Lead Network Engineer (IT/OT Segmentation / Cutover)
Job Description
The OperAxis team is hiring a Lead Network Engineer for a remote U.S. contract supporting an OT infrastructure separation. You will own the network workstream end to end: assess both sites, design the IT/OT boundary changes, build them and run the network cutover. Candidates must be U.S. citizens and available to start Monday, November 9, 2026. What you'll do: - Lead a remote assessment of both sites and turn incomplete drawings into a current-state network picture - Map every flow that crosses the IT/OT boundary, including ports, protocols, zones and conduits - Design the L3.5 DMZ and L3 network changes needed at cutover, and keep the disposition register current - Stage network devices, take over existing site switches, and re-point AAA, syslog and SNMP - Stand up DHCP relay, device AAA and the time source at L3 - Agree monitoring sensor points with the OT cybersecurity engineer - Write the network section of the cutover runbook, run isolation tests, execute cutover steps and recommend rollback - Support hypercare, keep diagrams, IP plans and configs current, and report progress and risks Requirements: - U.S. citizenship and availability to start Monday, November 9, 2026 - 10+ years in enterprise network engineering, with lead or design responsibility and recent hands-on configuration work - At least two years of lead experience - Led and executed at least one live cutover to a fixed date with a written rollback plan - Cisco routing and switching at CCNP level or equivalent, including VLANs, OSPF and BGP - DMZ design under a restrictive protocol policy, using relays, proxies and per-flow rules - IT/OT segmentation using the Purdue model and ISA/IEC 62443 zones and conduits - TACACS+ or RADIUS, DHCP relay and NTP - Strong communication, including presenting a design to a security team and working from a runbook in a change window - One of CCIE, GICSP, PCNSE or CCSE Preferred: - Check Point and Palo Alto firewall policy - OT network monitoring sensor placement (Nozomi, Dragos or Forescout) - Cisco Catalyst 9800 wireless controllers and access-point re-adoption - Catalyst 8000V or 9800-CL virtual appliances - Scripting for config generation (Python, Ansible) - Divestiture, carve-out or merger separation experience