Lead Network Engineer

ZealHire Inc.; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

ZealHire Inc. seeks a senior enterprise network engineer to own the IT/OT network workstream for a two-site carve-out in an M&A transaction.

You will design the L3.5 DMZ and the L3 network, map connectivity, and run the cutover on site with a written rollback plan. The role requires 10+ years of enterprise network experience, CCNP or higher, hands-on routing/switching, DMZ policies, and IT/OT segmentation (Purdue ISA/IEC 62443).

Qualifications

• Must be able to start 11/9/2026.
• 10+ years in enterprise network engineering with lead/design responsibility and recent hands-on config work.
• Experience leading at least one live cutover with a written rollback plan.
• CCIE, GICSP, PCNSE or CCSE.
• DMZ design under a restrictive policy using relays, proxies and per-flow rules.
• Cisco routing and switching at CCNP level or equivalent, VLANs, OSPF and BGP.
• Strong communication.
• US citizens.

Responsibilities

• Lead the network workstream end to end: design it and build it.
• Run the network cutover on site.
• Map connectivity at each site including IT/OT boundary crossings.
• Design the L3.5 DMZ and L3 network changes for cutover.
• Stand up DHCP relay, device AAA and time source for L3.
• Coordinate monitoring sensor points with OT Cybersecurity Engineer.
• Write the network section of the cutover runbook and run tests.
• Support hypercare and keep diagrams, IP plans, and configs updated.

Skills

10+ years in enterprise network eng

IT/OT segmentation

DMZ design

CCNP level routing & switching

OSPF & BGP

TACACS+ / RADIUS / DHCP relay

Lead live cutover

Strong communication

US citizens

Tools

TACACS+ / RADIUS

DHCP relay

NTP

Job description

Must be able to start on Monday, November 9th 2026

Must Have:

• Must be able to start 11/9/2026
• 10+ years in enterprise network engineering, with lead or design responsibility and recent hands-on configuration work
• Exp Leading and executing at least one live cutover to a fixed date with a written rollback plan
• CCIE, GICSP, PCNSE or CCSE
• DMZ design under a restrictive protocol policy, using relays, proxies and per-flow rules
• Cisco routing and sw Check Point and Palo Alto firewall policy
• OT network monitoring sensor placement (Nozomi, Dragos or Forescout)
• Cisco routing and switching at CCNP level or equivalent, including VLANs, OSPF and BGP
• Must have strong communication
  • US Natural Citizens
• LinkedIn page

Contract work on an OT infrastructure separation. Two OT sites are being carved out of their parent company in an M&A transaction, and the OT control environment has to run on the acquirer's own services from cutover. You work in a small team under the lead firm on the program.

The role

Own the network workstream end to end: design it and build it. Find out what is on the network at both sites, decide what has to cross the IT/OT boundary at cutover, build the changes, and run the network cutover on site. The work centers on L3.5 (the IT/OT DMZ) and the in-scope L3 network.

What you will do

• Lead a three-week remote assessment of both sites and turn the seller's incomplete drawings into a current-state network picture
• Map the connectivity at each site: every flow that crosses the IT/OT boundary, with ports, protocols, zones and conduits, as the basis for the acquirer's firewall cutover
• Design the L3.5 DMZ and the L3 network changes needed at cutover, and keep the network rows of the disposition register: what transfers, what is bridged, what is replaced
• Stage the network devices and any virtual stand-ins, and take over the existing site switches with credentials, config backups, and AAA, syslog and SNMP re-pointed to the acquirer
• Stand up DHCP relay, device AAA and the time source at L3
• Agree the monitoring sensor points with the OT Cybersecurity Engineer
• Write the network section of the cutover runbook, run isolation tests and test plans, execute the network cutover steps on site, and make the network rollback recommendation
• Support hypercare, keep diagrams, IP plans and configs current in the team repository, and report network progress, risks and open questions to the lead firm

What you bring

• 10+ years in enterprise network engineering, with lead or design responsibility and recent hands-on configuration work
• IT/OT segmentation using the Purdue model and ISA/IEC 62443 zones and conduits
• DMZ design under a restrictive protocol policy, using relays, proxies and per-flow rules
• Cisco routing and switching at CCNP level or equivalent, including VLANs, OSPF and BGP
• TACACS+ or RADIUS, DHCP relay and NTP
• Led and executed at least one live cutover to a fixed date with a written rollback plan
• Comfortable presenting a design to a client security team and working from a runbook in a change window

Nice to have

• Divestiture, carve-out or merger separation experience
• Check Point and Palo Alto firewall policy
• OT network monitoring sensor placement (Nozomi, Dragos or Forescout)
• Cisco Catalyst 9800 wireless controllers and access-point re-adoption
• Catalyst 8000V or 9800-CL virtual appliances

$000,000 – $000,000 Salary range is not shown on the candidate portal