Senior Network Engineer, Network Access Security

Rockwell Automation•Mayfield Heights, OH

2d•$119,360 - $179,040•Hybrid

About The Position

Rockwell Automation is hiring a Senior Network Engineer to join its enterprise network and security engineering team. The role focuses on the design, security, and reliability of network access for users and devices across the global estate, including corporate and manufacturing environments in AMER, EMEA, and APAC. Network access policy is primarily built and enforced in Forescout, with Cisco Identity Services Engine (ISE) handling device administration. This work is part of the company’s network Zero Trust program, spanning three regions and hundreds of sites. The engineer will share program ownership as a peer to the senior network access engineer, take responsibility for a portion of the estate, and help advance the program from reactive lifecycle work toward deliberate segmentation and Zero Trust implementation. This is a hands-on engineering role requiring practical experience with network access policy, RADIUS logs, 802.1X troubleshooting, and safely tightening access without disrupting plant or office operations. The role reports to the IT Manager, Network and Security Engineering. It is hybrid and based at a Rockwell Automation office in Milwaukee or Mequon, Wisconsin; Mayfield Heights, Ohio; Chelmsford, Massachusetts; or Eden Prairie, Minnesota. Employees are expected to work at a Rockwell location at least Mondays, Tuesdays, and Thursdays unless they have a business obligation out of the office.

Requirements

Bachelor’s degree in a relevant field.
Legal authorization to work in the United States; the employer will not sponsor employment visas for this opening.
Extensive, hands-on practical experience administering Forescout, including designing, creating, and enforcing network access policy; deep Forescout expertise is identified as a critical requirement.
Deep, demonstrable expertise in 802.1X and MAB for wired and wireless access, RADIUS, and common EAP methods.
Practical experience with Cisco ISE for device administration using TACACS+, including deployment, upgrades, and certificate lifecycle in a large, distributed enterprise.
Strong Cisco routing and switching foundation, particularly campus and access-layer networking.
Solid understanding of network segmentation, VLANs, and access control lists and how they support a Zero Trust model.
Working knowledge of certificates and PKI as they apply to EAP, RADIUS, and device trust.
Strong troubleshooting and analytical skills, with the ability to work independently and own a regional share of a global program.

Nice To Haves

Typically requires a minimum of 8 years of related experience.
Bachelor’s degree in Computer Science, Engineering, or Information Technology, or equivalent experience.
Current or previously held Cisco networking certification, such as CCNP or CCNP Security.
Cisco ISE or security specialization, such as a CCNP Security or an ISE-focused certification.
Experience with Cisco TrustSec, Security Group Tags, and pxGrid integrations.
Experience securing OT and industrial or manufacturing networks, including environments where endpoints cannot always run a supplicant.
Palo Alto Networks firewall familiarity sufficient to partner on segmentation and policy.
Automation experience using Python, Ansible, or REST APIs to scale NAC and access operations.
Experience with Cisco wireless, including the 9800 wireless LAN controller.
Experience deploying or integrating in Microsoft Azure cloud environments.

Responsibilities

Design, deploy, and operate 802.1X and MAB authentication for wired and wireless access across corporate and manufacturing environments.
Build and tune Cisco ISE policy sets, authentication and authorization rules, posture, profiling, dynamic VLAN assignment, and downloadable ACL assignment.
Troubleshoot complex access failures end to end, from the supplicant and switchport through RADIUS to the ISE policy decision, including OT and industrial endpoints.
Own deployment, upgrades, patching, and certificate lifecycle for the distributed Cisco ISE estate, including regional policy and monitoring nodes.
Manage certificate and PKI dependencies used by ISE and RADIUS, including EAP, DTLS, and administration certificates.
Respond to ISE and NAC security advisories and drive timely, low-risk remediation.
Operate and extend Forescout for device discovery, classification, and policy enforcement, including ACL-writing enablement as sites are brought under control.
Keep access policy aligned with an accurate, current view of devices on the network.
Design and implement network segmentation using VLANs, access control lists, and group-based policy to limit lateral movement and contain risk.
Help define and advance the network access Zero Trust roadmap, translating strategy into deployed, measurable controls.
Manage RADIUS and TACACS+ for authentication and device administration, and support the Cisco access-layer switching that underpins these services.
Partner with firewall, application delivery, security operations, and regional network teams to deliver access control as a coherent service.
Create and maintain documentation, runbooks, and standard configurations, and provide a second point of coverage for the program.
Participate in change management and support maintenance windows and escalations, including outside standard business hours when needed.