Network Engineer

CSC Sugar, together with its Sugaright business, is a sugar refining and commodity trading company headquartered in Westport, Connecticut. We run refining, liquid sugar and distribution operations across more than ten sites in the United States, Mexico and Colombia, and our IT team of four supports more than 300 users across all of them. The network is what keeps plants shipping, traders trading and customers receiving orders, so this role matters to the business every day.

We are looking for a Network Engineer to own the company network end to end. This is a hands‑on role with real authority: you will design, build, secure, document and support our firewalls, switching, wireless, WAN and cloud networking, and you will be the person the team and the business rely on when something breaks.

Our security edge runs on Cisco Firepower Threat Defense (FTD), managed through Firepower Management Center (FMC), and we are completing a migration off legacy Cisco ASA firewalls. Our server workloads run in AWS, and our identity platform is Microsoft Entra , current experience with FMC/FTD and AWS networking is required.

This role owns the CSC Sugar network: all of it, at every site and in AWS. If a firewall, switch, circuit, tunnel or cloud connection goes down, you are accountable for getting it back and for making sure it does not happen again.

• On call 24/7. Serve as the primary escalation point for all network outages and degradations across every site and AWS. You must be reachable and able to respond remotely at any time, including nights, weekends and holidays.
• End‑to‑end ownership. Take incidents from detection through resolution, carrier and vendor escalation, user communication and a written root‑cause analysis, without needing to be directed.
• Remote readiness. Keep monitoring, alerting, documentation and out‑of‑band access in a state where you can diagnose any site remotely.
• Planned coverage. Arrange and hand off coverage in advance of planned time off, so the network is never without an owner.

• Administer Cisco FTD appliances at all sites through FMC, including access control, NAT, prefilter, intrusion and file policies, platform settings and device health.
• Build and maintain route‑based and policy‑based site‑to‑site VPNs between headquarters, plants, distribution sites and AWS.
• Stand up new and refreshed site firewalls from a documented standard build, not a cloned config, covering WAN interfaces, DHCP, routing, VPN and policy.
• Plan and run FMC policy deployments with change control, pre‑checks and a rollback plan.
• Support the rollout and operation of Cisco Secure Access (SSE) as the replacement for Cisco Umbrella, including DNS security, secure internet access and remote access.

• Maintain the remaining Cisco ASA firewalls until they are retired, including ACLs, NAT, Any Connect/Secure Client and site‑to‑site tunnels.
• Lead ASA‑to‑FTD migrations site by site, including config translation, cutover planning, testing and post‑cutover validation.
• Own the refresh roadmap for end‑of‑life firewalls and switches, including sizing, bill of materials, scheduling and on‑site installs.

• Design and support Cisco enterprise switching at every site: VLANs, trunking, spanning tree, port security, PoE and access‑layer standards.
• Manage WAN and internet circuits across multiple carriers, including primary and backup failover, BGP and static routing, and carrier escalation.
• Support plant‑floor and OT network segments in coordination with site operations.
• Maintain IP addressing, DHCP and DNS standards across the enterprise.

• Desig…