Principal Network Engineer - OT Network Segmentation / Palo Alto Firewall

This is a highly technical, hands-on role focused on designing, implementing, securing, and supporting network segmentation across manufacturing and enterprise environments.

The ideal candidate will have deep experience with Palo Alto firewalls, firewall security policies, OT/manufacturing networks, network segmentation, and the Purdue Model / ISA-95 framework.

In addition to the OT segmentation initiative, this role will support broader enterprise networking technologies including LAN, WAN, wireless, SD-WAN, SASE, routing, switching, network security, and secure access technologies., * Support the architecture, design, and implementation of OT network segmentation within a pharmaceutical manufacturing environment.

• Configure, manage, and troubleshoot Palo Alto firewalls and firewall security policies.
• Apply Purdue Model / ISA-95 principles to OT and manufacturing network architecture.
• Design and implement secure network zones, segmentation strategies, and access controls between enterprise IT and operational technology environments.
• Install, configure, test, troubleshoot, and support:
• Cisco routers and switches
• Cisco wireless technologies
• LAN and WAN infrastructure
• SD-WAN
• Palo Alto firewalls
• Secure Access Service Edge (SASE) technologies
• Zscaler Internet Access (ZIA)
• Zscaler Private Access (ZPA)
• Support networking technologies throughout the lifecycle from proof of concept through design, build, deployment, and operational handoff.
• Partner with Network Operations teams to ensure a smooth transition from project implementation into production support.
• Maintain detailed network architecture, configuration, security, and operational documentation.
• Ensure network documentation and implementation practices support GxP and regulated manufacturing requirements.
• Identify network risks, dependencies, performance trends, and opportunities to improve security, reliability, scalability, and resiliency.
• Support network capacity planning, infrastructure scaling, and future-state network architecture.
• Troubleshoot complex routing, switching, firewall, connectivity, and network performance issues.
• Identify opportunities to automate network infrastructure deployment, configuration, monitoring, and administration.
• Provide clear status updates across multiple concurrent initiatives and deployments.
• Collaborate with Network Engineering, Network Operations, Digital & Technology teams, manufacturing IT, project teams, vendors, managed service providers, and business stakeholders.

• 8+ years of network engineering experience supporting complex, highly available, 24x7 enterprise environments.
• Strong hands-on experience with OT, industrial, laboratory, or manufacturing networks.
• Demonstrated experience designing or implementing network segmentation.
• Strong hands-on experience with Palo Alto firewalls, including security policies and firewall rule management.
• Working knowledge of the Purdue Model and/or ISA-95 framework.
• Strong understanding of enterprise routing and switching technologies.
• Strong experience with:
• BGP
• EIGRP
• Cisco routers and switches
• Cisco wireless networking
• WAN and SD-WAN
• Palo Alto Networks firewalls
• Zscaler Internet Access (ZIA)
• Zscaler Private Access (ZPA)
• TCP/IP
• DNS
• DHCP
• NTP
• Syslog
• Common IP protocols and network services
• Experience with network capacity planning and infrastructure scaling.
• Experience contributing to network architecture and infrastructure design.
• Strong troubleshooting and root cause analysis skills.
• Strong network and security documentation skills.
• Excellent written and verbal communication skills.
• Ability to work effectively with engineering teams, operations teams, project teams, leadership, and business stakeholders.

Preferred Qualifications

• Experience within pharmaceutical, biotechnology, life sciences, or another regulated manufacturing environment.
• Knowledge of GxP and 21 CFR Part 11 requirements.
• Experience with OT cybersecurity and manufacturing network security.
• Experience working within Plan / Build / Run operating models.
• Experience partnering with Managed Services Providers (MSPs).
• Experience with cloud networking technologies.
• Familiarity with load balancing technologies.
• Familiarity with Network Admission Control (NAC) technologies.
• Experience with:
• Splunk
• LogicMonitor
• Cisco Catalyst Center
• Bachelor’s degree in Computer Science, Management Information Systems, Engineering, or another technical discipline, or equivalent practical experience.

Ideal Candidate

We are particularly interested in candidates who have worked directly in OT or manufacturing environments and understand the security and operational complexities involved in separating manufacturing systems from traditional enterprise IT networks.

The strongest candidates will have hands-on experience with:

• Palo Alto firewall security policies
• OT / manufacturing networks
• Network segmentation
• Purdue Model / ISA-95
• Cisco routing and switching
• Regulated or pharmaceutical manufacturing environments

This is not primarily a traditional corporate network operations role. The primary focus will be the OT Network Segmentation initiative, so candidates with direct OT segmentation and Palo Alto firewall experience will receive strong consideration.

Engagement Details

This is a 12+ month contract engagement with a strong possibility of extension.

The position is expected to work onsite in Rensselaer, NY, five days per week.

Pay: $65.00 - $70.00 per hour

Expected hours: 40.0 per week