Location: India – Remote

Engagement: Independent Contractor

Duration: Approximately 10–14 weeks

Availability: Immediate or short notice

Working hours: India hours with regular overlap with the UK business day

About the engagement

We are seeking an experienced Cisco ISE and Identity Security Engineer for a remote enterprise project involving Cisco Secure Remote Access VPN, Microsoft Entra ID, Active Directory and certificate-based authentication.

The engineer will help move an existing Cisco ISE Remote Access VPN integration from a permissive/pass-through configuration to controlled identity- and group-based access enforcement.

Key responsibilities

Review the existing Cisco ISE and Remote Access VPN architecture.

Assess the existing ISE policy sets, authorization profiles and RADIUS authentication flow.

Integrate Cisco ISE with Microsoft Entra ID and/or Active Directory.

Configure Entra REST ID Store and Microsoft Graph-based group lookups where applicable.

Design and configure group-based VPN authorization policies.

Map approximately 5–10 Entra ID/AD groups to 3–5 VPN access profiles.

Configure Cisco ASA or FTD/FMC Remote Access VPN integration with ISE.

Review user and device certificate authentication, PKI trust chains, SAN/UPN mapping and certificate profiles.

Configure protection against Active Directory account lockouts caused by repeated authentication failures.

Develop HLD, LLD, authorization matrix, test plan and rollback procedure.

Perform functional, negative, failover and security testing.

Support a controlled pilot,



monitoring period and phased production rollout.

Troubleshoot authentication, authorization, RADIUS, certificate and group-mapping issues.

Produce as-built documentation, an operational runbook and knowledge-transfer material.

Work within formal enterprise change-control and security-approval processes.

Essential experience

Strong hands-on experience with Cisco Identity Services Engine.

Experience designing and implementing Cisco ISE policy sets, authentication rules, authorization profiles and identity source sequences.

Experience integrating Cisco ISE with Microsoft Active Directory.

Practical experience with Microsoft Entra ID, REST ID Store, Microsoft Graph API and application registrations.

Robust understanding of RADIUS authentication and accounting.

Experience with Cisco Secure Client/AnyConnect Remote Access VPN.

Hands-on experience with Cisco ASA and/or Cisco FTD managed through FMC.

Good understanding of EAP-TLS, certificate authentication, internal PKI, SCEP, SAN/UPN mapping, CRL and OCSP.

Experience troubleshooting ISE Live Logs, authentication failures, authorization results and Active Directory lockouts.

Understanding of Intune device registration and compliance integration with Cisco ISE.





Experience delivering controlled pilots, production cutovers and rollback plans.

Strong HLD, LLD and technical documentation skills.

Excellent spoken and written English.

Preferred qualifications

CCNP Security, CCIE Security or equivalent practical experience.

Cisco ISE specialist training or certification.

Microsoft identity or security certification.

Experience working with UK enterprise or critical national infrastructure customers.

Familiarity with ITIL change management and formal security-governance processes.

Important scope boundaries

This is a hands-on design and implementation role.

The work is primarily remote.

The Cisco ISE appliance migration itself is outside the scope of this engagement.

Wired/wireless 802.1X and TEAP implementation are outside the immediate scope.

Occasional out-of-hours support may be required for approved production cutovers and will be agreed separately.

Application requirements

Please apply with

Your updated CV.

Current location.

Notice period and earliest start date.

Expected daily contract rate in GBP or INR.

Cisco ISE versions you have worked with.

Brief details of a recent Cisco ISE, Entra ID/Active Directory or Remote Access VPN implementation.

Confirmation of availability to overlap with UK working hours.

Candidates must be able to demonstrate recent, hands-on implementation experience. Profiles limited to monitoring, service desk support or theoretical Cisco ISE knowledge will not be suitable.

📌 Cisco ISE and Identity Security Engineer (India)
🏢 ServQual - Security
📍 India