Sr Staff Engineer, Network and Segmentation- Onsite

ABOUT THE ROLE

The network is where a contained incident becomes a plant wide one. You own the resilience and containment design of the connectivity layer: factory networks, operational technology and IT separation, and site and carrier diversity.

You will work at the intersection of manufacturing IT, information security and network engineering, and you will hold the deciding engineering view on network containment within your domain. Where a proposed factory network change breaches the segmentation standard, you raise it in design review and block it there, with your director holding the escalation.

Some segmentation work has already been delivered at our first manufacturing site. Part of this role is reviewing and hardening what exists, then setting the reference pattern for everything that follows.

WHAT YOU WILL DO
Architect segmentation. The operational technology and IT boundary, and the intra factory segmentation model, designed so that a compromise or failure is contained by architecture rather than by response time.
Engineer connectivity diversity. Carrier, path and site diversity for factory and data centre connectivity, including emergency access when both production sites are degraded.
Design the dual data centre fabric. The network topology that enables site failover: latency budgets, stretched layer decisions, and routing convergence under failure.
Harden what exists. Review and harden segmentation already delivered at the first manufacturing site, and establish the reference pattern for subsequent phases.
Prove containment. Segmentation efficacy testing and failover validation, evidenced rather than asserted.
Hold the standard in design review. Raise and block any factory network change that breaches the segmentation standard, through the design review forum.
Direct without managing. Set and enforce the network resilience requirements the managed service provider is measured against, and provide technical direction to network engineers globally.

REQUIRED QUALIFICATIONS
We are looking for the right capability rather than a specific number of years. The experience indication below is typical, not a filter; an engineer who has genuinely done this work in less time will be considered.
Typically ten or more years in enterprise networking, with deep routing, switching and network security design.
Demonstrated design and delivery of production network segmentation at scale, including the operational negotiation that goes with it.
Data centre fabric and multi site failover design, with evidenced convergence behaviour under real failure.
Working fluency in operational technology and industrial network constraints, or a proven ability to earn the trust of the people who own them.
You can hold and win a technical argument with information security, and be right.

PREFERRED QUALIFICATIONS
Semiconductor fabrication or continuous process manufacturing network experience.
Purdue model or an equivalent operational technology segmentation framework, in production.
Experience setting technical requirements that govern a large managed service provider.

LEVEL EXPECTATIONS
Works across teams on ambiguous problems that have no established playbook.
Establishes standards adopted across engineering and security organisations.
Influence extends well beyond the immediate team.