Cybersecurity Engineer

The City of Chesapeake is seeking a Cybersecurity Engineer to strengthen enterprise cybersecurity capabilities by identifying and responding to threats while engineering secure solutions. This onsite role focuses on security architecture and network security, with responsibility for threat detection and response, plus governance of AI security requirements across the organization.

In this position, you will help define security reference architectures and standards, support penetration testing and remediation, and oversee security controls spanning hybrid networking, cloud platforms, virtualization, and enterprise monitoring. You will also contribute to incident response architecture and forensics planning to improve resilience and reduce impact during security events.

• Design, implement, and maintain enterprise security architectures with emphasis on network security
  , including hybrid cloud networking, virtualization security, secure routing, segmentation, and modern perimeter designs.
• Define and enforce Zero Trust principles using network micro-segmentation, identity-aware access control, secure connectivity patterns, and layered network defenses.
• Create and maintain security reference architectures, standards, and design documentation for network topology, firewalling, secure connectivity, encryption strategies, and inter-system communication paths.
• Provide architectural oversight for firewalls, routers, switches, VPNs, endpoint security/XDR, email security, SIEM telemetry, and vulnerability management to ensure consistent control implementation.
• Perform threat modeling and architectural risk assessments focused on network attack surfaces, segmentation gaps, lateral-movement risks, and protocol vulnerabilities aligned with NIST
  , CIS
  , ISO 27001
  , HIPAA
  , CJIS
  , and PCI (and related frameworks).
• Coordinate penetration testing with a focus on network exploitation paths, segmentation enforcement, firewall rule validation, secure remote access, and driving remediation activities.
• Define secure network design patterns for on-premises, hybrid, and cloud environments, including segmentation and perimeter architectures.
• Define and govern security requirements for AI/ML platforms
  , data pipelines, and model interfaces, including controls for prompt injections, model theft, data poisoning, and unauthorized API access.
• Establish security requirements for AI workloads handling sensitive data, including secure connectivity, encrypted endpoints, audit logging, and compliance-aligned data-access governance.
• Govern secure data-sharing patterns between AI platforms and inter-agency partners (law enforcement, city utilities, health departments) by defining trusted networks and cross-domain access controls.
• Design secure environments on Azure and AWS
  , including segmentation, identity integration, private access, and firewalling.
• Oversee cloud‑native security controls such as Azure Firewall
  , NSGs/ASGs
  , Security Groups
  , Network Firewall
  , CSPM
  , and secrets management
  .
• Ensure hardened network controls for cloud environments supporting critical infrastructure, including monitored integration points and secure OT/IT cloud connectors.
• Define secure configuration for VMware/Hyper‑V, virtual switches, hardened templates, and workload segmentation.
• Provide guidance for securing Windows
  , Linux
  , IoT
  , OT
  , and SCADA environments.
• Triage, analyze, and respond to threats with timely escalation and coordinated remediation actions.
• Continuously monitor security alerts and telemetry to identify anomalous behavior, potential intrusions, and emerging threats.
• Define detection engineering requirements for SIEM/XDR platforms and support proactive threat-hunting activities.
• Use threat intelligence to enrich detections, validate…