Network Security Governance & Architecture Engineer

Eaton’s Corporate Sector division is currently seeking a Network Security Governance & Architecture Engineer. The position will be based at our facility in Beachwood, Ohio. The role is eligible for a hybrid work setup (3 days in office, 2 days remote each week).

The expected annual salary range for this role is $146000 - $215000 a year. This position is also eligible for a variable incentive program.

Please note the salary information shown above is a general guideline only. Salaries are based upon candidate skills, experience, and qualifications, as well as market and business considerations.

The Network Security Governance & Architecture Engineer maintains a compliance and risk-based security strategy, architecture guardrails and control requirements that govern how Eaton's networks are designed, connected and defended - including emerging architectures such as SASE/SSE, SD-WAN, cloud and multi-cloud networking, ZTNA, private wireless/5G, edge and OT/IoT connectivity. The role translates threat intelligence, regulatory obligations, and Zero Trust principles into enforceable standards, reference designs and measurable assurance, and governs adoption through architecture review, exception management and risk reporting rather than day-to-day execution.

The engineer is the Cybersecurity authority for network security architecture, standards and compliance. Cybersecurity retains accountability for security requirements, architecture guardrails, control intent, compliance interpretation, assurance and risk oversight; Infrastructure and Network Engineering retain responsibility for design implementation, configuration, maintenance and run-state operations; Security Operations retains responsibility for detection engineering, tuning and 24x7 monitoring. This role sets the requirements and verifies outcomes - it does not operate the controls.

What you’ll do:

• Own network security standards, guardrails and reference architectures: Define requirements, approved patterns and target-state reference designs for segmentation, secure connectivity, remote access, network access control, firewall and policy management, DNS security, web/proxy controls, encrypted-traffic visibility and privileged network access. Maintain a published standards portfolio with clear ownership, review cadence, deviation criteria and a documented exception process.
• Translate threat intelligence into control strategy: Assess adversary tactics, techniques and procedures affecting enterprise, cloud, remote-access, product-connected and industrial network paths, and convert them into prioritized standard changes, control requirements and detection intent. Focus on the strategic requirements rather than the tuning of individual rules.
• Define detection requirements and validate coverage: Specify the network telemetry, logging standards and detection use cases required across SIEM, NDR, firewall, proxy, DNS, VPN and SASE/SSE platforms, and validate that coverage exists for priority attack paths. Partner with Security Operations - who builds and tunes the detection content - to close telemetry and coverage gaps and to correlate network signal with identity, endpoint and cloud events.
• Direct risk-informed threat hunting: Set hunt priorities and hypotheses based on MITRE ATT&CK, Eaton's threat profile and known architectural weaknesses; sponsor and review hunts executed with Security Operations; and convert findings into standards, control and telemetry improvements with tracked owners.
• Advance Zero Trust and segmentation strategy: Own the multi-year target-state model for trust boundaries, microsegmentation, least-privilege connectivity and containment across IT, cloud, OT and product-connected networks. Define maturity milestones, sequencing and adoption criteria, and partner with Infrastructure and Enterprise Architecture to align secure designs with operational and business requirements.
• Run the network control assurance program: Establish a repeatable, risk-based program to verify that required network controls are implemented and effective - including control testing scope, evidence standards, configuration and exposure-path review, exception governance and aging, and remediation prioritization based on exploitability and business impact. Report results into governance forums with accountable owners.

Qualifications:

Basic Qualifications:

• Bachelor’s degree from an accredited institution

• Minimum 10+ years of experience in information security, network engineering or security architecture
• Minimum 4 years’ experience in setting security standards, architecture requirements or governance for enterprise networks.
• Eaton will not consider applicants for employment immigration sponsorship or support for this position. This means that Eaton will not support any CPT, OPT, or STEM OPT plans, F-1 to H-1B, H-1B cap registration, O-1, E-3, TN status, I-485 job portability, etc.
• No relocation benefit is being offered for this position. Only candidates within a 50-mile radius of the work location will be considered. Active-Duty Military Service member candidates are exempt from the geographical area limitation.

