Senior Network Engineer, Network Access Security

Rockwell Automation is a global technology leader focused on helping the world’s manufacturers be more productive, sustainable, and agile. With more than 28,000 employees who make the world better every day, we know we have something special. Behind our customers - amazing companies that help feed the world, provide life-saving medicine on a global scale, and focus on clean water and green mobility - our people are energized problem solvers that take pride in how the work we do changes the world for the better.

We welcome all makers, forward thinkers, and problem solvers who are looking for a place to do their best work. And if that’s you we would love to have you join us!

Job Description

As a Senior Network Engineer, Network Access Security, you will join our enterprise network and security engineering team. In this role you will help own the design, security, and reliability of how every user and device gets onto our global network. The work spans network access control, identity based authentication, and network segmentation. The majority of our network access policy is built and enforced in Forescout, with Cisco Identity Services Engine (ISE) handling device administration, across our AMER, EMEA, and APAC regions. 

This is our Zero Trust program for the network. You will partner directly with our senior network access engineer as a peer, sharing a program that today runs across three regions and hundreds of sites. You will take real ownership of a share of that estate rather than shadowing someone else's, and you will help move the program from reactive lifecycle work toward a deliberate segmentation and Zero Trust build. 

This is a hands on engineering role for someone who has lived inside network access policy and RADIUS logs, knows why a supplicant is failing 802.1X, and can tighten access without taking a plant or an office offline. 

You will report to the IT Manager, Network and Security Engineering, and will work Hybrid in any of RA office based in Milwaukee or Mequon, WI OR Mayfield Heights, OH OR Chelmsford, MA or Eden Prairie, MN.

Primary Responsibilities

Network access control and 802.1X (primary focus of the role):

• Design, deploy, and operate 802.1X and MAB authentication for wired and wireless access across the global estate, for both corporate and manufacturing environments. 

• Build and tune Cisco ISE policy sets, authentication and authorization rules, posture, profiling, and dynamic VLAN and downloadable ACL assignment. 

• Troubleshoot complex access failures end to end, from the supplicant and switchport through RADIUS to the ISE policy decision, including hard to place devices such as OT and industrial endpoints. 

Cisco ISE platform engineering and lifecycle:

• Own deployment, upgrades, patching, and certificate lifecycle for the distributed ISE estate, including policy and monitoring nodes across regions. 

• Manage the certificate and PKI dependencies that ISE and RADIUS rely on, including EAP, DTLS, and administration certificates. 

• Respond to ISE and NAC security advisories and drive timely, low risk remediation. 

Forescout and device visibility:

• Operate and extend Forescout for device discovery, classification, and policy enforcement, including ACL writing enablement as sites are brought under control. 

• Keep access policy aligned with an accurate, current picture of what is actually on the network. 

Network segmentation and Zero Trust:

• Design and implement network segmentation using VLANs, access control lists, and group based policy to limit lateral movement and contain risk. 

• Help define and advance the Zero Trust roadmap for network access, turning strategy into deployed, measurable control. 

AAA, access layer, and operations:

• Manage RADIUS and TACACS+ for authentication and device administration, and support the Cisco access layer switching that underpins it. 

• Partner with the firewall, application delivery, security operations, and regional network teams to deliver access control as a coherent service. 

• Create and maintain documentation, runbooks, and standard configurations, and provide a genuine second point of coverage for a program that is currently single threaded. 

• Participate in change management and support maintenance windows and escalations, including outside standard business hours when needed. 

The Essentials - You Will Have:

• Bachelor's Degree in relevant field.
• Legal authorization to work in the US is required. We will not sponsor individuals for employment visas, now or in the future, for this job opening.

The Preferred - You Might Also Have:

• Typically requires a minimum of 8 years of related experience.
• Bachelor's degree in Computer Science, Engineering, Information Technology, or equivalent experience. 

• Current or previously held Cisco networking certification, such as CCNP or CCNP Security. 

• Extensive, hands on practical experience administering Forescout, including the design, creation, and enforcement of network access policy. The majority of our network access policy lives in Forescout, so deep Forescout expertise is the critical requirement for this role. 

• Deep, demonstrable expertise in 802.1X and MAB for wired and wireless access, RADIUS, and common EAP methods. This is a core requirement for the role. 

• Practical experience with Cisco Identity Services Engine (ISE) for device administration (TACACS+), including deployment, upgrades, and certificate lifecycle in a large, distributed enterprise. 

• Strong Cisco routing and switching foundation, particularly the campus and access layer. 

• Solid understanding of network segmentation, VLANs, and access control lists, and how they serve a Zero Trust model. 

• Working knowledge of certificates and PKI as they apply to EAP, RADIUS, and device trust. 

• Strong troubleshooting and analytical skills, with the ability to work independently and own a regional share of a global program. 

• Cisco ISE or security specialization, such as a CCNP Security or an ISE focused certification. 

• Experience with Cisco TrustSec, Security Group Tags, and pxGrid integrations. 

• Experience securing OT and industrial or manufacturing networks, where endpoints cannot always run a supplicant. 

• Palo Alto Networks firewall familiarity, enough to partner cleanly on segmentation and policy. 

• Automation experience using Python, Ansible, or REST APIs to scale NAC and access operations. 

• Experience with Cisco wireless, including the 9800 wireless LAN controller. 

• Experience deploying or integrating in Microsoft Azure cloud environments. 

What We Offer:

• Health Insurance including Medical, Dental and Vision
• 401k
• Paid Time off
• Parental and Caregiver Leave
• Flexible Work Schedule where you will work with your manager to enjoy a work schedule that can be flexible with your personal life.
• To learn more about our benefits package, please visit at www.raquickfind.com.

For this role, the Base Salary Compensation is from $119,360.00 - $179,040.00 USD Annual with an annual target bonus of 8% of base salary. Actual pay will be based on factors such as skills, knowledge, education, and experience.

At Rockwell Automation we are dedicated to building a diverse, inclusive and authentic workplace, so if you're excited about this role but your experience doesn't align perfectly with every qualification in the job description, we encourage you to apply anyway. You may be just the right person for this or other roles.

This position is part of a job family. Experience will be the determining factor for position level and compensation.

#LI-Hybrid

#LI-LifeAtRok

#LI-SS1

We are an Equal Opportunity Employer including disability and veterans.

Rockwell Automation’s hybrid policy aligns that employees are expected to work at a Rockwell location at least Mondays, Tuesdays, and Thursdays unless they have a business obligation out of the office.