OT Network & Security Engineer

About the Role

Vulcan Elements is manufacturing American rare-earth permanent magnets for a secure, resilient future, serving critical industries such as defense, aerospace, and automotive. As the OT Network & Security Engineer, you will design and secure the operational technology backbone for a 1 million square foot manufacturing facility expansion. This high-impact, high-ownership role requires depth in both industrial networking and OT security.

Responsibilities

• Produce the OT network architecture for a large-format industrial facility: MDF/IDF distribution, fiber backbone topology, switching and routing design, IP schema, and resilience strategy.
• Freeze IDF locations, pathways, and enclosure requirements into construction drawings on the construction schedule.
• Author and maintain the IEC 62443 zone-and-conduit register, the living document that drives firewall policy, and set security-level targets per zone.
• Write network and security requirements into all equipment packages ahead of Factory Acceptance Tests, and verify them at acceptance alongside Controls Engineers.
• Design and operate the remote access architecture for internal OT network access and OEM support connectivity, with per-vendor approval and session control.
• Coordinate the enterprise boundary with IT: DMZ services, WAN demarcation, identity architecture, and CMMC/CUI compliance evidence for the U.S. government partnership.
• Select and onboard the managed OT detection-and-response provider ahead of first energization; scope the independent IEC 62443 risk assessment and penetration test.
• Own patch-versus-compensating-control decisions with the area controls engineers.

Deliverables

• OT network design basis, MDF/IDF standards, IP schema, and fiber/cabling specifications with acceptance criteria.
• Zone-and-conduit register, security-level targets, firewall policy set, and the secure remote access design.
• OEM network/security requirement specifications, FAT verification records, CMMC/CUI evidence packages, and the OT incident-response plan.
• Switch and firewall configuration standards under change control, asset inventory, and the managed detection and service integration.

Responsibilities and tasks outlined are not exhaustive and may change as determined by the needs of the business.

Requirements

• Bachelor’s or Master’s degree in Engineering, Computer Science, or a related field with 7+ years spanning industrial networking and OT security, or equivalent demonstrated depth in both.
• Ability to design and defend segmentation, switching, routing, and firewall policy for industrial Ethernet environments, and to reason about control-traffic behavior (EtherNet/IP or comparable) when making design trade-offs.
• Ability to apply zone/conduit thinking and risk-based security levels to a real plant—asset inventory, monitoring, secure remote access, and patch/compensating-control judgment under production constraints.
• Ability to take a network design through construction: fiber topologies, IDF and enclosure planning, and working productively with construction and cabling contractors.
• Ability to write requirements vendors can build to and auditors can verify, and to defend security decisions to both operations and compliance audiences.
• Must be a U.S. Person due to required access to U.S. export-controlled information or facilities.

Preferred Skills

• Formal IEC 62443 project experience (zone/conduit registers, security-level assessments) or NERC CIP program work that translates directly to it.
• Greenfield or major-expansion industrial network design, including construction-phase coordination.
• Field or professional-services background with an OT security platform or consultancy (Claroty, Dragos, Nozomi class, or an OT security practice).
• Defense industrial base, government-partnered, or otherwise compliance-driven manufacturing environments (CMMC, NIST 800-171/82).
• Experience selecting or managing a managed OT detection-and-response service.
• GICSP, ISA/IEC 62443 certificates, CISSP, CCNP, or equivalent credentials.
• Industrial wireless design and site RF survey experience.
• Familiarity with Rockwell/EtherNet/IP-centric plant architectures and industrial DMZ patterns.
• Experience in regulated industries such as Defense, Aerospace, or Automotive.

Physical and Environmental Requirements

• Regular presence on the production floor and ability to navigate all areas of the facility.
• Ability to climb stairs, stand and walk for extended periods, and work in environments that may be hot, humid, or noisy.
• Use of personal protective equipment, including respirators, and adherence to all applicable safety policies, procedures, and regulatory requirements.
• Ability to complete required fit testing, wear appropriate PPE for the duration of assigned tasks, and respond safely to changing conditions within the production environment.