Sr. NSX Engineer

Job Title: Sr. NSX Engineer
Job Location: Springfield, VA
Compensation: $160,000 - $180,000
Eligibility/Clearance: Candidate must possess an active TS/SCI clearance
and be willing to obtain a CI Polygraph
Job Description:
We are seeking a Senior NSX Engineer to design, implement, operate,
secure, and troubleshoot VMware NSX-based network virtualization in a
mission-critical U.S. Department of Defense environment. The ideal
candidate brings at least 5 years of hands-on VMware NSX engineering
experience, strong vSphere/VCF integration knowledge, and a proven
record working within DoD security, compliance, and operational
processes.
This role is suited to an engineer who can own the full NSX
lifecycle—from architecture and deployment through operational support,
hardening, automation, upgrades, and incident resolution—while
collaborating effectively with network, cybersecurity, systems, storage,
and program teams.
Key Responsibilities
· · Design, deploy, configure, and sustain VMware NSX-T / VCF Networking
solutions supporting production, development, test, and mission
environments.
· Engineer and maintain NSX management, control, and data planes,
including NSX Managers, transport nodes, transport node profiles, host
and edge transport zones, uplink profiles, N-VDS or VDS-backed
configurations as applicable, and NSX Edge clusters.
· Design and administer logical networking services, including overlay
segments, VLAN-backed segments, Tier-0 and Tier-1 gateways, distributed
routing, BGP, static routing, ECMP, north-south connectivity, and
east-west traffic flows.
· Implement and maintain microsegmentation and zero-trust-aligned
controls using NSX Distributed Firewall, Gateway Firewall, groups, tags,
service insertion, context profiles, and policy-based security controls.
· Develop and manage firewall rulesets in coordination with
cybersecurity, ISSO/ISSM, RMF, application, and network teams; ensure
policies follow least-privilege principles and are documented, reviewed,
approved, and auditable.
· Integrate NSX with VMware vCenter Server, vSphere clusters, VMware
Cloud Foundation, vSAN, VMware Aria Operations/Logs, identity platforms,
PKI/certificate services, SIEM platforms, vulnerability-management
tools, and enterprise monitoring systems.
· Troubleshoot complex issues across virtual and physical networking
layers, including routing adjacency failures, BGP peering, MTU
mismatches, tunnel
endpoint connectivity, Geneve encapsulation, multicast or unicast
replication behavior, firewall rule processing, asymmetric routing,
packet loss, performance degradation, and Edge-node failures.
· Perform packet-level troubleshooting using NSX CLI, nsxcli, ESXi
commands, vmkping, pktcap-uw, tcpdump-uw, distributed firewall rule
analysis, logical-port inspection, traceflow, flow monitoring, and
physical-switch diagnostics.
· Lead planning and execution for NSX upgrades, patches, certificate
replacement, configuration changes, migrations, backup/restore
validation, and lifecycle-management activities while minimizing
operational risk and service interruption.
· Develop implementation plans, maintenance-window procedures, backout
plans, test plans, validation checklists, and post-change documentation
for production changes.
· Support migration efforts from legacy NSX-V, traditional VLAN-based
networks, legacy firewall architectures, or standalone NSX environments
into VMware Cloud Foundation and modern NSX-based architectures.
· Build and maintain standardized NSX configuration baselines, naming
conventions, network diagrams, IP address-management documentation,
firewall-policy matrices, operational runbooks, and as-built
documentation.
· Participate in architecture reviews, design discussions, technical
interchange meetings, engineering change reviews, compliance
assessments, and operational readiness reviews.
· Provide Tier 3 escalation support for NSX, vSphere networking,
distributed firewalling, routing, and virtual network security
incidents.
· Mentor junior engineers and administrators; establish repeatable
engineering standards and operational procedures for NSX support.
Skills/Qualifications:
Required:
· Bachelor’s degree in Information Technology, Computer Science,
Engineering, Cybersecurity, or a related discipline; equivalent
relevant experience may be substituted.
· At least 5 years of hands-on experience designing, implementing,
operating, or supporting VMware NSX in enterprise-scale environments.
