Staff Network Architect - OT/SCADA

ON.energy is building the backbone of energy and AI infrastructure powering grid-safe data centers and mission-critical facilities. The company supplies and operates hyperscale power systems that solve the toughest resilience challenges delivering custom solutions for AI data centers mission-critical facilities and front-of-the-meter assets. ON recently announced a 5GW partnership with 3GW currently under construction across multiple hyperscale data center campuses. With patented technology and proprietary software ON.energy develops projects worldwide that set new benchmarks for resilience.

Role Summary

We're hiring a Senior OT/SCADA Network Architect to be the in-house design authority on OT networks for our AI data center UPS projects. You'll work side by side with the engineering manager who sets direction and approves the architecture. Within that the design work is yours. We build from a standard base network design that serves as the template for every project adapted per site for size topology and interconnection requirements. You'll help refine that template and apply it project by project so your work compounds across the portfolio instead of being rebuilt each time.

Key Responsibilities

Architect the OT network Develop the designs analyze the options and make the technical recommendations decisions are built on. The manager gives final approval the design is your craft. Refine the base design template zoning model IP and VLAN scheme redundancy topology equipment baseline and adapt it per project flagging when a site genuinely needs to deviate rather than quietly forcing a fit. Produce the design packages L1/L2/L3 diagrams IP and VLAN schedules switching and routing configurations port maps and cable/fiber schedules. Design heavily segmented multi-zone networks Purdue-aligned levels DMZs conduits between zones along with the redundancy QoS and time synchronization (NTP/PTP/IRIG-B) that keep control traffic reliable. Design site-to-site VPN connectivity into our cloud environment secure remote access for our engineers and vendors and out-of-band management. Support design reviews and commissioning network test plans troubleshooting during energization and as-builts. Document decisions clearly enough that project engineers and technicians can execute without re-deriving your reasoning. Own the IT/OT boundary Apply a clear model of IT/OT separation where the boundary sits what crosses it and why. Map dataflows end to end from PCS BMS meters and site SCADA through to our cloud environment and client-facing platforms. Design the DMZ gateway and data-transfer patterns that get business systems the data they need without exposing control systems and coordinate with IT and cloud teams on identity and remote access. Guide vendor and equipment selection Recommend network and infrastructure equipment industrial switches routers firewalls media converters gateways to include weighing environmental ratings form factor PoE budgets protocol support lifecycle and spares. Present trade-offs not a single answer. Review vendor and OEM submittals against our base design recommend how to close gaps and support procurement with sizing justification and lead-time input. Support spec compute and infrastructure (industrial and rack servers virtualization sizing storage redundant power UPS) and coordinate with electrical teams on panel layouts enclosures grounding and surge protection. Design with security in mind Build in segmentation least privilege hardened baselines and explicit trust boundaries between IT OT client and vendor networks. Contribute to industrial firewall design zone-to-zone rule sets OT protocol inspection where required and secure remote access patterns (jump hosts MFA SSO). Apply IEC 62443 concepts in design decisions and support compliance and audit work with drawings and documentation. Support asset inventory network monitoring and centralized logging so we can see what's on our networks. Understand the protocols Know the protocols in our stack Modbus TCP/RTU DNP3 IEC 61850 IEC 60870-5-104 OPC UA MQTT to include their bandwidth timing and segmentation implications and how to troubleshoot them at the packet level. Our controls and SCADA engineers own protocol configuration and point mapping. You don't need to own that layer but you do need to speak the language and anticipate how design choices affect it.

Required Experience

8+ years in network engineering and architecture including 5+ years designing OT ICS or SCADA networks. This experience can be within energy utilities data centers or mission-critical facilities oil & gas water or heavy industry. Proven experience designing heavily segmented multi-zone networks for large systems. Be ready to walk us through a zoning model you worked on why the boundaries fell where they did and what you'd change now. Strong routing and switching VLANs trunking L3 routing (OSPF/BGP/static) NAT ACLs spanning-tree and ring redundancy and structured IP planning. Site-to-site IPsec VPN design and troubleshooting including tunnel routing redundancy and failover. Clear grasp of IT/OT separation and dataflow design DMZs gateways and why a control network isn't just another VLAN. Working fluency in industrial protocols (Modbus DNP3 IEC 61850 or IEC 60870-5-104 OPC UA) and how they behave on a loaded network. Hands-on firewall design with at least one major platform (Palo Alto Fortinet Cisco FTD/ASA Check Point). Working familiarity with IEC 62443. Strong documentation and drawing skills. This role produces packages other people build from with a collaborative style since you'll be paired closely with the engineering manager and cross-functional teams.

Preferred Experience

Proprietary industrial ring redundancy Moxa Turbo Ring / Turbo Chain Advantech X-Ring / X-Chain or similar — including the judgment for when sub-second ring recovery is worth it over standard spanning-tree. Industrial hardware lines (Moxa Advantech Cisco IE/ISA-3000 Tofino) and equipment evaluation or standardization work. Battery storage data center power solar wind or substation automation including power plant controllers (PPC) EMS/SCADA platforms BMS and PCS integration revenue metering. Cloud networking VPC design site-to-site VPN transit gateways route tables security groups. Exposure to NERC CIP or to the frameworks data center clients tend to impose (SOC 2 ISO 27001). We expect our compliance scope to grow as this business does. Hardware specification server and storage sizing virtualization industrial compute UPS and DC power enclosure design. Certifications such as CCNP/CCIE GICSP GIAC GRID/GCIP ISA/IEC 62443 Cybersecurity Specialist CISSP PCNSE/NSE or equivalent. Scripting for configuration and validation (Python Ansible) and OT monitoring tooling (Nozomi Claroty Dragos Zabbix). Travel Occasional site travel for commissioning support corporate meetings and factory acceptance testing (~10%) LI-AD1 For US-based roles - What you’ll get Competitive salary + annual performance-based bonus eligibility Medical dental and vision insurance 401(k) with company match Paid time off and company holidays For Mexico-based roles - What you’ll get Competitive salary + annual performance bonus eligibility Christmas Bonus (Aguinaldo) 30 days Major medical expenses and life insurance Paid time off and holidays (per local policy) For all roles Professional development and growth opportunities Opportunity to grow with a mission-driven team shaping the future of clean energy Equal Opportunity ON.energy is committed to equal employment opportunity and to maintaining a work environment free of harassment discrimination or retaliation. Accommodations If you need an accommodation during the application process email recruitment@onenergystorage.com

Benefits

vary by role and location and are subject to change. Agency Notice ON.energy does not accept unsolicited resumes from staffing agencies search firms or third-party recruiters. Resumes submitted without a fully executed Master Services Agreement (MSA) and a written request from an authorized member of our Talent Acquisition team will be considered the property of ON.energy. No placement fees or compensation will be paid for unsolicited candidate submissions.