Network Security Governance & Architecture Engineer

Eaton’s Corporate Sector division is currently seeking a Network Security Governance & Architecture Engineer. The position will be based at our facility in Beachwood, Ohio. The role is eligible for a hybrid work setup (3 days in office, 2 days remote each week).

The expected annual salary range for this role is $146000 - $215000 a year. This position is also eligible for a variable incentive program.

Please note the salary information shown above is a general guideline only. Salaries are based upon candidate skills, experience, and qualifications, as well as market and business considerations.

The Network Security Governance & Architecture Engineer maintains a compliance and risk-based security strategy, architecture guardrails and control requirements that govern how Eaton's networks are designed, connected and defended - including emerging architectures such as SASE/SSE, SD-WAN, cloud and multi-cloud networking, ZTNA, private wireless/5G, edge and OT/IoT connectivity. The role translates threat intelligence, regulatory obligations, and Zero Trust principles into enforceable standards, reference designs and measurable assurance, and governs adoption through architecture review, exception management and risk reporting rather than day-to-day execution.

The engineer is the Cybersecurity authority for network security architecture, standards and compliance. Cybersecurity retains accountability for security requirements, architecture guardrails, control intent, compliance interpretation, assurance and risk oversight;
Infrastructure and Network Engineering retain responsibility for design implementation, configuration, maintenance and run-state operations;
Security Operations retains responsibility for detection engineering, tuning and 24x7 monitoring. This role sets the requirements and verifies outcomes - it does not operate the controls.

• Own network security standards, guardrails and reference architectures:
  Define requirements, approved patterns and target-state reference designs for segmentation, secure connectivity, remote access, network access control, firewall and policy management, DNS security, web/proxy controls, encrypted-traffic visibility and privileged network access. Maintain a published standards portfolio with clear ownership, review cadence, deviation criteria and a documented exception process.
• Translate threat intelligence into control strategy:
  Assess adversary tactics, techniques and procedures affecting enterprise, cloud, remote-access, product-connected and industrial network paths, and convert them into prioritized standard changes, control requirements and detection intent. Focus on the strategic requirements rather than the tuning of individual rules.
• Define detection requirements and validate coverage:
  Specify the network telemetry, logging standards and detection use cases required across SIEM, NDR, firewall, proxy, DNS, VPN and SASE/SSE platforms, and validate that coverage exists for priority attack paths. Partner with Security Operations - who builds and tunes the detection content - to close telemetry and coverage gaps and to correlate network signal with identity, endpoint and cloud events.
• Direct risk-informed threat hunting:
  Set hunt priorities and hypotheses based on MITRE ATT&CK, Eaton's threat profile and known architectural weaknesses; sponsor and review hunts executed with Security Operations; and convert findings into standards, control and telemetry improvements with tracked owners.
• Advance Zero Trust and segmentation strategy:
  Own the multi-year target-state model for trust boundaries, microsegmentation, least-privilege connectivity and containment across IT, cloud, OT and product-connected networks. Define maturity milestones,…