Lead Network Engineer/Architect (100% Remote)
Must Have:
- Must be able to start 11/9/2026
- 10+ years in enterprise network engineering, with lead or design responsibility and recent hands-on configuration work
- 2+yer Lead exp
- Exp Leading and executing at least one live cutover to a fixed date with a written rollback plan
- CCIE, GICSP, PCNSE or CCSE
- DMZ design under a restrictive protocol policy, using relays, proxies and per-flow rules
- Cisco routing and sw· Check Point and Palo Alto firewall policy
- OT network monitoring sensor placement (Nozomi, Dragos or Forescout)
- Cisco routing and switching at CCNP level or equivalent, including VLANs, OSPF and BGP
- Must have strong communication
Contract work on an OT infrastructure separation. Two OT sites are being carved out of their parent company in an M&A transaction, and the OT control environment has to run on the acquirer's own services from cutover. You work in a small team under the lead firm on the program. The role Own the network workstream end to end: design it and build it. Find out what is on the network at both sites, decide what has to cross the IT/OT boundary at cutover, build the changes, and run the network cutover on site. The work centers on L3.5 (the IT/OT DMZ) and the in-scope L3 network. What you will do · Lead a three-week remote assessment of both sites and turn the seller's incomplete drawings into a current-state network picture · Map the connectivity at each site: every flow that crosses the IT/OT boundary, with ports, protocols, zones and conduits, as the basis for the acquirer's firewall cutover · Design the L3.5 DMZ and the L3 network changes needed at cutover, and keep the network rows of the disposition register: what transfers, what is bridged, what is replaced · Stage the network devices and any virtual stand-ins, and take over the existing site switches with credentials, config backups, and AAA, syslog and SNMP re-pointed to the acquirer · Stand up DHCP relay, device AAA and the time source at L3 · Agree the monitoring sensor points with the OT Cybersecurity Engineer · Write the network section of the cutover runbook, run isolation tests and test plans, execute the network cutover steps on site, and make the network rollback recommendation · Support hypercare, keep diagrams, IP plans and configs current in the team repository, and report network progress, risks and open questions to the lead firm What you bring · 10+ years in enterprise network engineering, with lead or design responsibility and recent hands-on configuration work · IT/OT segmentation using the Purdue model and ISA/IEC 62443 zones and conduits · DMZ design under a restrictive protocol policy, using relays, proxies and per-flow rules · Cisco routing and switching at CCNP level or equivalent, including VLANs, OSPF and BGP · TACACS+ or RADIUS, DHCP relay and NTP · Led and executed at least one live cutover to a fixed date with a written rollback plan · Comfortable presenting a design to a client security team and working from a runbook in a change window Nice to have · Divestiture, carve-out or merger separation experience · Check Point and Palo Alto firewall policy · OT network monitoring sensor placement (Nozomi, Dragos or Forescout) · Cisco Catalyst 9800 wireless controllers and access-point re-adoption · Catalyst 8000V or 9800-CL virtual appliances · Scripting for config generation (Python, Ansible) · CCIE, GICSP, PCNSE or CCSE