Senior Security Consultant (Cisco ISE/Ansible/AWS)

Position Summary

Platform Automation Engineer responsible for automating the configuration, deployment, and validation of Cisco ISE across Gruve's multi-tenant ISE-as-a-Service (ISEaaS) platform, with 5+ years of experience in infrastructure automation. Owns the Ansible codebase, dynamic inventory, CI/CD pipelines, secrets management, and the automated validation suite that gates every customer onboarding. This role sits at the intersection of automation and network security: the successful candidate will develop working Cisco ISE knowledge as a secondary skill in order to automate the platform meaningfully rather than generically. Working knowledge of AWS and Terraform.

Key Responsibilities

• Build and maintain dynamic inventory integration with AWS (amazon.aws.aws_ec2 plugin) driven by resource tags.
• Automate Cisco ISE configuration through ERS / OpenAPI interfaces and CLI where API coverage is incomplete.
• Automate ISE node bootstrap, deployment formation, persona assignment, certificate operations, logging targets, SNMP configuration, and backup scheduling.
• Design and maintain CI/CD pipelines covering linting, validation, plan/approval gates, automated apply, and post-change verification.
• Build and own the automated validation suite used as the onboarding acceptance gate, including health checks, replication status, and test authentication.
• Implement secure secrets management using AWS Secrets Manager, HashiCorp Vault, or ansible-vault; ensure no credentials are stored in code or state.
• Collaborate with the Cloud Architect to ensure Terraform outputs integrate cleanly into Ansible inventory and configuration workflows.
• Apply automation-first practices to reduce manual effort in patching, upgrades, onboarding, and recurring operational tasks.
• Contribute to Terraform module development as a secondary responsibility where infrastructure and configuration overlap.
• Automate creation of Network Device Groups and Network Devices (NADs) with RADIUS/TACACS+ shared secrets.
• Explicitly own pxGrid automation (certificates, clients, and subscriptions) as a distinct task, not just folded into general certificate operations.
• Support creation and validation of the ISE repository used for backup and certificate artifacts.
• Run and document a joint Terraform-apply + Ansible-idempotency validation with the AWS Cloud Architect before promoting a tenant to production.

Basic Qualifications

• 5+ years of experience in infrastructure automation, DevOps, or configuration management roles.
• Strong hands-on Ansible experience with production-grade roles and playbooks that the candidate has personally authored.
• Practical experience automating network or security appliances via REST API, not solely server operating systems.
• Experience designing and operating CI/CD pipelines for infrastructure or configuration changes.
• Working knowledge of AWS services and terraform sufficient to collaborate on infrastructure provisioning.
• Programming or scripting proficiency in Python (preferred) or equivalent.
• Exposure to Cisco ISE, NAC, RADIUS, or 802.1X, or demonstrated ability and willingness to build that knowledge quickly.
• Experience with secrets management and secure automation practices.
• Red Hat Certified Specialist in Ansible Automation or equivalent certification is an advantage.
• Strong documentation and collaboration skills across cloud, network, and security teams.

Preferred Qualifications

• Automation & Configuration: Ansible (roles, playbooks, collections, dynamic inventory, ansible-vault), idempotent design, Jinja2 templating.
• CI/CD & Version Control: Git, GitHub Actions / GitLab CI / Jenkins, pipeline design, approval gates, OIDC federation for cloud credentials.
• Cloud & IaC: AWS (EC2, IAM, Secrets Manager, SSM, S3, tagging), Terraform (working knowledge), cross-account role assumption.
• Scripting & APIs: Python, Bash, REST API integration, JSON/YAML, API authentication and error handling.
• Secrets & Security: AWS Secrets Manager, HashiCorp Vault, ansible-vault, least-privilege automation identities, secure credential handling.
• Testing & Validation: Automated smoke testing, health validation, pytest or equivalent, ansible-lint, molecule (desirable).
• Familiar with Technologies: Cisco ISE (ERS / OpenAPI), RADIUS, 802.1X, certificates and PKI, syslog, SNMPv3.