Remote Principal Controls Engineer Jobs in Silver Spring, MD

Koniag Data Solutions, a Koniag Government Services company, is seeking an experienced Zero Trust Engineer to support enterprise cybersecurity operations and IT administrative and operational support services for a federal government client. This position requires an active security clearance or the ability to obtain and maintain a government background investigation and all requisite IT access authorizations prior to performing work. Specific clearance requirements will be confirmed at time of offer. Primary work will be performed at the client site in Washington DC and approved remote/telework locations.

We offer competitive compensation and an extraordinary benefits package including health, dental and vision insurance, 401K with company matching, flexible spending accounts, paid holidays, three weeks paid time off, and more.

This role serves as a critical technical function responsible for the architecture, engineering, implementation, and continuous advancement of Zero Trust security capabilities across a complex, geographically distributed federal IT environment spanning on-premises infrastructure, cloud platforms, enterprise applications, and hybrid network environments.

The ideal candidate is a technically proficient and strategically minded cybersecurity engineer with deep, hands-on expertise in Zero Trust Architecture principles, Federal Zero Trust policy frameworks, identity and access management technologies, network micro-segmentation, endpoint security, data protection, and the practical implementation of Zero Trust controls across diverse enterprise technology stacks. This individual must possess the technical depth, cross-domain knowledge, and collaborative leadership skills required to drive the Government's Zero Trust maturity forward in alignment with NIST SP 800-207, OMB M-22-09, and applicable Federal Zero Trust mandates and implementation guidance.

The Zero Trust Engineer will serve as the program's primary technical expert and implementation lead for Zero Trust Architecture (ZTA) initiatives, responsible for driving the design, engineering, implementation, and continuous improvement of Zero Trust security capabilities across all pillars of the enterprise environment—identity, devices, networks, applications, data, and visibility and analytics. This individual works closely with security engineers, network engineers, cloud operations teams, identity and access management specialists, DevSecOps engineers, and Government stakeholders to ensure Zero Trust principles are systematically embedded across the enterprise technology stack, advancing the Government's Zero Trust maturity in alignment with Federal mandates and the program's security objectives.

Principal responsibilities will include but are not limited to:

Zero Trust Architecture & Strategy

• Serve as the program's subject matter expert and technical authority for Zero Trust Architecture, providing authoritative guidance, engineering leadership, and expert recommendations to program leadership, functional teams, and Government stakeholders on Zero Trust strategy, implementation priorities, and maturity advancement.
• Develop and maintain the program's Zero Trust Architecture documentation, including ZTA reference architecture diagrams, Zero Trust pillar maturity assessments, implementation roadmaps, and technical design specifications aligned with NIST SP 800-207, OMB M-22-09, CISA Zero Trust Maturity Model, and applicable Federal Zero Trust implementation guidance.
• Conduct comprehensive Zero Trust maturity assessments across all five Zero Trust pillars—Identity, Devices, Networks, Applications and Workloads, and Data—identifying current state capabilities, maturity gaps, and prioritized improvement opportunities across the enterprise environment.
• Develop and maintain Zero Trust implementation roadmaps, translating maturity assessment findings and Federal Zero Trust mandates into actionable, sequenced engineering initiatives with clear milestones, dependencies, and success criteria.
• Lead Zero Trust architecture reviews for new systems, infrastructure changes, application deployments, and cloud migrations, assessing Zero Trust alignment, identifying implementation gaps, and recommending compensating controls and architectural improvements.
• Evaluate emerging Zero Trust technologies, industry frameworks, and Federal policy developments, providing well-researched recommendations to program leadership and Government stakeholders on opportunities to advance Zero Trust maturity and security posture.
• Provide technical leadership and mentorship to security engineering team members on Zero Trust principles, implementation techniques, and Federal compliance requirements, fostering a shared understanding of Zero Trust objectives across the program.

Identity Pillar Implementation

• Lead the engineering and implementation of Zero Trust identity controls across the enterprise environment, ensuring all user and non-person entity (NPE) identities are continuously verified, strongly authenticated, and least-privilege access principles are consistently enforced.
• Design and implement enterprise-wide Multi-Factor Authentication (MFA) enforcement, ensuring phishing-resistant MFA—including PIV/CAC, FIDO2, and other approved strong authentication methods—is deployed and enforced for all user access to Government systems and applications.
• Engineer and implement identity risk-based conditional access policies across enterprise identity platforms, including Microsoft Entra ID and Okta, ensuring access decisions continuously evaluate identity risk signals, device compliance, location, and behavioral context.
• Support the implementation and maturation of Privileged Access Management (PAM) capabilities, including just-in-time access provisioning, privileged session management, and credential vaulting, ensuring privileged access is tightly controlled, monitored, and auditable.
• Implement and maintain identity governance and administration (IGA) controls, including automated access provisioning and deprovisioning, access certification campaigns, and segregation of duties enforcement, in alignment with Zero Trust least-privilege and need-to-know principles.
• Develop and maintain identity-aware security policy integrations across network security, endpoint security, and application security platforms, ensuring identity context is consistently leveraged to enforce granular, risk-based access controls across the enterprise.
• Support the integration of non-person entity (NPE) identity management capabilities, including service accounts, application identities, API credentials, and machine identities, into the Zero Trust identity framework.

