Senior Network Engineer, Network Access Security

Rockwell Automation•Mayfield Heights, OH

1d•$119,360 - $179,040•Hybrid

About The Position

Rockwell Automation is seeking a Senior Network Engineer, Network Access Security, to join its enterprise network and security engineering team. The role focuses on the design, security, and reliability of network access for users and devices across the global enterprise, with network access policy primarily built and enforced in Forescout and Cisco Identity Services Engine (ISE) supporting device administration. The network spans AMER, EMEA, and APAC, including corporate and manufacturing environments. The engineer will share ownership of the global network access program with a senior network access engineer, taking responsibility for part of the estate across three regions and hundreds of sites. The role will help shift the program from reactive lifecycle work toward planned network segmentation and Zero Trust implementation. It is a hands-on engineering position requiring deep experience with network access policy, RADIUS, and troubleshooting 802.1X while maintaining service availability for plants and offices. The position reports to the IT Manager, Network and Security Engineering. It is hybrid and based at a Rockwell Automation office in Milwaukee or Mequon, Wisconsin; Mayfield Heights, Ohio; Chelmsford, Massachusetts; or Eden Prairie, Minnesota. Employees are expected to work at a Rockwell location at least Mondays, Tuesdays, and Thursdays unless they have an out-of-office business obligation.

Requirements

Bachelor's degree in a relevant field.
Legal authorization to work in the United States; employment visa sponsorship is not available for this position.
Deep, hands-on expertise in 802.1X and MAB for wired and wireless access, RADIUS, and common EAP methods.
Extensive practical Forescout administration experience, including designing, creating, and enforcing network access policy.
Practical Cisco ISE experience for device administration using TACACS+, including deployment, upgrades, and certificate lifecycle in a large, distributed enterprise.
Strong Cisco routing and switching foundation, particularly in campus and access-layer networking.
Solid understanding of network segmentation, VLANs, access control lists, and their role in a Zero Trust model.
Working knowledge of certificates and PKI as they apply to EAP, RADIUS, and device trust.
Strong troubleshooting and analytical skills, and ability to work independently and own a regional share of a global program.

Nice To Haves

Typically at least 8 years of related experience.
Bachelor's degree in Computer Science, Engineering, or Information Technology, or equivalent experience.
Current or previously held Cisco networking certification, such as CCNP or CCNP Security.
Cisco ISE or security specialization, such as CCNP Security or an ISE-focused certification.
Experience with Cisco TrustSec, Security Group Tags, and pxGrid integrations.
Experience securing OT and industrial or manufacturing networks, including environments where endpoints cannot run a supplicant.
Familiarity with Palo Alto Networks firewalls sufficient to partner on segmentation and policy.
Automation experience using Python, Ansible, or REST APIs to scale NAC and access operations.
Experience with Cisco wireless, including the 9800 wireless LAN controller.
Experience deploying or integrating in Microsoft Azure cloud environments.

Responsibilities

Design, deploy, and operate 802.1X and MAB authentication for wired and wireless access across corporate and manufacturing environments worldwide.
Build and tune Cisco ISE policy sets, authentication and authorization rules, posture and profiling, and dynamic VLAN and downloadable ACL assignments.
Troubleshoot complex access failures from the supplicant and switchport through RADIUS to the ISE policy decision, including for OT and industrial endpoints.
Own deployment, upgrades, patching, and certificate lifecycle for the distributed ISE estate, including regional policy and monitoring nodes.
Manage certificate and PKI dependencies used by ISE and RADIUS, including EAP, DTLS, and administration certificates.
Respond to ISE and NAC security advisories and drive timely, low-risk remediation.
Operate and extend Forescout for device discovery, classification, and policy enforcement, including ACL-writing enablement at sites.
Keep access policy aligned with an accurate, current view of devices on the network.
Design and implement network segmentation using VLANs, access control lists, and group-based policy to limit lateral movement and contain risk.
Help define and advance the network access Zero Trust roadmap by turning strategy into deployed, measurable controls.
Manage RADIUS and TACACS+ for authentication and device administration, and support the Cisco access-layer switching infrastructure.
Partner with firewall, application delivery, security operations, and regional network teams to deliver access control as a coherent service.
Create and maintain documentation, runbooks, and standard configurations, and provide a second point of coverage for the program.
Participate in change management and support maintenance windows and escalations, including outside standard business hours when needed.