Senior Network Engineer, Network Access Security

Rockwell Automation is a global technology leader focused on helping the world’s manufacturers be more productive, sustainable, and agile. With more than 28,000 employees who make the world better every day, we know we have something special. Behind our customers - amazing companies that help feed the world, provide life-saving medicine on a global scale, and focus on clean water and green mobility - our people are energized problem solvers that take pride in how the work we do changes the world for the better.

We welcome all makers, forward thinkers, and problem solvers who are looking for a place to do their best work. And if that’s you we would love to have you join us!

Job Description As a Senior Network Engineer, Network Access Security, you will join our enterprise network and security engineering team. In this role you will help own the design, security, and reliability of how every user and device gets onto our global network. The work spans network access control, identity based authentication, and network segmentation. The majority of our network access policy is built and enforced in Forescout, with Cisco Identity Services Engine (ISE) handling device administration, across our AMER, EMEA, and APAC regions.

This is our Zero Trust program for the network. You will partner directly with our senior network access engineer as a peer, sharing a program that today runs across three regions and hundreds of sites. You will take real ownership of a share of that estate rather than shadowing someone else's, and you will help move the program from reactive lifecycle work toward a deliberate segmentation and Zero Trust build.

This is a hands on engineering role for someone who has lived inside network access policy and RADIUS logs, knows why a supplicant is failing 802.1X, and can tighten access without taking a plant or an office offline. You will report to the IT Manager, Network and Security Engineering, and will work Hybrid in any of RA office based in Milwaukee or Mequon, WI OR Mayfield Heights, OH OR Chelmsford, MA or Eden Prairie, MN.Primary

Responsibilities Network access control and 802.1X (primary focus of the role):
Design, deploy, and operate 802.1X and MAB authentication for wired and wireless access across the global estate, for both corporate and manufacturing environments. Build and tune Cisco ISE policy sets, authentication and authorization rules, posture, profiling, and dynamic VLAN and downloadable ACL assignment. Troubleshoot complex access failures end to end, from the supplicant and switch port through RADIUS to the ISE policy decision, including hard to place devices such as OT and industrial endpoints.

Cisco ISE platform engineering and lifecycle:
Own deployment, upgrades, patching, and certificate lifecycle for the distributed ISE estate, including policy and monitoring nodes across regions. Manage the certificate and PKI dependencies that ISE and RADIUS rely on, including EAP, DTLS, and administration certificates. Respond to ISE and NAC security advisories and drive timely, low risk remediation. Forescout and device visibility:
Operate and extend Forescout for device discovery, classification, and policy enforcement, including ACL writing enablement as sites are brought under control. Keep access policy aligned with an accurate, current picture of what is actually on the network. Network segmentation and Zero Trust:
Design and implement network segmentation using VLANs, access control lists, and group based policy to limit lateral movement and contain risk. Help define and advance the Zero Trust roadmap for network access, turning strategy into deployed, measurable control. AAA, access layer, and operations:
Manage RADIUS and TACACS+ for authentication and…