Senior Network & Security Engineer (20+ Years)

David Neal Gravatt

Houston, TX

Professional Summary:

• Senior Network Engineer with over 20 years of experience managing complex network infrastructures, specializing in network security across Wired, Wireless, Hybrid, and Cloud implementations. Skills/Experience

• Routing: Cisco IOS, NXOS, and IOSXE. ASR 1k and 9k. 7200s, 9500s, ONS/CPT. VRF, VDC, OTV, iBGP, eBGP, OSPF, RIP, and EIGRP. GLBP, VRRP, HSRP, DMVPN, MPLS, IPSec GRE, SD-WAN, Meraki MR/MX, Palo Alto OSPF

• Switching: Cisco NX-OS 3k, 5k, 7k, and 9k. Cisco IOS/IOS-XE 4500s, 6500s, 3700s, 2960s, 93/92/94/9500 mGig Switches, 93180, Cisco 9500 Fiber Channel, Cisco 1000v, FortiSwitch 200s, Dell Force10, Meraki Dashboard/APs/switches, QOS, SNMPv3, Syslog, 802.1q, RSTP, LACP, VSS, VPC, VDC, VXLAN, OTV. SSO/ISSU/HA in wired and wireless networks, Netflow, Syslog, SNMPv3, POE. MS SQL Server, ExpressRoute (Direct)

• Wireless: Cisco WCS, Prime, DNA/Cisco Catalyst Center, Cisco Spaces (Connector), Cisco WLC 4400, 5500, (migration to) 9800-40/80/L-F. SSO and N+1 HA, Mobility, HPE/Aruba, Cisco APs 1000s, 2600s, 4800, 9136, 9166, 9120, 9617 LWAPP, CAPWAPP, MESH/RAP/MAP, Cisco 1800s Sensors, Ekahau predictive surveys. AP on a Stick, Meraki dashboards, Juniper/HPE Mist, Fortinet 2211

• VoIP: Cisco Call Manager v6 - v9, Contact Center Express v6 – v9. IP-wired and wireless phones, QOS

• Security,/Other: AMP endpoints. Cisco Secure X, Talos Intel, Cisco ISE v1.4 to 3.2, 802.1x (NAC), Cisco ISEv3.x, ISE

(Profiling, TACACS+ and RADIUS, TrustSec, Posture Assessment, Juniper/HPE ClearPass, Cisco AnyConnect VPN, NAM, Umbrella. Stealthwatch/DNAC/ISE integration. Cisco SmartNet and Smart Licensing, F5 Big IP 5050 LTM, GTM/DNS HA, iRules, Microsoft AD and Infoblox for DHCP, DNS, FireEye IPS/IDS, AlienVault, SolarWinds NPM and NCM. Silverpeak, AWS, Azure (express route) GCP, Python, Terraform, Ansible config automation,, O365 for Enterprise and SMB, Cisco WAAF, ASDM 5500s, then 5500X, now Cisco FTD 4200 series w/AVC, IPS, AMP. Also managed, Palo Alto VMs PA-7050, 220, 3200 5500 series, Panorama M100, Malware/Threat/App ID detection, URL filtering, Global Protect. Fortigate 100, 60F. HP TippingPoint, Fortinet 200f, 148, Radware IPS, Cisco Viptella Professional Experience

WorldVue Inc., Houston, TX Feb 2026 - Present

Network Activations Engineer

• Acquired Meraki, Rukus, and HPE Aruba partner certifications over 3 weeks of training.

• Primary role is supporting on site technicians with installation of preconfigured (by my team) hardware for deployment at hotels.

• Most consist of Meraki MX routers, MS switches and Palo Alo firewalls and Meraki Switches

• Each Site would take a week, though we worked 5 sites a week at the same time. Test and turn-up network equipment are usually revealed in problems since these hotels were mostly upgrades or acquisitions of an existing hotel.

• Clients include nearly every hotel chain across Globe.

