This is a contract position for a Lead Network Engineer to own the network workstream for an operational technology (OT) infrastructure separation project. Two OT sites are being carved out in an M&A transaction and must transition to the acquirer's services by cutover. You will work in a small team under the lead program firm, based remotely, for a minimum of 6 months. The role centers on Layer 3.5 (IT/OT DMZ) and Layer 3 network design, build, and cutover execution across both sites.
Responsibilities
Lead a three-week remote assessment of both sites; reconcile incomplete seller drawings into a complete current-state network picture
Map all connectivity at each site, identifying every flow that crosses the IT/OT boundary, including ports, protocols, zones, and conduits, to inform the acquirer's firewall cutover strategy
Design the Layer 3.5 DMZ and Layer 3 network changes required at cutover; maintain the network disposition register documenting what transfers, what is bridged, and what is replaced
Stage network devices and virtual stand-ins; assume control of existing site switches including credentials, configuration backups, and reconfiguration of AAA, syslog, and SNMP to point to the acquirer's infrastructure
Stand up DHCP relay, device AAA, and time source services at Layer 3
Coordinate monitoring sensor points with the OT Cybersecurity Engineer
Author the network section of the cutover runbook; design and execute isolation tests and test plans; perform network cutover steps on site and provide the network rollback recommendation
Show the full description
Support hypercare phase; maintain current diagrams, IP plans, and configurations in the team repository; report network progress, risks, and open items to the lead firm
Qualifications
Required
10+ years in enterprise network engineering with lead or design responsibility and recent hands-on configuration experience
IT/OT segmentation knowledge using the Purdue model and ISA/IEC 62443 zones and conduits
DMZ design expertise under restrictive protocol policy, including relays, proxies, and per-flow rule implementation
Cisco routing and switching at CCNP level or equivalent, including VLANs, OSPF, and BGP
Experience with TACACS+ or RADIUS, DHCP relay, and NTP
Led and executed at least one live cutover to a fixed date with a documented rollback plan
Ability to present network designs to client security teams and execute from a cutover runbook in a change window
Preferred
Experience with divestiture, carve-out, or merger separation projects
Check Point and Palo Alto firewall policy configuration
OT network monitoring sensor placement (Nozomi, Dragos, or Forescout)
Cisco Catalyst 9800 wireless controllers and access-point re-adoption
Catalyst 8000V or 9800-CL virtual appliances
Scripting for configuration generation (Python, Ansible)
CCIE, GICSP, PCNSE, or CCSE certification
