Operational Technology Controls and Automation Engineer

Gordon Food Service • Michigan, MI

9d • Onsite

About The Position

The Operational Technology Controls and Automation Engineer serves as the key technical lead bridging physical warehouse automation, industrial cybersecurity, and operational execution across the distribution network. This role is responsible for driving the continuous improvement, stability, and security posture of all on-site Operational Technology (OT) - including Material Handling Equipment (MHE/conveyors/sorters/ASRS), Cold Chain/Refrigeration controls, Building Management Systems (BMS), and facility safety infrastructure. Functioning as a technical owner and influencer, this role collaborates directly with Divisional DC Maintenance, Enterprise IT/GTS, Security Operations, and external OEM vendors to enforce OT network segmentation, optimize real-time WCS/WES execution logic, and guarantee high availability without compromising floor throughput or physical safety.

Requirements

• Bachelor's degree in Information Security, Computer Science, Engineering, Information Technology, or a related field or equivalent combination of education and experience required.
• Deep expertise in Industrial Control Systems (ICS), Programmable Logic Controllers (PLCs - Rockwell/Allen-Bradley, Siemens), HMIs, variable frequency drives (VFDs), and fixed barcode scan tunnels.
• Advanced knowledge of industrial networking protocols (Profinet, EtherNet/IP, Modbus TCP) and industrial network security frameworks (ISA/IEC 62443, NIST SP 800-82, Purdue Model).
• Hands-on proficiency with Layer 7 Next-Gen Firewalls (Palo Alto Networks, App-ID, Threat Prevention) and SASE/Zero-Trust Access (Prisma Access).
• Knowledge of Automated Material Handling Systems (AMHS), AS/RS stacker cranes, robotics, and their operational relationships to cold chain refrigeration and facility utilities.
• Strong ability to influence without direct authority, build trust with floor maintenance teams, and translate complex technical requirements into actionable site guidance.
• Strong troubleshooting and analytical skills related to interpreting trend logs, packet captures, and network flow data.
• Excellent written and verbal communication skills; ability to author procedures, business proposals, and technical incident reports for executive leadership.
• Strong Electrical / Controls background
• Strong Industrial control system trouble shooting experience with ability to assist in system trouble events both remotely and on site dispatched if needed.

Nice To Haves

• GICSP (Global Industrial Cyber Security Professional), CISSP, ISA/IEC 62443 Cybersecurity Expert, or Palo Alto PCNSA/PCNSE certifications preferred.

Responsibilities

• Partners with Enterprise Security to design, deploy, and enforce Layer 7 network segmentation (e.g., Palo Alto / Prisma Access) between OT subnets and enterprise VLANs, protecting OT/ICS environments from enterprise threats without impacting operational continuity.
• Leads the deployment and execution of technical migration from legacy VPNs to modern Zero Trust Network Access (ZTNA) and SASE jump-box portals, establishing strict access governance for third-party automation and refrigeration providers.
• Manages Network Detection and Response and OT visibility platforms (e.g., Armis, Cisco CyberVision, Vectra), maintaining real-time asset inventories and threat detection across cloud and floor environments.
• Operationalizes and executes pre-approved "break-glass" containment playbooks with SecOps to isolate compromised warehouse segments or malicious vendor tunnels at machine speed during cyber threats without causing self-inflicted plant outages.
• Partners with GTS teams to develop and maintain network security design patterns, engineering standards, and implementation roadmaps supporting Zero Trust, SASE, cloud migration, and business objectives.
• Partners with other GTS and Security teams and oversees a global segmentation model utilizing Next-Gen Firewalls (NGFWs), micro-segmentation, and cloud-native security controls across cloud, data center, partner networks, and site locations.
• Partners with Cloud, On-Prem Network, and IAM teams to integrate identity attributes, device posture, and directory services into dynamic access policies across SD-WAN and enterprise transit layers.
• Implements IaC and policy-as-code solutions to automatically deploy, validate, and audit network security controls across hybrid environments.
• Establishes edge firewall virtual patching and threat prevention profiles (IPS/App-ID) to mitigate vulnerabilities on legacy PLCs and controllers that cannot accept direct firmware patches.
• Owns point-in-time backup integrity and disaster recovery protocols for PLC ladder logic, SCADA configurations, and local execution databases to satisfy corporate Recovery Point (RPO) and Recovery Time (RTO) objectives.
• Serves as senior technical escalation support during complex automation stoppages and cybersecurity incidents, troubleshooting fieldbus communications (Profinet, EtherNet/IP) and network-based threat activity.
• Serves as a trusted advisor to Divisional DC Maintenance, Site Leadership, and GTS teams, mentoring technicians and driving network-wide adoption of OT best practices, SOPs, and engineering standards.
• Oversees the integration and real-time execution performance of Warehouse Control Systems (WCS) and Warehouse Execution Systems (WES), ensuring wave-balancing algorithms and routing logic maintain peak case-per-hour throughput.
• Controls PLC firmware updates, SCADA updates, and control logic patches, ensuring all updates undergo offline validation in pre-production environments prior to scheduled maintenance windows.
• Participates in the Cross-Functional Architecture Group to influence the secure design of enterprise technology initiatives, cloud transit, and data-in-transit encryption standards.
• Evaluates emerging network security technologies and defines key security engineering metrics related to network visibility, policy compliance, and Zero Trust maturity.
• Performs other duties as assigned.
• Develops and maintains Control Platform Standards that are maintained in the GFS Standards used for existing and new implementations
• Provides and specifies server OT needs for IT to provide the appropriate solution for the OT application or Control System. This includes supporting provisioning of support contractors and required roles to support GFS systems.
• Collaborate with Enterprise security in review of devices that will exist on GFS networks. This includes hardware devices, software used to control devices, and other OT specific applications and devices.

Benefits

• Equal Employment Opportunity is a matter of policy at Gordon Food Service, Inc. and we are committed to a work environment in which all individuals are treated with respect and dignity.
• All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, status as a protected veteran, or status as a qualified individual with disability.
• If you require reasonable accommodation for any part of the application or hiring process due to a disability, please submit your request to [email protected] and use the words “Accommodation Request” in your subject line.
• All Gordon Food Service locations are tobacco-free.
• Gordon Food Service is a drug-free workplace and conducts pre-employment drug tests.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior