SME Network and Computer Systems Administrator

Please note that this position is contingent upon the successful award of a contract currently under bid.

Please note that this position is contingent upon the successful award of a contract currently under bid.

A leader in cutting-edge research and technology in the cyber arena, CPMG focuses on using business drivers to guide cybersecurity activities and manage risk. CPMG offers flexible, integrative solutions for Department of Defense (DoD) contractors, among others, and specializes in cybersecurity, information and operational technology, electronic security surveillance, and support services.

We are actively seeking a SME Network and Computer Systems Administrator to act as the primary architect and guardian of high-assurance communications within classified enclaves, directly implementing the stringent security requirements mandated by DoDM 5205.07 and the JSIG. Their core responsibility centers on designing, hardening, and maintaining physically and logically isolated network infrastructures to prevent unauthorized lateral movement between highly compartmentalized program elements.

• Design and implement isolated local and wide-area multi-tenant network enclaves enforcing strict data-in-transit segregation between differing Special Access Required (SAR) compartments.
• Implement and verify physical and electromagnetic separation of cryptographic/classified (RED) and unclassified/cipher (BLACK) signal cabling, conduits, and equipment racks.
• Configure, deploy, key, and maintain NSA-approved Type-1 High Assurance IP Encryption (HAIPE) devices (e.g., KG-175 TACLANE) to establish point-to-point and mesh cryptographically secure overlays.
• Apply, script, and continuously audit Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) across multilayer switches, routers, and firewalls.
• Develop network boundary diagrams, hardware/software baselines, port/protocol/service (PPS) documentation, and control implementations for the System Security Plan (SSP) and Authorization Packages.
• Engineer and manage strict network segmentation using Virtual Routing and Forwarding (VRF-Lite/MPLS), 802.1Q VLAN isolation, and private access control lists (ACLs) to block unauthorized inter-compartment lateral traversal.
• Enforce IEEE 802.1X port-level authentication, MAC address filtering, and dynamic VLAN assignment; disable and lock down all unassigned physical switch ports inside the SAPF.
• Validate hash integrity and deploy firmware, software upgrades, and security definitions onto air-gapped network appliances.
• Perform rigorous intake, serial tracking, tamper inspections, and provenance verification on all commercial network hardware prior to introduction into a SAP environment.
• Support and maintain facility physical access control, intrusion detection and video surveillance systems
• Support and maintain organization video teleconferencing (VTC) system
• Execute emergency technical network isolation procedures (e.g., remote quarantine, port isolation) during suspected security incidents, data spills, or unauthorized cross-contamination.
• Maintain strict configuration baselines, automate differential backups, and execute configuration audits to ensure unapproved network changes do not invalidate the system's Authority to Operate (ATO).

• Must have verifiable expertise in defining, implementing and sustaining SAP network systems, practices and procedures for SAP facilities.
• Verifiable expertise in products and systems utilized by the SAP community and are familiar with the Air Force Instructions, JSIG-series regulations or equivalent.
• Excellent customer service, written and verbal…