Sr Principal Network Engineer

Company Overview

CB&I delivers integrated storage and asset‑management solutions that help customers operate safely, reliably, and efficiently across the lifecycle of their facilities. Through two global business units – Storage Solutions, the world leader in tanks, terminals, and storage systems, and Asset Solutions, a leading provider of operations, management, wells and decommissioning services – we combine technical excellence with execution capability to extend asset life, optimize performance, and maximize value.

CB&I® is the most experienced and the only worldwide builder and designer of industrial storage products and facilities. Headquartered in Houston, Texas, CB&I has the global expertise and strategically located operations to provide engineering, procurement and construction solutions for our customers’ most complex energy projects.

About the Role

The Senior Principal Technology Specialist – Senior Network Engineer addresses complex, high‑impact challenges by combining strategic vision with hands‑on expertise. An expert in data communications and network security, this individual architects, secures, and scales data and firewall solutions while guiding the direction and resource allocation of projects and programs. This Individual Contributor role reports directly to the Director, Information Technology Infrastructure and routinely interacts with Global IT, Business Leads, Project Management, Engineering, and Operations.

Responsibilities

• Develop and execute a strategic vision for enterprise and data‑center networks, security perimeters, and telecommunications environments by leveraging innovative technologies, implementing industry best practices, and driving continuous improvement to optimize service delivery and elevate customer satisfaction.
• Design, configure, implement, and maintain secure, scalable, and resilient network infrastructure, firewalls, security perimeters, wireless networks, cloud environments, third‑party integrations, security tools, SASE, and supporting auxiliary systems such as monitoring, DHCP, and DNS.
• Collaborate with IT teams, cross‑functional teams, and third parties to gather business requirements, assist with business plan development, and implement technologies such as integrated innovative network infrastructure, security controls, cloud solutions, and applications, ensuring seamless and future‑ready operation across the organization.
• Execute a wide range of network and security initiatives, including deploying and integrating technologies across the global enterprise to securely manage data traffic flows and access management for systems and applications.
• Engineer, deploy, and operate monitoring tools to enable visibility, control, proactive mitigation, system health, and operational effectiveness.
• Analyze network performance data and implement strategies to optimize system performance, including bandwidth utilization, network throughput, routing, call quality, hardware/software tuning, application filtering, and response times.
• Design and implement predictive and preventive system maintenance techniques, including lifecycle management strategies.
• Design and implement integration services with third‑party systems, IAM, cloud services, next‑generation firewalls, DNS services, WAF, CDN, and SaaS.
• Adapt leading security frameworks (NIST, CIS, ISO, CSA, and CB&I‑specific controls) to enhance cybersecurity effectiveness.
• Develop and implement robust security policies, processes, and technology systems specific to network, firewalls, security perimeters, and telecommunications domains in collaboration with the Cybersecurity team.
• Develop, review, maintain, and disseminate comprehensive documentation—including configuration details, changes, troubleshooting guides, SOPs, business processes, and runbooks—to ensure operational clarity and compliance.
• Leverage network, cybersecurity, and telecommunications governance expertise to develop and enforce policies and procedures that support continuous improvement and compliance.
• Serve as a subject‑matter expert, mentoring global IT staff, delivering technical and operational cross‑training, and providing advanced support for problem‑solving and root‑cause analysis.
• Collaborate with Disaster Recovery and Business Continuity stakeholders to design, implement, and maintain comprehensive disaster recovery plans and strategies, ensuring continuous availability and resilience of network, firewall, security perimeter, and VoIP/telephony services during outages, natural disasters, or cybersecurity incidents.

