Role overview

The Network Access Control (NAC) Engineer designs, deploys and operates certificate-based 802.1X authentication across wired and wireless networks, using Aruba ClearPass as the policy manager and the organization’s existing PKI.

This role turns NAC architecture into working, supportable service: EAP-TLS authentication, role-based enforcement, endpoint onboarding and integration with network infrastructure. It covers enterprise IT and, where applicable, segmented OT environments.

Job title Network Access Control Engineer (802.1X / ClearPass)

Key responsibilities

802.1X and EAP-TLS deployment

* Design and implement EAP-TLS authentication for wired and wireless networks, covering

machine and user authentication.

* Define and deploy supplicant configuration through Group Policy, Intune or MDM. This includes server validation, trusted roots and authentication mode.

* Plan phased rollouts: monitor mode, low-impact mode, then closed mode. Fallback for non- 802.1X devices uses MAC Authentication Bypass (MAB) with profiling.

ClearPass policy management

* Build and maintain ClearPass services, authentication methods and sources (Active Directory, LDAP), role mappings, and enforcement policies and profiles.

* Configure enforcement outcomes: dynamic VLAN assignment, downloadable roles and ACLs, and RADIUS Change of Authorization (CoA).

* Manage ClearPass certificates, Trust Lists, clustering, node roles, backups and upgrades.

* Use Access Tracker, logs and reporting to tune policy and resolve authentication failures.

Profiling, MAC authentication and strict enforcement

* Configure ClearPass device profiling, including DHCP fingerprinting, HTTP User-Agent,

SNMP/ARP table reads, SPAN/IF-MAP feeds and active scanning (Nmap, WMI, SSH). The goal is to classify every endpoint by category, OS family and device name.

* Design and deploy MAC Authentication Bypass (MAB) for non-802.1X devices such as printers, phones, cameras, IoT and OT assets. Authorisation must be tied to profiled attributes and endpoint repository status, never MAC address alone.

* Build and maintain the MAB exception process: static host lists, endpoint attribute tagging, approval workflow and periodic recertification.

* Plan and execute the move from monitor mode to strict (closed-mode) enforcement. This





means default-deny on unknown or unauthorised devices, quarantine and remediation VLANs, and CoA-triggered re-authentication on profile change.

* Detect and respond to MAC spoofing and profile conflicts, for example a printer MAC presenting a Windows fingerprint.

Policy creation

* Translate security requirements and segmentation design into ClearPass policy: service rules, role mapping, enforcement policies and profiles.

* Build layered policy conditions using certificate attributes, AD group membership, endpoint profile, posture, location (NAD group), time and connection type.

* Define standard enforcement outcomes per device class, such as VLAN, Aruba user role, Cisco dACL or SGT. Each must have documented least-privilege access.

* Version, test and peer-review policy changes in a non-production environment. Use Policy

Simulation and Access Tracker evidence before promotion.

* Maintain a policy catalogue that maps each device class to its authentication method,

enforcement outcome and owner.

PKI integration

* Integrate ClearPass with the existing CA hierarchy (e.g. AD CS): trust chains, RADIUS/EAP server certificates, and certificate templates with correct EKUs.

* Configure and validate revocation checking through OCSP and CRL. Support certificate

enrolment and renewal processes such as auto-enrolment and SCEP.

Network infrastructure integration

* Configure switches and wireless controllers for 802.1X, RADIUS, accounting and CoA. Platforms include Aruba CX, Aruba wireless and Cisco Catalyst.

* Work with network teams on port templates, VLAN design and change windows.

Operations, documentation and assurance

* Produce high- and low-level designs, build guides, test plans and operational runbooks.

* Provide third-line support and root-cause analysis for authentication and authorisation issues.

* Align NAC controls with segmentation and zero-trust objectives, and with relevant standards

(ISO 27001,



NCSC CAF, IEC 62443 where OT is in scope).

* Hand over to operations teams and support knowledge transfer.

Essential skills and experience

* 4+ years in network security engineering, with at least 2 years delivering 802.1X/NAC in

production.

* Hands-on Aruba ClearPass Policy Manager experience: services, enforcement, role mapping, AD integration and troubleshooting with Access Tracker.

* Strong understanding of EAP-TLS, plus working knowledge of PEAP, EAP-TTLS, RADIUS

(attributes, VSAs, CoA) and EAPOL.

* Practical PKI knowledge: certificate chains, templates, EKUs, SANs, OCSP and CRL, and AD CS operations.

* Windows supplicant configuration through GPO and/or Intune, and familiarity with macOS and mobile onboarding.

* Switch and wireless configuration for 802.1X on Aruba and/or Cisco platforms.

* Solid grounding in VLANs, routing, firewalls and network segmentation.

* Ability to produce explicit designs, test plans and runbooks for technical and non-technical

audiences.

* Proven delivery of ClearPass profiling, MAB and policy design, including a production move to strict (closed mode) enforcement.

Desirable skills and certifications

* Aruba certifications such as ACCP (ClearPass Professional) or ACCX, or Cisco ISE experience (CCNP Security).

* ClearPass Onboard, OnGuard (posture), Guest and device profiling.

* Experience extending NAC into OT/industrial environments, including MAB-heavy estates and IEC 62443 zones and conduits.

* MDM and EMM integration with ClearPass (Intune, Jamf), and SCEP or NDES certificate

distribution.

* Automation of ClearPass or network configuration through REST APIs, Python or Ansible.

* SIEM integration (syslog, Splunk, Sentinel) for authentication monitoring.

* Security certifications such as CISSP, CompTIA Security+ or the GIAC equivalents.

Behaviours

* Methodical troubleshooter who works from logs and evidence, not assumptions.

* Communication changes impact clearly to network, desktop and operations teams.

* Balances security with operational continuity, especially on production and OT sites.

* Documents as they build and hands over cleanly.

Pay: ₹800,000.00 - ₹1,200,000.00 per year

Work Location: Hybrid remote in Pune, Maharashtra

📌 Network Access Control (NAC) Engineer (Pune)
🏢 Sudshi IT
📍 Pune