• Clients had different hardware in place Meraki, Aruba, Ruckus wireless equipment and Meraki core switching including MX, MS, route and switch. SD-WAN, L7 firewall, and SASE provided by Meraki MX platform also.

• Create RF Maps of each hotel in Ekahau. Populate with APs to ensure proper coverage. Netsync Networks, Houston, TX Mar 2023 – Nov 2025

Wireless Consultant

• Completed sales by providing Post sales Installation services as Lead Engineer and customer consultant for LAN and WLAN implementations.

• Architect a solution and present a detailed design document with solutions and recommendations for best practices. Lead the technical team to help with the physical installation followed by testing and result documentation, final design documents and recommendations for more secure network. Some customers also purchased a day of cross train

• Completed 3 projects replacing Cisco Catalyst APs with Meraki APs. Used either Cisco 9300 or Meraki MS POE + switches and Meraki MX router for L3, routing, firewall, and VPN tunnel.

• Replaced EOL Meraki/cisco Catalyst equipment with new Meraki MX, MS, and wireless. Used dashboard to migrate between customers multiple locations (school district) and place device in pre-configured groups so they would download the correct VLAN settings for the site.

• Used python scripting for automation, configuration of API tunnels, Meraki device configuration, KPI reports. For Aruba, automation of onboarding access points to dashboard, creating groups and associate shared configuration.

• Switch deployment projects included large campus, multisite, OT, and SMBs. Successfully deployed Cisco 9500 core switches and 9300/9200 access switches. Most IDF closets had 3 or 4 data/power stack configurations with L2 portchannels back to core WLAN projects included replacing, upgrading, or new installation of Cisco’s latest WLC 9800, Cisco DNAC (now Cisco Catalyst Center), Cisco ISE, and Cisco Spaces. Access Point models were the latest WIFI 6E or 7 including but not limited to the 9167, 9136, 9166.

• Several projects required updating from old AierOS to the Cisco 9800 running IOS and migrating older APs or replacing them. Cisco PRIME information was exported and imported to DNAC.

• Several Oil and Gas clients including Apache and Boardwalk Pipelines. Had to ensure access points used for communication on the OT side had no connectivity to enterprise.

• Assisted on several projects upgrading Aruba Mist. Provisioned new APs for dashboard. Integration with Aruba Clearpass

• Completed DNAC integrations with Cisco ISE for AAA. Created Guest login services through ISEv3.x policies and implemented mobility solution with a ‘guest’ WLC in the DMZ

• Worked with teams to upgrade Aruba APs to latest version available to address any vulnerabilities. APs were running versions 6, 7, 8 and were upgraded to v9 at the time as it was the latest version.

• Outdoor or industrial wireless projects included configuration and deployment of IE3300 switches, MESH networks converting APs to RAPS or MAPs. Multisite customers also required Flex connect APs to implement local switching.

• Some clients had complete Meraki Firewalls, switches and access points. A ‘rip and replace’ of all hardware was done. Dashboards were updated, switch and AP templates applied, and new features enabled. Most significant was introduction of WiFi 6e and making sure Wireless networks automatically tuned to the correct channels as the 2.4 Ghz frequency was still by used by a lot IOT gear.

• Achieved Ekahau Certification to conduct predictive wireless site assessments using site floor plans. Pre-installation wireless surveys determine where to place new Access Points or used ‘AP on a stick’ to calculate attenuation values or complete each project with RSSI and cochannel inference scan.

• Largest and most complex project took several weeks to plan and 3 months to install three 9800-80 WLCs for N+1 redundancy, and over 4000 APs at 67 locations.

Golden Nugget Casino, Lake Charles, LA Sep 2021 – Mar 2023 Network Engineer

• Successfully managed five casinos’ networks with one other network admin. Responsible for all network access, security and connectivity for employees, resort guests, IOT devices in guest room, Wi-Fi, casino games, slot machines connectivity, network segmentation and remote access.

