About this opportunity
Ziggurat Automation Inc. lists this OT Network & Cybersecurity Engineer opportunity in sacramento, California. Review the employer’s description below for duties, qualifications and application requirements.
Job description
OT network hardening: RBAC, allow-listing, unused protocol disabling, device hardening baselines
Integration & Controls
Coming Soon Senior Engineer
ZA-31013
Sacramento, CA (Hybrid)
Hybrid
Compensation discussed during final conversation
Why This Role Exists
Every IEC 61850 GOOSE message, every DNP3 poll, and every Modbus register read travels across an industrial Ethernet network that must be both reliable and secure. This role exists because PRP dual-star network design, IEC 62443 zone/conduit architecture, and OT-specific cybersecurity require an engineer who understands both network infrastructure and protection system communication requirements. You design and harden the OT network that carries protection traffic - VLAN segmentation, QoS for GOOSE prioritization, PRP failover, ACL enforcement, and standards alignment across IEC 62443, NERC CIP, NIST 800-82, and IEEE 1686.
What You Own
PRP dual-star network architecture: distribution and industrial edge switch topology, DANP endpoint assignments, QoS for GOOSE traffic
IEC 62443 zone/conduit design: security zone architecture, VRF/VLAN segmentation, ACL-based zone boundary control
OT network hardening: RBAC on RTACs/relays/switches/HMI, allow-listing policies, unused protocol disabling
Cybersecurity standards alignment: IEC 62443, NERC CIP (concepts), NIST SP 800-82, IEEE 1686 - hardening baselines per device type
Network monitoring integration: Nozomi or Claroty deployment for OT traffic visibility and anomaly detection
Logging and forensics architecture: SOE audit trails, time-synchronized logging to SIEM or dual historian
Systems You'll Touch
Vendor Platforms: Cisco SEL
Software Tools: Wireshark Nozomi Networks Claroty AcSELerator RTAC
Standards: IEC 62443 IEC 62439-3 (PRP/HSR) NERC CIP IEEE 1686 IEC 61850
Protocols: SNMP IRIG-B
What Success Looks Like
First 90 Days
Reviewed existing OT network architecture on an active project - topology, VLAN assignments, security posture
Produced a zone/conduit diagram or network hardening baseline for a protection network scope
Assessed PRP network configuration: dual-plane separation, GOOSE multicast delivery, failover readiness
First 180 Days
Owning OT network design scope on at least one project - PRP architecture, VLAN/VRF, QoS, ACLs
Cybersecurity alignment documentation delivered against IEC 62443 and at least one additional standard
Network hardening applied to RTACs, relays, and switches with RBAC and allow-listing verified
Required Background
7+ years OT network engineering or cybersecurity for industrial control systems or critical infrastructure
Industrial Ethernet network design: VLAN/VRF segmentation, QoS, managed industrial Ethernet switch configuration
IEC 62443 zone/conduit model implementation - security zone architecture, boundary enforcement
OT network hardening: RBAC, allow-listing, unused protocol disabling, device hardening baselines
Network protocol analysis: Wireshark for GOOSE, DNP3, Modbus, SNMP traffic
Understanding of PRP or HSR per IEC 62439-3 for redundant industrial Ethernet
Preferred Background
IEC 61850 GOOSE communication architecture awareness - QoS requirements for protection traffic
Nozomi Networks or Claroty deployment for OT monitoring
NERC CIP compliance mapping for power systems or adapted federal facility context
NIST SP 800-82 (ICS security) and IEEE 1686 (substation IED cybersecurity)
Cisco managed distribution and industrial Ethernet switch configuration
What to Expect in the Field
Travel 20-40% for network deployment, commissioning support, and security assessments
Site Hours Standard office hours for design; site hours during network deployment and PRP commissioning
Customer-Facing Interface with prime contractor network engineers, facility IT/OT teams, and cybersecurity stakeholders
Documentation Heavy - network architecture diagrams, zone/conduit documentation, hardening baselines, standards alignment matrices, ACL rule sets
Field Safety Minimal direct electrical exposure; NFPA 70E awareness for switchgear-adjacent network equipment
Why Ziggurat
OT cybersecurity for protection networks - your security architecture protects the systems that protect the power infrastructure
PRP dual-star with IEC 61850 GOOSE in production - real zero-SPOF network design, not theoretical compliance
Multi-standard alignment (IEC 62443, NERC CIP, NIST, IEEE 1686) on every project - deep standards exposure
Small firm means your security architecture decisions shape the practice standard, not a corporate cybersecurity policy you inherit
Hiring Process
Screen: Background review against role requirements - vendor platform experience, relevant certifications, project types, and standards familiarity. Quick assessment of baseline alignment before investing either party's time. Resume review + 15-min intro call
Technical Review: Deeper evaluation of technical depth. We review sample work - relay settings files, protection study reports, commissioning test procedures, or SCADA configuration packages - depending on the role. If samples aren't shareable, we discuss specific project scenarios in detail. Async work-sample review or 45-min technical call
Interview: Scenario-based conversation with the principal engineer. Real project situations: how you'd approach a coordination study for a complex switchgear lineup, sequence a commissioning plan across multiple vendor platforms, or troubleshoot a protection scheme failure during site acceptance testing.
Exercise / Artifact Review: A practical evaluation matched to the role. Engineering roles receive a take-home exercise - review and mark up a set of relay settings, identify gaps in a protection study, or develop a test procedure for a specific scheme. Field-focused roles walk through a commissioning package or test report they've delivered, explaining their methodology and decisions.
Final Conversation: Role scope, current project pipeline, working arrangements, and compensation. This is a two-way conversation - we want to confirm the role fits your goals, not just the other way around.
30-min call
This role supports our Cybersecurity and Architecture & Design service scopes.
General interest Protection & Relay EngineeringPower System Studies & DesignCommissioning & Field ExecutionIntegration & ControlsProject & Deployment Management
Get in Early
This role opens soon.
#J-18808-Ljbffr
Worksite address
sacramento, CA, 95828, US
Who can apply
Review the original listing for work authorization, qualifications and employer requirements.