communication and maintain separate management, data, shared-service, staging, and future classified network boundaries
- Design, implement, and maintain Azure Network Security Groups (NSGs) for approved subnets and network interfaces, ensuring inbound and outbound traffic is limited to authorized sources, destinations, protocols, and ports
- Develop and maintain Application Security Groups (ASGs) that logically group workloads by function, security role, application tier, or service type and reduce dependence on individually maintained IP-address rules
- Design and administer Azure Firewall Policy rule collection groups, including DNAT, network, and application rule collections, using approved service tags, IP Groups, fully qualified domain names, and threat-intelligence settings where appropriate
- Implement centrally governed security-admin rules when mandatory enterprise rules must be enforced consistently across selected subscriptions, virtual networks, or network groups
- Maintain a network-rule register containing the rule identifier, control point, source, destination, direction, protocol, port, action, priority, DEE environment, business justification, security-requirement reference, owner, approval authority, review or expiration date, and test evidence
- Apply least-privilege and default-deny principles and prohibit unrestricted any-to-any rules unless supported by an approved, documented, time-bounded exception
- Analyze the combined effect of security-admin rules, subnet and network-interface NSGs, Azure Firewall policies, routing tables, NAT rules, private endpoints, and hybrid connectivity controls
- Review rules periodically and after architecture, application, interface, or mission changes to identify obsolete, duplicative, shadowed, unused, or overly permissive rules
- Implement Private Endpoint and Private Link as the preferred access pattern for supported Azure platform services and document approved exceptions to public network exposure
- Design and maintain Azure Private DNS zones, Azure DNS Private Resolver, DNS forwarding, conditional forwarding, and integration with approved on-premises DNS services
- Validate routing, firewall policy, name resolution, and service reachability from Azure, on-premises, remote-access, and shared-service locations
- Integrate approved remote-access capabilities with identity, multifactor authentication, conditional access, device posture, logging, and least-privilege network access requirements
- Configure and maintain applicable SIEM integrations and alerts for ExpressRoute and VPN health, route changes, firewall events, denied traffic, packet loss, latency, DNS failures, private-endpoint availability, and abnormal traffic patterns
- Perform packet capture, next-hop analysis, connection troubleshooting, effective-security-rule analysis, route validation, and end-to-end network performance testing
- Analyze bandwidth, throughput, latency, packet loss, storage-access patterns, and transfer performance for digital engineering models, technical data packages, simulation outputs, configuration baselines, and other large engineering datasets
- Develop and maintain network infrastructure as code using approved tools such as Bicep, Terraform, Azure Resource Manager templates, PowerShell, Azure CLI, or program-approved automation frameworks
- Integrate network and security-rule changes with the DEE DevSecOps process, including source control, peer review, automated validation, testing, approval, deployment, rollback, and configuration-baseline management
- Develop and maintain reusable Infrastructure as Code modules for virtual networks, subnets, NSGs, ASGs, route tables, private endpoints, private DNS, diagnostic settings, firewall policies, and network-rule collections
- Support NIST SP 800-171 Revision 3, NIST SP 800-53 Revision 5, DoW Cloud Computing Security Requirements Guide, applicable DISA STIGs, RMF, and program-specific cybersecurity requirements
- Produce and maintain RMF evidence including ports/protocols/services inventories, firewall and NSG rule sets, route tables, private-endpoint and DNS inventories, test results, configuration baselines, change records, and monitoring evidence
- Participate in technical reviews, design reviews, change-control boards, control assessments, vulnerability-remediation activities, incident response, and authorization-package development
- Coordinate with the ISSM, ISSO, security architect, system architect, cloud engineers, application owners, and assessment personnel to resolve findings and validate network-control implementation
- Develop network implementation plans, maintenance procedures, rollback plans, continuity procedures, and disaster-recovery connectivity strategies
- Plan and execute upgrades and enhancements without disrupting engineering operations or weakening CUI protections
- Lead troubleshooting of complex incidents spanning Azure, on-premises infrastructure, identity services, DNS, firewalls, routing, application services, and external connections
- Evaluate network technologies and provide cost, performance, interoperability, security, authorization, and lifecycle recommendations
- Provide technical support to program operational strategies and initiatives that optimize processes, enhance productivity, and ensure quality across program functions
- Ensure 100% of planned hours are worked and accurately recorded
- Identify and forward opportunities that may support growth within the work area and participate in growth efforts as requested
- Ensure contractual deliverables are met or exceeded to the customer's satisfaction
- Complete the personal development plan (PDP) and actively participate in Staff Meetings and Storytime with the camera on
- Build productive and positive professional relationships with clients and cross-functional program teams
- Execute assigned contract requirements in accordance with the contract-specific labor category and requirements
- Perform other related duties as assigned
Skills
- Clearance: Active Secret clearance
- Education and Years of Experience: Bachelor's degree in computer science, information systems, engineering, cybersecurity, or a related field (or equivalent) with 8-10 years of relevant experience, or a Master's degree with 6-8 years of relevant experience
- • Extensive experience designing, implementing, securing, and sustaining enterprise hybrid-cloud networks
- • Hands-on experience with Azure virtual networks, subnets, peering, route tables, Network Security Groups, Application Security Groups, Azure Firewall Policy, VPN Gateway, ExpressRoute, private endpoints, private DNS, and network monitoring
- • Strong knowledge of TCP/IP, BGP, IPsec, DNS, routing, switching, firewalls, NAT, network segmentation, load balancing, high-availability design, and hybrid name resolution
- • Experience developing and maintaining network diagrams, traffic-flow documentation, firewall and security-group rule matrices, IP-address plans, implementation plans, rollback plans, and test procedures
- • Experience analyzing effective security rules and troubleshooting interactions among NSGs, Azure Firewall, routing, NAT, private endpoints, DNS, and hybrid connectivity
- • Experience implementing network and security-rule configurations through infrastructure as code, source control, peer review, and controlled deployment pipelines
- • Experience with enterprise and Azure-native monitoring, logging, performance analysis, and incident troubleshooting
- • Working knowledge of NIST SP 800-171, NIST SP 800-53, RMF, CMMC, DoD Cloud SRG, and applicable DISA STIG requirements
- • Effective leadership and communication skills for coordinating with system architects, cybersecurity personnel, application owners, program leadership, and Government stakeholders
- • Current CompTIA Security+ CE certification is required
- • Microsoft Certified: Azure Network Engineer Associate, Azure Solutions Architect, Azure Security Engineer, or equivalent demonstrated experience
- • Cisco CCNP Enterprise, CCNP Security, or an equivalent advanced networking certification
- • Experience with Azure Government, DoW cloud impact-level environments, controlled unclassified information, or classified network environments
- • Experience with Terraform, Bicep, PowerShell, Python, Azure CLI, Linux, Bash scripting, or other network and cloud automation tools
- • Experience with Azure Firewall Premium, Azure Virtual Network Manager, ExpressRoute, Private Link, Azure DNS Private Resolver, Network Watcher, Connection Monitor, virtual network flow logs, Traffic Analytics, and Log Analytics
- • Experience with approved Palo Alto, Cisco, Fortinet, or other network virtual appliances deployed in Azure
- • Experience supporting MBSE repositories, product lifecycle management systems, configuration-management repositories, simulation environments, high-performance computing, or large engineering-data transfers
- • Experience supporting RMF assessments and producing technical implementation and verification evidence
- • Prior experience in Government, defense, aerospace, or other large-scale regulated network environments
Benefits
- Learning and development opportunities
- Health and wellness programs
- Income protection
- Paid leave
- Retirement and savings
Company Overview