• Coordinated and managed network projects. Tuned and upgraded network equipment for performance, threat and vulnerability mitigation and resilience through HA configurations. Used python scripting for inventory.

• Worked as the only network engineer at my casino. Discovered out of date documents and unsecure network configurations, and no templates for standards. Worked with other Casino network admin to standardize device configs and document run books, develop and maintain standards, policies and secure configs across all 5 casinos.

• The distribution and access layer consisting of gaming networks including physical devices and gaming servers in the onsite DC, thousands of cameras and hundreds Cisco stacked access switches providing POE, wireless access layer for resort guests, a separate wired and wireless network for corporate users, internal shared resources, network application servers, and highly segmented shared external network (extranet) for access for state gaming commission, business partners such as Ticket Master, and game developers. Core network included Nexus 5k and 2k FEXs.

• Separate Cisco ASA 5508x, 5520x, and 5545X HA installations replaced by Cisco FTD 4215 and 4245 and added to FMC console for log correlation using Cisco FTD Migration tool. Panorama was used to manage NGFW Palo Alto firewalls for Internet access and point to point IPSEC tunnels including connections to Azure and AWS

• Managed the 2fa system, Cisco DUO and Cisco CUCM solution. Collaborated with support and infrastructure teams to provide network security expertise.

• Audited firewalls using python rule surveys to look for deltas and identify change control to compliance for gaming commission.

• Produced KPI reports using python scripting. Produce number of devices and types of devices connected to the network. Verify policies and DACLs. Verify and update devices in the MAC address database for MAB.

• Implemented a network monitoring and alerting solution using SolarWinds NPM and PRTG. Other various applications for syslog, Netflow, and SNMPv3 polling including Infoblox for DHCP and DDI services. D e v e l o p e d alerting and response SLAs for department and provided KPI reports each month.

• Assist with design of network projects at corporate offices including Cisco Viptela SD-WAN solution and ISEv3. Each location (many restaurants as well, had backend MPLS and separate circuit internet access and some even had two, a second one for hotel guests. I assisted with the setup and for a short time I was there help with policy design.

• Corporate office was also responsible for Meraki wireless and MX devices at restaurant locations. I helped monitor and maintain this environment.

• VXLAN was in use at the casinos to provide vlans in different networks separated by L3 links. Similar concept is described below, where I managed an OTV setup between Camden’s 3 locations.

• Designed segmented network and installed networking hardware for DraftKings game room. Deployed a Zero Trust design and secure connectivity.

Macquarie Bank, Houston, TX Apr 2021 – Aug 2021

Network Engineer Contractor

• Relocation forced me to take on a short-term contract with less responsibility and a chance to work in yet another new industry.

• Hired to help complete delayed project migrating to new datacenter while at same time migration from a single context Cisco ASA to a multi-vsys Palo Alto firewall. Complex network with integration to financial systems around the world that connected the banks to the New York Stock Exchange, banking data teams working with clients and Customers.

• Primary goal was to access existing Cisco firewalls and routers and convert them to Palo Alto Virtual firewalls for new datacenter migration and hardware upgrade. Cutover to new DC requires coordination with many teams and ISPs.

• Followed strict change control procedures to maintain compliance with finical regulations from many countries. High stress environment to adhere to banking industry standards and complete projects on time. This left no room for errors and failing back was not an option.

• Was assigned to a team that consisted of three full-time Network Engineers to assist with completing data center migration/upgrade project. Project was nearly 2 years behind schedule due to COVID. NocServ, Houston, TX Nov 2017 – Feb 2022

Sr. Systems Engineer

• Worked part time with permission from my employer for my current employer. I only did this work after hours.

• Company was advertised as a ‘Helpdesk in the cloud.’

• Helped a colleague start his business by working nights doing installations and upgrades and when possible, accompany him as engineer on sales calls. Performed simple network closet clean ups.

• Helped coordinate technical panels and even invited my bosses to see if they want to participate. My friend also mentored students at University of Houston on starting new companies. One project We were chosen to replace legacy Cisco Systems or upgraded existing Fortinet hardware for client’s 10 locations.