Qualifications

• Minimum bachelor’s degree in Computer Science, Computer Engineering, Management Information Systems, or related field, or equivalent work experience.
• Preferred 15+ years of LAN/WAN, enterprise, and data‑center network, routing, switching, and wireless experience.
• Minimum 8 years designing, configuring, and maintaining Palo Alto or Cisco firewall policies, security rules, NAT, VPNs (IPSec/SSL), and application‑based filtering.
• Security‑appliance experience integrating firewalls and security solutions with SIEM, IDPS/IPS, and threat intelligence; centralized firewall administration and policy orchestration using tools such as Panorama; conducting rule‑base and configuration reviews for audit and control compliance.
• Minimum 4 years of cloud network and infrastructure technologies experience.
• Experience designing, configuring, and implementing unified communications (VoIP, telephony on‑prem and cloud, conference systems, third‑party telephony integration, SIP, PSTN) is a plus.
• Preferred certifications or equivalents: Cisco CCNP Enterprise or Security, PCNSE, Microsoft Azure Network, Network+.
• In‑depth experience with converged global network infrastructure: Cisco IOS, NX‑OS, 802.1x, BGP, OSPF, EIGRP, MPLS, VPNs, DMVPN, SD‑WAN, ACLs, LAN, WAN, firewalls, SASE, wireless.
• Proficiency with networking and security tools such as NetBrain, ThousandEyes, SecureCRT, Wireshark, MS Visio, PRTG, Infoblox, IPFIX aggregator, and log collectors.
• Experience planning and migrating acquisitions, divestitures, on‑premises systems, SaaS, facilities, firewalls, and cloud services.
• Ability to diagnose and resolve network, firewall, application flow, and telecommunication issues using diagnostic tools and techniques.
• Proven ability to produce illustrative design documentation covering licensing, physical architecture, logical configuration, inventory checklists, security policy phases, and baseline configurations.
• Extensive experience supporting routers, switches, firewalls, web application firewalls, load balancers, DNS, email gateways, proxy services, VPN, LAN, WAN, cryptographic devices, and associated automation systems.
• Experience configuring and deploying TACACS, Cisco DNA Center, Cisco ISE, Cisco Prime, SD‑WAN, load balancers, WAF, Palo Alto Panorama, or similar centralized firewall and cloud security management platforms.
• Specific hardware experience: Cisco ISR 4331, 8500, 2911, 8300; Palo Alto 3000, 4000, Panorama; Cisco 9300, 9200, 8200, 4500, 3850, 2960 series; Cisco Nexus 7k/5k/2k; Cisco AP & WLC, Aruba AP & WLC, Meraki AP & MG cellular wireless.
• SD‑WAN and SASE experience: Cisco Meraki MX, Palo Alto Prisma SD‑WAN, Cisco Secure Access, Secure Connect.
• Routing protocol expertise: BGP, OMP, EIGRP, RIP, MP‑BGP, VRF, redistribution, static routing.
• Switching protocol expertise: STP, RSTP, PVSTP, VTP, VPC, ARP, HSRP, VRRP, GLBP, VLAN, VXLAN, inter‑VLAN routing.
• Supporting features knowledge: IP subnetting, VLSM, DHCP, DNS, NAT, PAT, IPsec, ACL, VRF, VSS, QoS, VXLAN, SSH, LDAP integration, DNS filtering, 802.1x, MAC authentication, certificates.
• History of delivering Tier 3 and Tier 4 support and acting as an escalation point across enterprise and data‑center networks, telecommunications, and cloud services.
• Experience delivering configuration and build patterns for TCP/IP networking, cloud load balancers, application gateways, security groups, VNETs/Subnets, VPN gateways, private links/endpoints, ExpressRoute, route tables, DNS, traffic manager, and NAT configuration.
• Experience managing, diagnosing, and resolving Internet circuits, WAN, MPLS, point‑to‑point networks, SIP trunks, and SIP services.
• Familiarity with external and internal audit processes regarding IT designs, services, and configuration changes.
• Proficiency with automation tools and scripting languages (e.g., Python, PowerShell/Automate).
• Experience regularly evaluating LAN, WLAN, WAN, firewall, security zones, telephony systems, cloud environments, enterprise network, and data‑center infrastructure performance to proactively troubleshoot and implement solutions that minimize downtime.

Skills and Behaviors

• Provide technical leadership while building and nurturing strong partnerships across business, engineering, security, and operations teams, consistently upholding the organization’s vision, core values, and business principles.
• Proactively embrace and promote the company’s values and culture, including diversity & inclusion and a healthy, safe work environment.
• Strong knowledge of hardware and software configuration using hands‑on methods and scripting; systems in scope include network hardware/software, telecommunications, cloud services, third‑party integrations, and security tools.
• Excellent assessment and analytical expertise to interpret outputs from monitoring and reporting tools, enabling proactive identification of potential problem areas and implementation of targeted risk‑mitigation solutions.
• Extensive knowledge in the design, implementation, and lifecycle management of seamless communication across multiple platforms, including video teleconferencing (VTC), telecommunication networks, security controls, cloud environments, and SaaS services.
• Strong understanding of networking concepts, network virtualization technologies (SDN, VPNs), protocols, and technologies such as TCP/IP, IPsec, DNS, DHCP, BGP, LAN/WAN, routing, switching, and wireless networks.
• Deep understanding of Cisco UC VoIP, VTC solutions, PSTN, SIP gateways, SBC, QoS, Microsoft Teams Calling, auto attendant, dial peers, Microsoft Direct Routing, and third‑party VoIP/SIP integration.
• In‑depth understanding of network security principles and best practices, including firewalls, intrusion detection systems, access controls, encryption techniques, enterprise and data‑center networks, cloud infrastructure, VoIP, third‑party integration, and wireless security.
• Strong knowledge