Senior Network Security Engineer

The Senior Network Security Engineer supports our program with the U.S. Census Bureau by designing, implementing, operating, troubleshooting, and improving enterprise network security services across on-premises, hybrid-cloud, and cloud-connected environments. The role focuses on firewall engineering, VPN and remote access services, RSA Secur

ID or equivalent MFA/token services, content filtering, network access control, edge security services, monitoring and logging integration, vulnerability remediation, security documentation, and policy compliance for TCO-managed systems.

The engineer serves as a senior technical resource for secure network architecture, operations support, incident response coordination, and compliance support. This position works closely with TCO leadership, Network Infrastructure, Identity and Domain Services, cloud teams, SOC/NOC/Operations Center personnel, the Office of Information Security (OIS), Information System Security Officers (ISSOs), System Owners, and application teams.

• Primary scope:
  Cisco and Palo Alto firewall platforms; firewall policy lifecycle; NAT; segmentation; remote access and site-to-site VPN; RSA Secur
  
  ID or equivalent MFA/two-factor authentication server and token services;
  Cloudflare or equivalent DNS/DDoS/WAF/Zero Trust edge security services; content filtering; network access control; monitoring, logging, and SIEM integration; vulnerability remediation; POA&M support; and audit evidence for TCO-managed systems.
• Coordination scope: SOC/NOC/Operations Center support, cloud and hybrid connectivity, IAM/DDI integrations, wireless/LAN dependencies, security architecture, change management, application access troubleshooting, and cross-team incident response.
• Role boundary:
  This is not a primary F5 BIG-IP/LTM/GTM/ASM/Advanced WAF or load-balancer administration role. The engineer will coordinate with the dedicated F5/application delivery team when firewall, VPN, DNS, WAF, certificate, routing, or application-traffic issues require cross-team support.
• RSA/MFA boundary:
  This role includes operational support for RSA Secur
  
  ID or equivalent two-factor authentication services used by VPN and remote access, including server operations, software updates, token support, and troubleshooting. Broader enterprise IAM, directory services, and PKI functions remain coordinated with the Identity Management and Domain Services (IMDS) team.

• Design, configure, administer, maintain, and troubleshoot enterprise firewall solutions, including Cisco and Palo Alto platforms, firewall policy rule bases, NAT, segmentation, threat prevention, logging, high availability, and secure configuration baselines.
• Install, configure, maintain, and upgrade firewall hardware and software into new and existing network infrastructure, including cloud-connected environments.
• Administer firewall policies and services in accordance with Census IT security policy, secure configuration standards, and change control processes.
• Perform recurring firewall rule base reviews, rule recertification, policy cleanup, decommissioning of obsolete rules, and optimization to reduce risk and complexity.
• Identify, diagnose, and resolve firewall issues involving connectivity, rule behavior, utilization, performance, routing, VPNs, DNS, TLS/certificates, application flows, and log/packet analysis.

• Install, configure, maintain, monitor, and troubleshoot VPN services, including remote access VPN, site-to-site VPN, client/clientless access, partner connectivity, mobile device access, and cloud connectivity.
• Support RSA Secur
  
  ID or equivalent MFA/two-factor authentication and directory service integrations for VPN and remote access services where applicable.
• Maintain, operate, administer, patch, upgrade, and troubleshoot RSA Secur
  
  ID or equivalent MFA/two-factor authentication infrastructure supporting VPN and remote access, including authentication servers/appliances, middleware/agents, certificates, high availability, backups, logs, monitoring, and directory service integration.
• Support RSA/MFA token lifecycle operations, including hardware and software token provisioning, assignment, activation, replacement, resynchronization, deactivation, inventory tracking, end-user/tiered support, and emergency access processes.
• Monitor and report on VPN availability, utilization, and performance, and resolve connectivity issues affecting users, business partners, cloud networks, and mission systems.

• Administer or support Cloudflare and related edge security capabilities, including DNS, DDoS protection, WAF policies, CDN, Access/Gateway, Zero Trust/ZTNA, tunneling, access controls, and logging.
• Design, implement, maintain, and troubleshoot content filtering services, including web security gateways, email security gateways, URL filtering, Data Loss Prevention (DLP)…