Lead Network Engineer

Contract work on an OT infrastructure separation. Two OT sites are being carved out of their parent company in an M&A transaction, and the OT control environment has to run on the acquirer's own services from cutover. You work in a small team under the lead firm on the program.

The role

Own the network workstream end to end

design it and build it. Find out what is on the network at both sites, decide what has to cross the IT/OT boundary at cutover, build the changes, and run the network cutover on site. The work centers on L3.5 (the IT/OT DMZ) and the in-scope L3 network.

What you will do

• Lead a three-week remote assessment of both sites and turn the seller's incomplete drawings into a current-state network picture

Map the connectivity at each site

every flow that crosses the IT/OT boundary, with ports, protocols, zones and conduits, as the basis for the acquirer's firewall cutover

• Design the L3.5 DMZ and the L3 network changes needed at cutover, and keep the network rows of the disposition register: what transfers, what is bridged, what is replaced
• Stage the network devices and any virtual stand-ins, and take over the existing site switches with credentials, config backups, and AAA, syslog and SNMP re-pointed to the acquirer
• Stand up DHCP relay, device AAA and the time source at L3
• Agree the monitoring sensor points with the OT Cybersecurity Engineer
• Write the network section of the cutover runbook, run isolation tests and test plans, execute the network cutover steps on site, and make the network rollback recommendation
• Support hypercare, keep diagrams, IP plans and configs current in the team repository, and report network progress, risks and open questions to the lead firm

What you bring

• 10+ years in enterprise network engineering, with lead or design responsibility and recent hands-on configuration work
• IT/OT segmentation using the Purdue model and ISA/IEC 62443 zones and conduits
• DMZ design under a restrictive protocol policy, using relays, proxies and per-flow rules
• Cisco routing and switching at CCNP level or equivalent, including VLANs, OSPF and BGP
• TACACS+ or RADIUS, DHCP relay and NTP
• Led and executed at least one live cutover to a fixed date with a written rollback plan
• Comfortable presenting a design to a client security team and working from a runbook in a change window

Nice to have

• Divestiture, carve-out or merger separation experience
• Check Point and Palo Alto firewall policy
• OT network monitoring sensor placement (Nozomi, Dragos or Forescout)
• Cisco Catalyst 9800 wireless controllers and access-point re-adoption
• Catalyst 8000V or 9800-CL virtual appliances
• Scripting for config generation (Python, Ansible)
• CCIE, GICSP, PCNSE or CCSE