Operational Technology Controls and Automation Engineer

Position Summary

The Operational Technology Controls and Automation Engineer serves as the key technical lead bridging physical warehouse automation, industrial cybersecurity, and operational execution across the distribution network. This role is responsible for driving the continuous improvement, stability, and security posture of all on-site Operational Technology (OT) - including Material Handling Equipment (MHE/conveyors/sorters/ASRS), Cold Chain/Refrigeration controls, Building Management Systems (BMS), and facility safety infrastructure.

Functioning as a technical owner and influencer, this role collaborates directly with Divisional DC Maintenance, Enterprise IT/GTS, Security Operations, and external OEM vendors to enforce OT network segmentation, optimize real-time WCS/WES execution logic, and guarantee high availability without compromising floor throughput or physical safety.

• Zero-Trust Floor Architecture & Segmentation:
  Partners with Enterprise Security to design, deploy, and enforce Layer 7 network segmentation (e.g., Palo Alto / Prisma Access) between OT subnets and enterprise VLANs, protecting OT/ICS environments from enterprise threats without impacting operational continuity.
• Secure Vendor Remote Access (SASE/ZTNA):
  Leads the leads the deployment and execution of technical migration from legacy VPNs to modern Zero Trust Network Access (ZTNA) and SASE jump-box portals, establishing strict access governance for third‑party automation and refrigeration providers.
• OT Visibility, Telemetry & NDR:
  Manages Network Detection and Response and OT visibility platforms (e.g., Armis, Cisco Cyber Vision, Vectra), maintaining real-time asset inventories and threat detection across cloud and floor environments.
• Automated Incident Containment ("Red Button"):
  Operationalizes and executes pre-approved "break-glass" containment playbooks with Sec Ops to isolate compromised warehouse segments or malicious vendor tunnels at machine speed during cyber threats without causing self-inflicted plant outages.
• Network Security Architecture & Enterprise Governance
  • Zero Trust Reference Architectures:
    Partners with GTS teams to develop and maintain network security design patterns, engineering standards, and implementation roadmaps supporting Zero Trust, SASE, cloud migration, and business objectives.
  • Unified Segmentation Strategy:
    Partners with other GTS and Security teams and oversees a global segmentation model utilizing Next‑Gen Firewalls (NGFWs), micro‑segmentation, and cloud‑native security controls across cloud, data center, partner networks, and site locations.
  • Cross‑Functional Infrastructure Alignment:
    Partners with Cloud, On‑Prem Network, and IAM teams to integrate identity attributes, device posture, and directory services into dynamic access policies across SD‑WAN and enterprise transit layers.
  • Infrastructure as Code (IaC) & Policy Automation:
    Implements IaC and policy‑as‑code solutions to automatically deploy, validate, and audit network security controls across hybrid environments.
• System Health, Resiliency & Disaster Recovery
  • High Availability & Virtual Patching:
    Establishes edge firewall virtual patching and threat prevention profiles (IPS/App-) to mitigate vulnerabilities on legacy PLCs and controllers that cannot accept direct firmware patches.
  • Local HA/DR Verification:
    Owns point‑in‑time backup integrity and disaster recovery protocols for PLC ladder logic, SCADA configurations, and local execution databases to satisfy corporate Recovery Point (RPO) and Recovery Time (RTO) objectives.
  • Complex Root‑Cause Triage:
    Serves as senior technical escalation support during complex automation stoppages and cybersecurity incidents, troubleshooting fieldbus communications (Profinet, Ether…