Device Pillar Implementation

• Lead the engineering and implementation of Zero Trust device trust capabilities, ensuring all managed and unmanaged devices seeking access to Government resources are continuously evaluated for compliance, health, and trustworthiness prior to access being granted.
• Design and implement device compliance policy frameworks across enterprise endpoint management platforms, including Microsoft Intune, ensuring device health signals—including patch compliance, EDR agent status, configuration compliance, and disk encryption status—are continuously assessed and integrated into access control decisions.
• Engineer device-based conditional access policy integrations between endpoint management platforms and enterprise identity providers, ensuring non-compliant or unmanaged devices are automatically restricted from accessing sensitive Government resources.
• Implement and maintain continuous device monitoring capabilities, ensuring device health and compliance status is continuously evaluated throughout active sessions and that access is revoked or restricted when device trust signals degrade.
• Support the implementation of enterprise certificate-based device authentication capabilities, ensuring all managed devices are issued and maintain valid device identity certificates used for network access control and Zero Trust policy enforcement.

Network Pillar Implementation

• Lead the engineering and implementation of Zero Trust network security controls, including network micro-segmentation, software-defined perimeter capabilities, encrypted communications enforcement, and identity-aware network access control across the enterprise environment.
• Design and implement network micro-segmentation architectures, working with network engineers and Palo Alto Networks platform engineers to define and enforce granular network segmentation policies that limit lateral movement and enforce least-privilege network access between workloads, applications, and user segments.
• Implement and maintain software-defined perimeter (SDP) and Zero Trust Network Access (ZTNA) capabilities, replacing legacy VPN-based remote access models with identity-aware, least-privilege application access controls that continuously verify user and device trust prior to granting network access.
• Design and implement encrypted communications enforcement policies, ensuring all data in transit is encrypted using approved cryptographic protocols and that unencrypted communications are detected, blocked, or remediated across the enterprise environment.
• Support the implementation of DNS security controls, including DNS filtering, DNS-over-HTTPS (DoH) policy management, and malicious domain blocking, as a key Zero Trust network visibility and control capability.
• Develop and maintain network pillar Zero Trust metrics and reporting, providing program leadership and Government stakeholders with accurate visibility into network segmentation coverage, ZTNA adoption, encrypted traffic enforcement, and lateral movement risk reduction.

Application & Workload Pillar Implementation

• Lead the engineering and implementation of Zero Trust application and workload security controls, ensuring all applications and workloads are protected through continuous authorization, least-privilege access enforcement, and runtime security monitoring.
• Design and implement application-level Zero Trust access controls, including continuous authorization policies, step-up authentication triggers, and session risk monitoring capabilities that enforce least-privilege access throughout active application sessions.
• Support the integration of enterprise applications with Zero Trust identity and access management platforms, ensuring applications leverage centralized, policy-driven authentication and authorization rather than legacy, application-managed access control mechanisms.
• Implement and maintain application security posture monitoring capabilities, including web application firewall (WAF) integration, API security controls, and application-layer threat detection, ensuring application-level security visibility is integrated into the Zero Trust policy decision and enforcement framework.
• Support the implementation of workload identity and runtime security controls across cloud and containerized environments, including workload identity attestation, container security policies, and cloud workload protection capabilities aligned with Zero Trust principles.

Data Pillar Implementation

• Lead the engineering and implementation of Zero Trust data security controls, ensuring sensitive Government data is identified, classified, protected, and continuously monitored in alignment with Zero Trust data-centric security principles.
• Design and implement enterprise data classification and labeling capabilities, working with information security and compliance teams to ensure sensitive data—including CUI and other protected information categories—is accurately identified and labeled across all storage, processing, and transmission contexts.
• Implement and maintain data access control policies aligned with Zero Trust least-privilege principles, ensuring access to sensitive data is restricted to authorized identities and devices with legitimate, verified need-to-know, continuously evaluated throughout access sessions.
• Support the implementation of Data Loss Prevention (DLP) capabilities across endpoint, network, email, and cloud storage environments, ensuring sensitive data exfiltration attempts are detected, blocked, and alerted in accordance with defined DLP policies.
• Implement and maintain encryption controls for sensitive data at rest and in transit, ensuring approved cryptographic standards are applied consistently across all environments where sensitive Government data is stored or transmitted.

Visibility, Analytics & Automation Pillar Implementation

• Lead the engineering and implementation of Zero Trust visibility and analytics capabilities, ensuring comprehensive telemetry collection, behavioral analytics, and automated policy enforcement mechanisms are in place to support continuous trust evaluation across the enterprise.
• Design and implement Zero Trust telemetry collection architectures, ensuring security-relevant events from identity, device, network, application, and data sources are ingested into the enterprise SIEM and analytics platforms for continuous monitoring and threat detection.
• Develop and maintain Zero Trust-aligned detection content within the enterprise SIEM platform, including detection rules, behavioral analytics, and anomaly detection capabilities that operationalize Zero Trust trust signals and risk indicators for threat detection and response.
• Support the implementation of Security Orchestration, Automation, and Response (SOAR) capabilities that automate Zero Trust policy responses to detected trust violations, including automated access revocation, device isolation, and incident escalation workflows.
• Develop and maintain Zero Trust maturity metrics and analytics reporting, providing program leadership and Government stakeholders with data-driven visibility into Zero Trust implementation progress, control effectiveness, and residual risk across all pillars.

Compliance, ATO & Federal Zero Trust Policy Alignment

• Ensure all Zero Trust engineering activities are conducted in full compliance with applicable Federal Zero Trust mandates and frameworks, including NIST SP 800-207, OMB M-22-09, CISA Zero Trust Maturity Model, applicable DISA Zero Trust reference architectures, NIST SP 800-53, FISMA, FedRAMP, and client-specific Zero Trust implementation requirements.<...