Network Engineer (Westport)

Travel: Approximately 20–25%, to US sites and to facilities in Mexico and Colombia

About CSC Sugar

CSC Sugar, together with its Sugaright business, is a sugar refining and commodity trading company headquartered in Westport, Connecticut. We run refining, liquid sugar and distribution operations across more than ten sites in the United States, Mexico and Colombia, and our IT team of four supports more than 300 users across all of them. The network is what keeps plants shipping, traders trading and customers receiving orders, so this role matters to the business every day.

The Role

We are looking for a Network Engineer to own the company network end to end. This is a hands-on role with real authority: you will design, build, secure, document and support our firewalls, switching, wireless, WAN and cloud networking, and you will be the person the team and the business rely on when something breaks.

Our security edge runs on Cisco Firepower Threat Defense (FTD), managed through Firepower Management Center (FMC), and we are completing a migration off legacy Cisco ASA firewalls. Our server workloads run in AWS, and our identity platform is Microsoft Entra ID. Deep, current experience with FMC/FTD and AWS networking is required.

Network Ownership and Accountability

This role owns the CSC Sugar network: all of it, at every site and in AWS. If a firewall, switch, circuit, tunnel or cloud connection goes down, you are accountable for getting it back and for making sure it does not happen again.

· On call 24/7. Serve as the primary escalation point for all network outages and degradations across every site and AWS. You must be reachable and able to respond remotely at any time, including nights, weekends and holidays.

· End-to-end ownership. Take incidents from detection through resolution, carrier and vendor escalation, user communication and a written root-cause analysis, without needing to be directed.

· Remote readiness. Keep monitoring, alerting, documentation and out-of-band access in a state where you can diagnose any site remotely.

· Planned coverage. Arrange and hand off coverage in advance of planned time off, so the network is never without an owner.

What You Will Own

Firewall and Network Security (Cisco FMC/FTD)

· Administer Cisco FTD appliances at all sites through FMC, including access control, NAT, prefilter, intrusion and file policies, platform settings and device health.

· Build and maintain route-based and policy-based site-to-site VPNs between headquarters, plants, distribution sites and AWS.

· Stand up new and refreshed site firewalls from a documented standard build, not a cloned config, covering WAN interfaces, DHCP, routing, VPN and policy.

· Plan and run FMC policy deployments with change control, pre-checks and a rollback plan.

· Support the rollout and operation of Cisco Secure Access (SSE) as the replacement for Cisco Umbrella, including DNS security, secure internet access and remote access.

Legacy ASA and Hardware Refresh

· Maintain the remaining Cisco ASA firewalls until they are retired, including ACLs, NAT, AnyConnect/Secure Client and site-to-site tunnels.

· Lead ASA-to-FTD migrations site by site, including config translation, cutover planning, testing and post-cutover validation.

· Own the refresh roadmap for end-of-life firewalls and switches, including sizing, bill of materials, scheduling and on-site installs.

Switching, Routing and WAN

· Design and support Cisco enterprise switching at every site: VLANs, trunking, spanning tree, port security, PoE and access-layer standards.

· Manage WAN and internet circuits across multiple carriers, including primary and backup failover, BGP and static routing, and carrier escalation.

· Support plant-floor and OT network segments in coordination with site operations.

· Maintain IP addressing, DHCP and DNS standards across the enterprise.

AWS Cloud Networking

· Design and operate AWS networking: VPCs, subnets, route tables, security groups, NACLs, Transit Gateway, VPN connections and gateways.

· Own connectivity between on-premises sites and AWS, including tunnel design, routing, redundancy and troubleshooting.

· Work with the systems team on network access for EC2 workloads, AWS Systems Manager and services that span on-premises and AWS, and review cloud network changes for security.

· Monitor and tune AWS network cost, performance and logging (VPC Flow Logs, CloudWatch).

Wireless (Cisco WLC and Ekahau)

· Own the wireless network at every site, including offices, plants, warehouses and loading areas, managed through Cisco wireless LAN controllers.

· Manage the AP lifecycle: join and provisioning, AP groups and tags, firmware upgrades, replacements and end-of-life planning.

· Configure and maintain WLANs, SSIDs, RF profiles, channel and power plans, roaming, QoS, guest access and secure authentication (WPA2/WPA3-Enterprise, 802.1X with RADIUS).

· Use Ekahau (AI Pro and Sidekick) for predictive designs, pre- and post-install validation surveys and troubleshooting surveys, and keep heatmaps and AP placement maps current for every site.

· Find and fix coverage gaps, interference and capacity problems, especially in plants and warehouses with metal, steel racking and handheld scanners.

· Drive wireless improvements site by site, including redesigns, AP upgrades to current standards (Wi-Fi 6/6E and newer) and better coverage where operations depend on it.

Operations, Monitoring and Resilience

· Own network monitoring and alerting so that we find problems before users report them.

· Run the scheduled after-hours maintenance window for network changes and upgrades.

· Improve network resilience over time through redundancy, failover testing and removal of single points of failure.

Documentation and Standards

· Keep a complete, current record for every site in the IT SharePoint repository: topology diagram, device inventory, configuration backups and IP addressing.

· Write and maintain runbooks and standard builds so that other team members can support the network without escalation.

· Document every change through the team's change and ticketing process.

Projects and Collaboration

· Act as network lead on company IT projects, including ERP and trading system rollouts, new site openings and security initiatives.

· Work with vendors, carriers and Cisco partners, and hold them to scope and timelines.

· Coach help desk and systems staff on network troubleshooting.

What You Bring

Required

· 7+ years of hands-on enterprise network engineering experience.

· Strong, recent production experience with Cisco FMC and FTD, including policy design, VPN, NAT, routing, upgrades and troubleshooting from both the CLI and the FMC console.

· Solid working knowledge of Cisco ASA, including a completed ASA-to-FTD migration.

· Proven experience designing and supporting AWS networking: VPCs, Transit Gateway, site-to-site VPN, security groups and on-premises-to-AWS connectivity.

· Strong Cisco switching and routing skills: VLANs, STP, OSPF, BGP, static routing and WAN failover.

· Experience designing and troubleshooting IPsec VPNs across multiple vendors and carriers.

· A track record of producing clear network documentation and maintaining it.

· Ability to own outcomes with limited supervision and to communicate clearly with both technical staff and business leaders.

· Willingness to serve as the primary on-call escalation point, work scheduled after-hours maintenance and travel to US and international sites.

Preferred

· Experience with Cisco WLC and Ekahau wireless design/survey.

· Experience with Cisco Secure Access, Cisco Umbrella or another SSE/SASE platform.

· Familiarity with Microsoft Entra ID and Azure networking, including SAML/SSO integrations with network devices.

· Experience with network monitoring platforms (for example Entuity, SolarWinds, PRTG or LogicMonitor).

· Experience supporting manufacturing, plant-floor or OT networks.

· Experience with scripting or automation for network tasks (Python, Ansible, PowerShell or the FMC REST API).

· Working proficiency in Spanish, to support our sites in Mexico and Colombia.

Certifications

· CCNP Enterprise or CCNP Security (or equivalent experience): required, or obtained within 12 months of hire.

· AWS Certified Advanced Networking – Specialty or AWS Certified Solutions Architect – Associate: strongly preferred.

· CCIE, Cisco Firepower specialist or security certifications (CISSP, Security+): a plus.

Work Environment

This position is on site in Westport, CT, five days a week, with regular travel to company sites. It is on call 24/7 as the primary escalation point for network outages. After-hours and weekend work is required for maintenance windows, cutovers and incidents. Site visits may include plant an]]> <