• Documented existing site layout, IP Scheme and existing network hardware to help determine new equipment and upgrade path. Each site had a slightly different layout. Some needed hardware replaced (Netgear hubs to Fortiswitches) and new VLANs configured. All sites needed code upgrades.

• Worked with the Fortinet team to scope each site and a plan with cost defined was given to customer.

• All 10 sites were configured the same. Each site had a Fortigate 60F for security and AP mgmt. A Fortiswitch 148-POE was ordered for 5 of the sites to replace the POE hubs. Each site had up to 5 FortiAP 221E Access points.

• Worked with a remote team to provide hands on upgrading end-of-life software for Fortinet firewalls, switches and APs. In case there was an issue I would be on site as well as console access to log any issues.

• Created separate network for POS machines and user network, Guest wireless access, and secure internal Access.

• Implemented Clearpass solution for user network access control.

• Managed Office 365 for nonprofit ‘Sky High 4 Kids’ (child cancer research). Organization became the target of social engineering through phone and email. Configured SPAM filtering using SPF, DCIM and DMARC

• Provided one day of onsite training and then volunteered free monitor and advising Office365/Email issue for several years. Identified fraudulent accounts and stopped multiple Social Engineering attempts. Camden Property Trust, Houston, TX Aug 2015 – Mar 2021 Sr. Network Engineer

• Worked as the Senior Network Engineer responsible for network and tasks for two JR network admins and helped manage two telephony engineers.

• Together, the team supported Cisco routing, switching, WLAN, VoIP/SIP systems, and Network Security environment including Cisco AMP, Palo Alto and Cisco Firewall/IPS/IDS, and Cisco ISE with DNAC at the 4-story corporate office, 2 data centers, and 250 remote locations.

• Maintained network at 250 branch offices and 100 Office Extended APs.

• In place was a DMVPN solution with web filtering through the DC and using Cisco 2800 routers or connections. I developed, designed, and helped deploy replacement of old DMVPN solution for 250 sites, which included 5 reginal offices, with Palo Alto firewall running v7os. This was a year long project starting with the POC from a local branch office.

• The DMVPN network was replaced by a single Palo Alto 200 or 800 series firewall with Webfiltering, firewalling, and threat containment enabled connected back to primary and secondary DC over IPsec tunnels. Managed by Panorama. Each Data Center had a PA 5000 series FW to terminate tunnels and a separate HA setup where firewalls were put in Vwire mode to only provide IPS services.

• Several projects took place to upgrade Palo Altos to version 8 and then 9.

• Automated site deployment tasks using Ansible. Palo Alto routers and cisco switches were configured in a lab environment before being shipped to location.

• A project manager reviewed the project plan for correct formatting but provided no management of project. The SR engineer managed the project with JR engineer helping to configure and ship hardware to local techs.

• Playbook for vulnerability assessments: As vulnerabilities were published by Cisco, software versions verified. Updated firmware when needed.

• Provided KPI report each month by exporting data from SolarWinds NPM and achieved on average ‘four nines’ of uptime for all sites.

• Worked closely with ISPs to Implemented fully redundant connections to each DC and the corporate office using different ISPs and physical paths and 10 gig speeds (fast at the time). Used Google maps to determine fiber paths locations carefully planned alternate physical paths. 10 gig networks connected data centers in North Houston and Bryan, TX to corporate offices. All three locations used OTV on Cisco Nexus 7ks to allow VLANs to be stretched across Layer 3 WAN connections.

• The Corporate office used only Palo Alto firewalls for all network edge functions replacing EOL Cisco ASAs. Cisco Stealthwatch was used for Netflow visibility and using RestAPIs integrated DNAC with ISE and Stealthwatch so the three systems could detect malicious traffic and then shut down the offending computers access. I also configured TrustSec on DNAC, which was enforced by ISE and pushed to the switches.

