Network Security Governance & Architecture Engineer

What you’ll do:

• Own network security standards, guardrails and reference architectures: Define requirements, approved patterns and target-state reference designs for segmentation, secure connectivity, remote access, network access control, firewall and policy management, DNS security, web/proxy controls, encrypted-traffic visibility and privileged network access. Maintain a published standards portfolio with clear ownership, review cadence, deviation criteria and a documented exception process.
• Translate threat intelligence into control strategy: Assess adversary tactics, techniques and procedures affecting enterprise, cloud, remote-access, product-connected and industrial network paths, and convert them into prioritized standard changes, control requirements and detection intent. Focus on the strategic requirements rather than the tuning of individual rules.
• Define detection requirements and validate coverage: Specify the network telemetry, logging standards and detection use cases required across SIEM, NDR, firewall, proxy, DNS, VPN and SASE/SSE platforms, and validate that coverage exists for priority attack paths. Partner with Security Operations - who builds and tunes the detection content - to close telemetry and coverage gaps and to correlate network signal with identity, endpoint and cloud events.
• Direct risk-informed threat hunting: Set hunt priorities and hypotheses based on MITRE ATT&CK, Eaton's threat profile and known architectural weaknesses; sponsor and review hunts executed with Security Operations; and convert findings into standards, control and telemetry improvements with tracked owners.
• Advance Zero Trust and segmentation strategy: Own the multi-year target-state model for trust boundaries, microsegmentation, least-privilege connectivity and containment across IT, cloud, OT and product-connected networks. Define maturity milestones, sequencing and adoption criteria, and partner with Infrastructure and Enterprise Architecture to align secure designs with operational and business requirements.
• Run the network control assurance program: Establish a repeatable, risk-based program to verify that required network controls are implemented and effective - including control testing scope, evidence standards, configuration and exposure-path review, exception governance and aging, and remediation prioritization based on exploitability and business impact. Report results into governance forums with accountable owners.

Qualifications:

Basic Qualifications:
• Bachelor’s degree from an accredited institution
• Minimum 10+ years of experience in information security, network engineering or security architecture
• Minimum 4 years’ experience in setting security standards, architecture requirements or governance for enterprise networks.
• Eaton will not consider applicants for employment immigration sponsorship or support for this position. This means that Eaton will not support any CPT, OPT, or STEM OPT plans, F-1 to H-1B, H-1B cap registration, O-1, E-3, TN status, I-485 job portability, etc.
• No relocation benefit is being offered for this position. Only candidates within a 50-mile radius of the work location will be considered. Active-Duty Military Service member candidates are exempt from the geographical area limitation.

Preferred Qualifications:

• Master’s degree in Cybersecurity, Information Assurance, Computer Science from an accredited institution
• Professional certifications such as CISSP (ISSAP preferred), CCSP, CISM, SABSA or TOGAF, GIAC GCIA/GCIH/GDSA, or vendor credentials from Cisco, Zscaler, Palo Alto Networks or Check Point.
• Experience designing or validating Zero Trust network architectures, microsegmentation and software-defined perimeter or zero-trust network access controls.
• Experience defining security requirements for emerging network architectures — SASE/SSE migrations, SD-WAN, private 5G/enterprise wireless, cloud-native and multi-cloud networking, service mesh, edge/satellite connectivity, IPv6 and network-as-code pipelines.
• Familiarity with emerging regulatory drivers relevant to a global manufacturer — EU NIS2, the EU Cyber Resilience Act, IEC 62443, SEC cyber-disclosure rules, CMMC and data-sovereignty/cross-border data-flow requirements.
• Proficiency with network and security platforms such as Zscaler, Check Point, Microsoft Sentinel or Defender, CrowdStrike, network detection and response tools, packet-capture utilities and firewall policy-management solutions.

Skills:

Position Criteria:

• Working knowledge of adversary behavior and frameworks such as MITRE ATT&CK, plus incident response and threat-hunting practices.
• Demonstrated ability to author enterprise security standards, reference architectures, control requirements, test procedures and risk-based recommendations that survive audit scrutiny.
• Working knowledge of security and regulatory frameworks applicable to networks (NIST CSF, NIST SP 800-53 and SP 800-207, ISO 27001, CIS Controls, PCI DSS) and experience producing compliance evidence.
• Experience influencing architecture and design decisions through governance forums such as architecture review boards, exception and risk committees.
• Excellent written and verbal communication skills, including the ability to explain technical risks and requirements to engineering, operations and business stakeholders.• Deep working knowledge of enterprise and modern network architectures, including routing and switching, firewalls, proxies, VPN, DNS, NAC, segmentation, secure remote access, SASE/SSE, SD-WAN, ZTNA and cloud/hybrid network services.
• Experience defining telemetry, detection and logging requirements and interpreting network security data from SIEM, NDR, packet analysis or comparable platforms.

Success Measures:

• Network security standards, guardrails and reference architectures are current, practical, testable and demonstrably adopted by accountable operating teams.
• Network telemetry and detection coverage improve for priority threats, critical assets and high-risk attack paths.
• Threat intelligence and hunt findings are translated into effective detections, control improvements and tracked remediation.
• Segmentation, containment and secure-connectivity controls measurably reduce lateral movement and blast-radius risk.
• Exceptions and control gaps have clear owners, risk context, remediation plans and aging visibility.
• Incident-response teams receive timely network analysis and reusable improvements from investigations and exercises.
• New network technologies and architectures are adopted only with approved security requirements, documented risk decisions and defined guardrails in place before deployment.
• Network-related audit, regulatory and customer-assessment findings are minimal, and required compliance evidence is produced on demand without ad-hoc effort.
• The Zero Trust and segmentation target-state roadmap shows measurable year-over-year progress against defined maturity milestones.