Preferred Qualifications:

• Master’s degree in Cybersecurity, Information Assurance, Computer Science from an accredited institution
• Professional certifications such as CISSP (ISSAP preferred), CCSP, CISM, SABSA or TOGAF, GIAC GCIA/GCIH/GDSA, or vendor credentials from Cisco, Zscaler, Palo Alto Networks or Check Point.
• Experience designing or validating Zero Trust network architectures, microsegmentation and software-defined perimeter or zero-trust network access controls.
• Experience defining security requirements for emerging network architectures - SASE/SSE migrations, SD-WAN, private 5G/enterprise wireless, cloud-native and multi-cloud networking, service mesh, edge/satellite connectivity, IPv6 and network-as-code pipelines.
• Familiarity with emerging regulatory drivers relevant to a global manufacturer - EU NIS2, the EU Cyber Resilience Act, IEC 62443, SEC cyber-disclosure rules, CMMC and data-sovereignty/cross-border data-flow requirements.
• Proficiency with network and security platforms such as Zscaler, Check Point, Microsoft Sentinel or Defender, CrowdStrike, network detection and response tools, packet-capture utilities and firewall policy-management solutions.

Skills:

Position Criteria:

• Working knowledge of adversary behavior and frameworks such as MITRE ATT&CK, plus incident response and threat-hunting practices.
• Demonstrated ability to author enterprise security standards, reference architectures, control requirements, test procedures and risk-based recommendations that survive audit scrutiny.
• Working knowledge of security and regulatory frameworks applicable to networks (NIST CSF, NIST SP 800-53 and SP 800-207, ISO 27001, CIS Controls, PCI DSS) and experience producing compliance evidence.
• Experience influencing architecture and design decisions through governance forums such as architecture review boards, exception and risk committees.
• Excellent written and verbal communication skills, including the ability to explain technical risks and requirements to engineering, operations and business stakeholders.• Deep working knowledge of enterprise and modern network architectures, including routing and switching, firewalls, proxies, VPN, DNS, NAC, segmentation, secure remote access, SASE/SSE, SD-WAN, ZTNA and cloud/hybrid network services.
• Experience defining telemetry, detection and logging requirements and interpreting network security data from SIEM, NDR, packet analysis or comparable platforms.

Success Measures:

• Network security standards, guardrails and reference architectures are current, practical, testable and demonstrably adopted by accountable operating teams.
• Network telemetry and detection coverage improve for priority threats, critical assets and high-risk attack paths.
• Threat intelligence and hunt findings are translated into effective detections, control improvements and tracked remediation.
• Segmentation, containment and secure-connectivity controls measurably reduce lateral movement and blast-radius risk.
• Exceptions and control gaps have clear owners, risk context, remediation plans and aging visibility.
• Incident-response teams receive timely network analysis and reusable improvements from investigations and exercises.
• New network technologies and architectures are adopted only with approved security requirements, documented risk decisions and defined guardrails in place before deployment.
• Network-related audit, regulatory and customer-assessment findings are minimal, and required compliance evidence is produced on demand without ad-hoc effort.
• The Zero Trust and segmentation target-state roadmap shows measurable year-over-year progress against defined maturity milestones.

All positions may require participation in video and in-person interviews as part of the hiring process. All candidates will be evaluated based on job-related competencies, and all candidates’ privacy rights and data security will be protected in accordance with applicable laws.

We are committed to ensuring equal employment opportunities for all job applicants and employees. Employment decisions are based upon job-related reasons regardless of an applicant's race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, marital status, genetic information, protected veteran status, or any other status protected by law.

Eaton believes in second chance employment. Qualified applicants with arrest or conviction history will be considered regardless of their arrest or conviction history, consistent with the Los Angeles County Fair Chance Ordinance, the California Fair Chance Act and other local laws.

You do not need to disclose your conviction history or participate in a background check until a conditional job offer is made to you. After making a conditional offer and running a background check, if Eaton is concerned about conviction that is directly related to the job, you will be given the chance to explain the circumstances surrounding the conviction, provide mitigating evidence, or challenge the accuracy of the background report.

To request a disability-related reasonable accommodation to assist you in your job search, application, or interview process, please call us at 1-800-836-6345 to discuss your specific need. Only accommodation requests will be accepted by this phone number.

We know that good benefit programs are important to employees and their families. Eaton provides various Health and Welfare benefits as well as Retirement benefits, and several programs that provide for paid and unpaid time away from work. Click here for more detail: Eaton Benefits Overview. Please note that specific programs and options available to an employee may depend on eligibility factors such as geographic location, date of hire, and the applicability of collective bargaining agreements.