Network Engineer: Control Center and Site Networks

You'll join Network Engineering & OT, the team that runs the networks QE Solar's operations depend on: our Scottsdale office, our 24/7 remote operations control center, our recovery site in New Jersey, and the connectivity to the solar and battery sites we monitor. The team owns the network, firewalls, VPN, backups and control-center infrastructure, and works alongside our SCADA, service desk and compliance teams.

Our control center is regulated under the NERC Critical Infrastructure Protection (CIP) standards. That shapes how we work: every change goes through change control with a tested rollback, access is granted only after clearance, and we keep the evidence that shows our controls work. If you have worked in a utility, generation, water or other regulated OT environment, you'll recognize it. If you haven't, we'll teach you, as long as you like working that way.

This is a network and infrastructure role. It is not a cloud, help desk or systems administration role.

The role:

• You own the control center's network end to end: its security perimeter, firewall rules, remote access and the documentation that proves it.

• You connect our generation sites to the control center, reliably and securely, and help the SCADA team keep that data flowing.

• You keep backups and recovery working, and prove it with tests.

• You find problems before anyone reports them, and fix the cause.

• Everything you run lives in a standard operating procedure (SOP) that a teammate is certified on, so anyone can cover.

Our environment:

* Locations: Scottsdale office and control center, NJ recovery site, 20+ generation sites across the country

• Network: next-generation firewalls at the control-center boundary, Ubiquiti switching, wireless and physical access control, site-to-site and remote-access VPN, carrier circuits

• Infrastructure: Proxmox and Hyper-V virtualization, Windows Server and Active Directory in the control center, image-based backup with replication to the recovery site

• Monitoring and security: file-integrity and configuration monitoring, centralized logging, SIEM with managed detection and response, DNS filtering

• Identity: Okta and Microsoft Entra ID

• Work and documentation: Jira (with Assets as the inventory of record), Confluence for SOPs, PagerDuty for on-call

What you'll own:

• Control-center perimeter. Design, configure and document firewall policy, network segmentation and the electronic security perimeter. Keep every rule justified and reviewed, and every port and service accounted for.

• Change control. Take network changes through change control: plan, risk, change record, configuration baseline update, tested rollback and post-change check. Changes to regulated systems are made only once you are authorized and trained.

• Daily security operations. Run the day-to-day security work for the control center and the systems you own: review logs and security alerts and act on what you find; administer accounts and privileged access, including periodic access reviews; check antivirus and endpoint protection status and clear failures; monitor firewall health, rule hits and blocked traffic. Record each check so the evidence is there when it's asked for.

• Patch management coordination. Coordinate patching across servers, hypervisors, firewalls, switches and other network appliances. Track vendor security releases, assess and schedule patches into maintenance windows, coordinate with SRE, SCADA and the control-center team, take each through change control, and verify and document the result.

• Remote access. Run site-to-site and remote-access VPN, with multi-factor authentication and an intermediate access layer for vendors and staff reaching control-center systems.

• Site connectivity. Build and support the connections from generation sites to the control center, including new sites and acquired portfolios. Work with the SCADA team and our SCADA partner on site network design and troubleshooting.

• Circuits and carriers. Order, cut over and troubleshoot carrier circuits and failover links, and hold carriers to their commitments.

• Backups and recovery. Run the weekly backup health checks, replication to the recovery site, and the BCP/DR tests, and fix what the tests find.

• Virtualization. Own the network side of our Proxmox and Hyper-V hosts, and support host lifecycle with the team.

• Monitoring and evidence. Keep monitoring, logging and baseline tooling healthy. Produce clean, dated evidence for internal reviews and audits without a scramble.

• Incidents. Lead network incidents through restoration and root cause. Support security incident response with our managed security partner. Take your turn in the after-hours on-call rotation.

• Automation and documentation. Script the repetitive work (config backups, rule reviews, health checks). Keep diagrams, the asset inventory and SOPs current, and certify teammates on them.

Your first 90 days:

• Day 30, learn and baseline: cleared for control-center access; certified on the core network, backup and DR SOPs; current network diagrams verified against the live configuration; shadowing on-call.

• Day 60, deliver: primary on-call; one firewall or network change delivered through change control with a tested rollback; one site connectivity issue resolved to root cause; one automated configuration backup or rule-review check running.

• Day 90, own and lead: led a DR test or tabletop; a firewall rule review completed with every rule justified or removed; the SOP set for your systems current, with a teammate certified on it; a six-month network roadmap approved by your manager.

Required:

• 4+ years in network engineering, including firewall administration in production

• Designed and managed firewall policy, NAT, segmentation and VPN (IPsec site-to-site and remote access) on an enterprise next-generation firewall

• Routing and switching in production: VLANs, static routing, OSPF or BGP, link failover

• Changes made through formal change control, with change records, configuration baselines and tested rollback plans

• Troubleshooting with packet captures and flow data (Wireshark, tcpdump or equivalent)

• Network documentation you built that others use: diagrams, port and service inventories, SOPs

• Scripting for network work (Python, PowerShell or Bash) that you wrote and still run

• Available for the after-hours on-call rotation

• Live within commuting distance of Scottsdale, AZ, or relocate before your start date. This role is on-site.

Preferred:

• Work in a regulated or OT environment: NERC CIP, utility, generation, water, oil and gas, or similar

• Ubiquiti UniFi; Proxmox or Hyper-V networking; image-based backup and replication

• Remote telemetry links for distributed sites: cellular, carrier MPLS or SD-WAN

• Supporting SCADA or industrial protocols (Modbus, DNP3) on the network side

• Certifications such as PCNSE, NSE 4, CCNP Enterprise or Security, or GICSP. We value certifications as a signal, but we hire and certify on demonstrated skill.

Other requirements:

• Authorized to work in the United States

• Able to pass a background check, including the personnel risk assessment required for access to regulated systems

• Occasional travel to the NJ recovery site and to generation sites

This position requires:

• Prolonged periods of sitting and working at a computer workstation, including monitoring SCADA systems, alarms, and operational dashboards.

• Ability to view multiple monitors simultaneously and maintain an elevated level of attention to detail over extended periods.

• Frequent use of hands and fingers to operate computers, keyboards, radios, and communication systems.

• Ability to communicate effectively, both verbally and in writing, including coordinating with field technicians, dispatch, and leadership.

• Ability to remain alert, responsive, and make timely decisions in a fast-paced, potentially high-pressure environment.

• Ability to work scheduled shifts, which may include nights, weekends, and holidays.

• Occasional standing, walking, and movement within the control center or facility.

• Ability to lift and carry items up to fifteen pounds, if necessary.

QE Solar offers incredible benefits! We enjoy:

• 100% paid employee premium on health benefits; additional dependents at low costs and great plans for Health, Dental, Vision, FSA, or HSA

• Wellbeing and Employee Assistance

• Learning & Development Opportunities

• Discounted Life & Disability Insurance