• Due to experience and audit requirements from previous job, the same Vulnerability management was done not only to IOS code, but firewalls, IPS, and internet facing servers. Cisco allows you to subscribe to email alerts (check for other known bugs on your IOS version and even upload your configuration to see if you had created an issue and even SMS alerts for critical. Each morning, I review the bug and vulnerabilities released by Cisco at 4am and address those individually. For example, an Internet-facing router that has a DHCP vulnerability would not affect us. If it was a BGP vulnerability that allowed a user to gain admin access, then this would be an emergency change that would be done that evening on all Internet facing router. Same concept applies to internal routers that may reset if running SSH V2. Every 6 months we used SolarWinds to run config change reports and any changes had to be associated with change control. Emergency change controls were approved by manager.

• Coordinated weekly team meetings, responsibility matrix for team functions, and served on the security council representing network and network security issues.

• Successfully designed an enterprise project to replace all forty of the recently EOL 3750x access layer switches. Old IOS switches to the newer 9300 and 9200 48 port switches. Each of the corporate office had power and data stacks of 4 or 5 switches with 9300 IOS-XE switches and integrated with Cisco DNAC and ISE 2.6. I was able to budget, test, deploy in phases, and work with a 3r.Managed three Virtual Machines that hosted Cisco ISE and SolarWinds app and DB.

• Required to collaborate with SOC/CISO, infrastructure team for cross-team knowledge sharing of network security to ensure end-to-end security. Troubleshoot complex network and security issues across hybrid environments.

• Maintained and upgraded Cisco ISE (v1.4 to 2.6 to 3.4) environment, which provided AAA services to all network hardware. 802.1x was enabled on all network access layer switches and wireless networks for a total of 3500 end users. Posture assessment was done to determine what devices could access the network. Implemented 2FA using AnyConnect was a supplicant with internal PKI infrastructure’ for end users 2 factor.Maintained two production data centers with HA Cisco 5545x L3 firewalls and 5525x ASAs for remote access and Palo Alto Firewalls. A Nexus 7k core provided connectivity to physical servers and large VM environment. OTV and multi VDC on Nexus switches.

• Managed two pairs of F5 BigIP 5050 load balancers. Extensive experience managing the LTM module and GTM/DNS module for server selection and DNS services. External DNS was provided by AWS Route53. Attended F5 training in NYC. Used F5 for SSL offloading and as server LTM was utilized while servers were migrated to Azure, F5 was responsible for server access. Configured iRules to query production servers and applications.

• Assisted Helpdesk in supporting customer Meraki network. Through dashboard access I would monitor, review logs, MAC moves/adds/changes, and help with WiFi settings. Houston METRO, Houston, TX Feb 2010 – Aug 2015

IT Network Manager

• Managed the network team consisting of six employees responsible for entire organization’s infrastructure communication equipment (excluding most applications) and multimillion dollar budget for capital and operating expenses, as well as training, vendor selection and vendor services.

• Vulnerability management and patching of Cisco IOS upgrades.

• Each morning, I review the bug and vulnerabilities (Cisco called them Advisories released by Cisco at 4am and address those individually.

• As a government entity, funded by the city, we were audited to make sure this was done each year. I had to ensure network was compliant.

• Was still the most senior network engineer even though I helped to hire 6 new employees

• Led new rail expansion which included 18 new rail communication closets and 4 new office buildings. Led all network design and product selection. This included circuit providers and wired and wireless hardware for access layer and rail platforms and connectivity to Light Rail Vehicles. Light Rail line was an OT network. SCADA system with PLUs that tracked the train location. Segmented by air gapping network. Managed by a different network team.

• Designed, configured, and completed Palo Alto firewall installation to segment all server networks from core network, remote locations, access layer consisting of end users, systems, IoT at corporate office and data center.

• Managed vendor relationships to help implement new technology and run POCs. Developed SOW for new projects to assist purchasing and procurement with vendor selection.

• Worked with server team to perform firewall and security audit reviews throughout each year.