· At least 5 years of experience with VMware vSphere, including ESXi,
vCenter Server, vSphere Distributed Switches, virtual networking,
cluster operations, host lifecycle management, and troubleshooting.
· Demonstrated expertise with NSX-T / VMware Cloud Foundation
Networking capabilities, including:
o Overlay and VLAN-backed segments
o Tier-0 and Tier-1 gateways
o Distributed routing and centralized services
o NSX Edge Nodes and Edge clusters
o BGP, static routing, ECMP, and route redistribution
o Distributed Firewall and Gateway Firewall
o Security groups, dynamic membership, tagging, and policy automation
o North-south and east-west traffic design
o VPN, NAT, load-balancing, DHCP, DNS forwarding, and other NSX
services as applicable
o NSX Manager clustering, backups, certificates, upgrades, and
recovery procedures
· Strong understanding of enterprise networking fundamentals,
including TCP/IP, DNS, DHCP, ARP, VLANs, VXLAN/Geneve, MTU, routing,
BGP, OSPF, VRFs, link aggregation, firewalling, NAT, load balancing,
and network troubleshooting.
· Hands-on experience operating in DoD, federal civilian, intelligence
community, or other heavily regulated environments with formal change
control, documentation, security approval, and audit requirements.
· Working knowledge of DoD cybersecurity processes and terminology,
including RMF, ATO, STIGs, POA&Ms, vulnerability management, DISA
guidance, security controls, and continuous monitoring.
· Ability to review, interpret, and remediate applicable DISA STIGs
and security findings for VMware components, operating systems, and
supporting infrastructure.
· Strong written and verbal communication skills, including the
ability to create technical diagrams, implementation plans, security
documentation, standard operating procedures, and executive-ready
status updates.
Required certifications
The final certification requirement should align with the contract’s
assigned DoD Cyber Workforce Framework role and component-specific
guidance. A practical baseline for this role is:
· Current CompTIA Security+ CE or another approved DoD 8140-aligned
baseline certification appropriate to the assigned work role.
· One current VMware/Broadcom networking, security, or
cloud-foundation certification, such as:
o VMware Certified Professional – Network Virtualization / VCP-NV, if
held and applicable
o VMware Certified Professional – VMware Cloud Foundation
Administrator
o VMware Certified Professional – VMware Cloud Foundation Architect
o Comparable current Broadcom/VMware certification focused on NSX, VCF
networking, or network virtualization
Desired:
· 5+ years of enterprise network virtualization, virtual
infrastructure, network security, or cloud-platform engineering
experience.
· Experience designing or supporting VMware Cloud Foundation
environments, including VCF lifecycle management, SDDC Manager,
workload domains, vSphere, and NSX integration.
· Experience integrating NSX with physical enterprise networks,
including Cisco Nexus, Juniper, Palo Alto Networks, F5, or similar
technologies.
· Familiarity with data-center architectures such as VXLAN, BGP
underlay/overlay routing, multi-rack design, and high-availability
network services.
· Experience with automation and infrastructure as code using
PowerShell/PowerCLI, Ansible, VMware Aria Automation, REST APIs, Git,
YAML, and JSON.
· Experience integrating NSX telemetry and logs with Splunk and
Elastic.
· Experience with enterprise PKI, certificate lifecycle management,
Active Directory, LDAP, identity federation, RBAC, privileged-access
management, and multifactor authentication.
· Experience supporting disconnected, air-gapped, tactical edge, or
classified environments.
· Experience with Dell PowerEdge, Cisco UCS, HPE and storage/network
performance troubleshooting.
· Familiarity with DISA STIG Viewer, SCAP scanning, ACAS/Nessus and
POA&M remediation workflows.
Education:
Bachelors Degree in Computer Science or a related field
ATR is an Equal Opportunity Employer (EOE) who will provide equal
employment opportunity to employees and applicants for employment
without regard to race, ethnicity, religion, color, sex, pregnancy,
national origin, age, veteran status, ancestry, sexual orientation,
gender identity or expression, marital status, family structure, genetic
information, or mental or physical disability