The posting
Multi-site enterprise network security | Hands-on technical leadership The opportunity We are seeking an experienced, hands-on network and infrastructure security engineer to own the operational security, reliability, and continuous improvement of our networks across multiple company locations. This role is primarily focused on network engineering and defensive security—not a policy-only cybersecurity position. The successful candidate will be our resident technical expert for firewalls, secure connectivity, network segmentation, switching, wireless, and protection of internet-facing infrastructure. You will work with Corporate IT and local IT teams to identify weaknesses before they are exploited, establish consistent technical standards, and resolve complex incidents without depending on vendors for routine diagnosis. What you will own • Firewall and perimeter security: Administer, harden, monitor, and troubleshoot next-generation firewalls and edge services; manage rule bases, NAT, IPS/IDS, remote access, VPNs, firmware, certificates, and secure management access. Experience with Palo Alto, SonicWall, Sophos, and/or Fortinet is especially relevant. • Proactive vulnerability and patch management: Maintain an accurate inventory of network/security devices; track vendor advisories, exposed services, end-of-life systems, configuration drift, and vulnerabilities. Prioritize and coordinate firmware/security updates, validate remediation, and document exceptions. • Segmentation and secure architecture: Design and maintain VLANs, ACLs, inter-VLAN controls, least-privilege access, site-to-site connectivity, and segmentation of user, server, guest, management, and other higher-risk networks. Reduce lateral-movement opportunities. • Switching, wireless, and network operations: Configure and troubleshoot managed switches, routing, DNS/DHCP dependencies, wireless controllers/APs, authentication, and network performance. Understand the security implications of each component. • Detection, response, and resilience: Review firewall/network telemetry and alerts, investigate suspicious traffic and attempted intrusions, support incident containment, validate backups of device configurations, and test recovery procedures. • Multi-site standards and execution: Conduct regular site security reviews; maintain network diagrams, configurations, change records, runbooks, and remediation plans. Coordinate changes with local IT teams while ensuring common corporate security baselines. • Technical Leadership and Continuous Improvement: Serve as a technical escalation point for complex network and security issues. Provide technical guidance to IT personnel across locations, establish engineering standards, and lead initiatives that improve the security and reliability of enterprise infrastructure.
Required experience and capabilities
3-5 years of hands-on enterprise network administration/engineering, including direct responsibility for firewall security and multi-site connectivity. Proven ability to configure, troubleshoot, and secure at least one major next-generation firewall platform; ability to learn and support additional platforms. Strong TCP/IP, routing, VLAN, ACL, VPN/IPsec, switching, wireless, DNS, DHCP, and network troubleshooting skills. Experience managing security patches, firmware upgrades, vulnerability remediation, and change control on production network devices. Ability to investigate issues using logs, packet captures, traffic analysis, and a structured root-cause methodology. Practical understanding of attack paths, exposed services, credential-based attacks, segmentation, least privilege, and defense in depth. Clear documentation, sound risk judgment, and ability to coordinate with distributed IT staff and business stakeholders. Ability to independently investigate complex security incidents using firewall logs, packet captures, network traffic analysis, and other diagnostic tools. Experience implementing secure administrative access, privileged access controls, and network management security best practices. Ability to lead technical projects, make architecture recommendations, and serve as a escalation resource for network and security operations.
Preferred qualifications Experience across Palo Alto, SonicWall, Sophos, and Fortinet; enterprise Wi-Fi and switch management; hybrid Active Directory/Entra ID environments; endpoint detection and response integration; CrowdStrike vulnerability scanning and SIEM/log monitoring; manufacturing or operational technology (OT) segmentation; Experience with high availability, disaster recovery, and business continuity design. Relevant vendor certifications (for example PCNSE, NSE/FCP/FCSS, CCNP, or equivalent) are valued, but demonstrated hands-on ability matters more than credentials. What success looks like
Internet-facing devices are inventoried, hardened, monitored, and patched within risk-based targets. Firewall rules and VPN access are reviewed regularly; unnecessary exposure and overly permissive access are reduced. Sites follow consistent segmentation, configuration, logging, backup, and change-control standards. High-risk findings have clear owners, remediation plans, and evidence of closure. When an outage or suspicious event occurs, you can diagnose the technical cause, restore service safely, and prevent recurrence.
