Cybertools
Network & Security Engineer
Job Description
Reports To:
IT SDM (Service Delivery Manager)
Location:
IN-HOUSE Position in Puyallup, WA. - with regular on-site work across client locations in the South Sound region
Employment Type:
Full-time
Initial Mandate:
Full-time engineering delivery across a wide variety of active client projects, with sustained demand and Escalation expertise where needed, as needed.
About the Role
Cybertools is growing its engineering team to keep up with rising project demand across our customer base, and the Network & Security Engineer is central to that growth. Project delivery is the primary focus. You will design, deploy and harden infrastructure across a wide range of active client engagements, with network architecture, security hardening and IT governance at the core of the work.
We also want an engineer who can flex. When capacity allows, you will be expected to step in as an escalation point and support other engineering priorities or client needs as they come up.
You will report to the IT SDM, who owns overall project coordination and client relationships.
Key Responsibilities
Network Architecture & Segmentation
- Design and implement VLAN segmentation, managed switching, and guest/IoT network isolation across multiple client sites.
- Segment camera (CCTV) systems, irrigation/sprinkler controls, and other specialty devices onto isolated network segments, coordinating with third-party vendors as needed.
- Redesign wireless network architecture, including migrations from legacy or locally-managed platforms to centrally-managed solutions.
- Support enterprise VPN connectivity, including SSL VPN, client-to-site, site-to-site, and SaaS-based secure remote access solutions.
Internet Resiliency & Routing
- Design and configure secondary/backup internet connections and automatic failover routing.
- Evaluate and implement WAN failover strategies, including hands-on testing to validate actual failover performance and business continuity.
- Design, deploy, and manage enterprise SD-WAN and routed networks (static and dynamic routing) across multi-client sites, utilizing diverse connection types including DIA, broadband, cellular, satellite, and microwave.
Security Hardening & Firewall Management
- Deploy, configure, and replace enterprise firewalls, including auditing, cleaning up, and re-documenting legacy policies to enforce least-privilege access.
- Support VAPT (vulnerability assessment and penetration testing) and cyber insurance readiness assessments by evaluating current controls against typical underwriting requirements.
- Deploy, harden, and maintain enterprise MFA platforms (e.g., Duo) and enterprise Privileged Access Management (PAM) solutions.
Identity, Device & Endpoint Management
- Design and deploy Mobile Device Management (MDM/MAM) programs, including compliance policies and encryption enforcement.
- Leverage EDR/AV platforms for proactive threat isolation, threat hunting, and automated endpoint remediation.
- Map threat intelligence, security alerts, and adversarial behaviors to the MITRE ATT&CK framework to support security incident management.
- Support identity platform design decisions (e.g., Entra ID/M365 tenant structure) for clients with standalone or under-managed environments.
Business Continuity, Disaster Recovery & Governance
- Develop documented Disaster Recovery and Business Continuity plans, including RTO/RPO definitions and recovery testing.
- Build governance program deliverables for clients, including risk registers, incident response plans, and IT policy frameworks.
- Design centralized logging and SIEM deployments to support incident investigation and detection.
- Support data classification program design for clients with regulatory or industry compliance obligations.
- Perform IT audits and infrastructure assessments to identify risk, document current-state network topology, and inform remediation roadmaps.
Required Qualifications
- 5+ years of hands-on experience in network engineering (switching, routing, VLANs, firewalls, wireless) in an MSP or multi-client environment.
- Working knowledge and set up of firewall platforms (e.g., WatchGuard, Fortinet, SonicWall or similar), managed switching, and enterprise wireless platforms (e.g., Aruba, Instant On, or comparable).
- Experience with Microsoft 365 / Entra ID administration, including tenant design and Conditional Access concepts.
- Demonstrated ability to manage multiple concurrent client projects and communicate technical findings to non-technical stakeholders.
- Valid driver's license and ability to travel regularly to client sites in the South Sound / Puget Sound region.
Preferred Qualifications
- Bachelor’s degree in IT or similar.
- 7+ years of professional network engineering experience.
- Experience with MDM platforms (Microsoft Intune or comparable).
- Prior exposure to IT governance frameworks (risk registers, incident response planning, change management) or compliance-driven environments.
- Familiarity with diverse industry compliance frameworks, including HIPAA, CMMC, SOX, SOC2, and NIST 800-53 / 800-171 guidelines.
- Relevant certifications such as CompTIA Network+/Security+, Cisco CCNA, or equivalent.
- Experience with SIEM/centralized logging platforms.
- Project management certification and experience will be considered an asset.
- Any other relevant network/cybersecurity certifications.
