Apply on Employer Site

Booz Allen Hamilton · 3 days ago

Endace Platform Engineer

Washington, DC

Full-time

Hybrid

Senior Level

$78K/yr - $176K/yr

5+ years exp

Booz Allen Hamilton is seeking a seasoned Endace Implementation and Sustainment Engineer to architect and operate Endace packet capture platforms. The role involves managing the entire lifecycle of Endace systems and integrating them with various security tools to ensure robust network visibility and security.

ConsultingCyber SecurityIT InfrastructureManagement ConsultingSecurity

Growth Opportunities

No H1B

Security Clearance Required

U.S. Citizen Only

Responsibilities

Architect, deploy, integrate, and operate Endace packet capture, monitoring, and network recording platforms across a large, distributed enterprise

Own the end-to-end lifecycle for Endace systems—including design, installation, configuration, maintenance, and long-term optimization

Integrate the platform with SIEM or SOAR, detection engineering, analytics tooling, and broader Zero Trust security controls

Lead the design, deployment, and configuration of Endace appliances for enterprise-scale packet capture

Develop packet capture strategies aligned to network architecture, mission requirements, and Zero Trust visibility controls

Build high-availability, scalable, and resilient Endace clusters across data centers and cloud-connected environments

Integrate Endace with analytics ecosystems

Maintain and tune Endace hardware and software for optimal performance, including upgrades, patching, sensor tuning, and storage lifecycle

Troubleshoot packet loss, timing drift, flow indexing issues, clock synchronization, and performance bottlenecks

Monitor device health, capacity, and telemetry fidelity to ensure consistent, forensically sound data capture

Manage PCAP retention strategies, indexing policies, and storage allocation across distributed deployments

Align Endace visibility architecture with Zero Trust telemetry requirements and continuous verification workflows

Ensure packet capture and telemetry support identity-aware network segmentation and policy enforcement

Support the development of traffic baselines, segmentation decisions, and enforcement models using Endace data

Automate deployment, configuration, and sustainment workflows using Ansible, Terraform, or scripting

Build dashboards, runbooks, playbooks, and investigation workflows for SOC, threat hunters, and IR teams

Partner with network engineering, cloud teams, and security operations to ensure full-spectrum telemetry coverage

Deliver training and guidance to operational teams on Endace platform usage and best practices

Qualification

Endace platform expertiseZero Trust ArchitectureNetwork forensicsPacket analyticsLinux administrationScriptingSIEM integrationPCAP workflowsDoD 8570.01-M CertificationAnalytical skillsCommunication skillsProblem-solving skills

Required

5+ years of experience in cybersecurity engineering, network security, or SOC tooling

Experience supporting regulated or high-security environments

Experience with Zero Trust Architecture, segmentation principles, identity-centric policy models, Linux administration, and scripting

Experience integrating Endace with SIEMs, SOAR tools, and investigation platforms

Knowledge of packet analysis, network forensics, deep packet inspection, and PCAP workflows

Knowledge of core network protocols

Active TS/SCI clearance; willingness to take a polygraph exam

Associate's degree and 5+ years of experience supporting IT projects and activities, Bachelor's degree and 3+ years of experience supporting IT projects and activities, or Master's degree and 1+ year of experience supporting IT projects and activities

DoD 8570.01-M Information Assurance Technician (IAT) Level II Certification, including Security+ CE, CCNA-Security, GSEC, SSCP, CySA+, GICSP, or CND Certification

Ability to obtain a DoD 8570.01-M Cybersecurity Service Provider - Infrastructure Support Certification, including CEH, CHFI, CFR, Cloud+, or CND certification within 30 days of start date