• Assisted in the development of plan for a physical security assessment of the company that included social engineering and spear phishing attacks to help identify vulnerabilities.Selected to ‘Future Leaders’ mgmt. program along with 19 other employees, over 1000 applied.

• Delegated tasks, revising all project plans and provided hands-on training to other engineersExperience managing Microsoft Exchange and a PKI Sever was used for authentication. Houston METRO, Houston, TX Feb 2008 – Feb 2010

Sr. Communications Systems Analyst

• One of two lead engineers for Company 15-story corporate office building, 30 ‘Park and Ride’ sites, 10 light rail stations, seven branch offices with large bus maintenance locations.

• Network consisted of 178 switches, 131 routers, 652 access points controlled by 36 wireless controllers, 75 security devices including 58 firewalls, NAC servers, IPS/IDS systems, Palo Alto 7050 and 5050 firewalls, 34 Cisco CPT router chassis,

• Managed company AV, McAfee EPO with over 2000 monitored endpoints agents

• Developed and deployed all security features including firewall rules for North/South and East/West traffic, network segmentation for guest and server network.

• Developed network and desktop hardening procedures to ensure a safe computing environment.

• Worked extensively on Windows DCs to manage DNS, DHCP, and Active Directory with integration into Cisco RADIUS authentication tools. Deployed Cisco’s NAC solution, called Cisco Clean Access to try and achieve network segmentation. Eventually Cisco product was rebranded as ISE.

• Managed Data Center hardware including Nexus 7k, 5k, 3k and 2k and VSS on 6509 switches. Primary DC was server room at corporate office. DC1 was offsite and DC2 was located at Houston TranStar

• Consolidated years of documentation for entire network including Visio diagrams for logical network flows, physical network connections, and rack elevations.

• Maintained or configured all ISP connectivity to the Internet and point-to-point WAN circuits to Data Centers, branch offices, and technical partners such as COH and HCTRA

• I worked with management to set criteria for circuit providers such as path diversity as all telecom serves were bid out every 3 years per government requirements.

• Configured a multi-ISP solution using conditional routing with BGP and several Cisco Routers and BGP attributes before SD-WAN routers existed

FNC Inc. Oxford, MS May 2001 – Feb 2008

Network Engineer

• Worked at helpdesk part time during college. Supporting around 300 end users. Provisioned new hardware, fixed computers, printers, any technical issues.

• As soon as I graduated, to keep me there I was offered full-time job as System Engineer. I passed an MCP Exam for Microsoft Server 2000

• Later that year the network engineer at the company quit, they gave me two months to get the CCNA and would then replace him

• Small company with 250 employees across 3 offices with 2 data centers in Los Angeles.

• Managed the firewalls,routers and switches at the 3 locations. Often traveling to LA to do work at the two Data Centers

• Learned most everything on the job while studying for the CCNP and in 2008 I passed the exams for the CCNP and moved to Houston to grow my career

Education

• University of Mississippi -BS in telecommunications Engineering May 2003, Engineering Student Body VP, Honor Council President, Received the Bervard Engineering and John Waddell Scholarship. Certifications

Certification Name Abbreviation Type Expire

CCNP Security CCNP-S General Certification In progress Cisco Certified Specialist - ISE CCS-SIMI Specialist Certification 3/22/2028 Cisco Certified Specialist - Enterprise Design CCS-ED Specialist Certification 3/22/2028 CCNP Enterprise CCNP-Enter General Certification 3/22/2028 Cisco Certified Specialist - Enterprise Core CCS-ECORE Specialist Certification 3/22/2028 CCNA CCNA General Certification 3/22/2028

Certified Wireless Network Associate CWNA Wireless Fundamentals In progress Ekahau Certified Survey Engineer ECSE Wireless Planning 2/15/2028 Jamf Certified Associate - Jamf Pro JAMF Apple IOS MDM 7/30/2026 https://www.credly.com/users/neal-gravatt/badges/credly

Contact this candidate