Network Architect Senior Lead Network Engineer

Key responsibilities Produce high level and low level designs for switching routing firewalling and segmentation across campus data centre and branch environments. Design and implement WAN architectures including BGP and static routing dual ISP failover HA pairs and SD-WAN or SASE overlays. Deploy and operate SASE platforms: physical Sockets and virtual Sockets IPsec site to site connections remote access clients ZTNA application access and the cloud security stack. Build cloud connectivity into Azure using ExpressRoute VNet peering hub and spoke topologies and virtual network appliances and integrate it with on-premises routing. Define and enforce firewall and secure web gateway policy: application control URL filtering IPS TLS inspection strategy and exception governance. Design network segmentation for user server and OT traffic including NAC based access control and micro segmentation where required. Lead the move from network based access to identity based Zero Trust access: application discovery policy mapping to identity groups and device posture pilot migration and decommissioning of legacy VPN. Own core network services design: DHCP DNS IP address management and CIDR planning across sites and cloud. Plan and execute migrations from MPLS legacy VPN and on-premises proxies with tested rollback. Lead major incident bridges as the final technical escalation and drive root cause analysis to permanent fixes. Govern change: review all normal and emergency changes for technical risk and represent the team at CAB. Manage vendor relationships for firewalls SASE switching and carriers: support cases roadmap licensing and capacity planning. Produce capacity performance and security posture reports and present them to customer leadership. Support pre-sales with effort estimates solution design and proof of concept delivery for new engagements. Required experience and skills All of the following with hands-on implementation experience not only design or oversight. 8 to 10 years in enterprise networking with at least 3 years in a lead or architect role. On-premises switching and routing: Layer 2 and Layer 3 campus design VLANs spanning tree VRFs OSPF BGP and static routing first hop redundancy. Enterprise WAN and BGP design: multi site topologies route policy path selection HA and dual ISP failover. Firewalls: next generation firewall design and administration on at least one of Palo Alto Fortinet Check Point or Cisco including HA zones NAT and policy lifecycle. Network segmentation of user server and OT environments including NAC (Cisco ISE Aruba ClearPass or equivalent) and 802.1X. IPsec site to site VPN and remote access clients including split tunnelling client coexistence and certificate based authentication. SASE or SSE platform implementation: Sockets and vSockets IPsec sites endpoint client ZTNA application access and the cloud security stack. Cato Zscaler Prisma Access or Netskope. Secure web gateway and TLS inspection at scale: certificate distribution bypass and exception governance privacy and performance considerations. Zero Trust access models and identity based policy using Microsoft Entra ID groups Conditional Access and device compliance signals. Data centre edge and cloud connectivity: Azure ExpressRoute VNet peering hub and spoke virtual firewalls or virtual appliances and hybrid routing. Core services: DHCP DNS IPAM and CIDR planning at enterprise scale. Deep TCP/IP troubleshooting with packet captures and log correlation across client edge firewall and identity. Migration leadership: MPLS to SD-WAN or SASE legacy VPN to ZTNA proxy consolidation with tested rollback plans. Documentation: HLDs LLDs network diagrams runbooks and standards written in clear English. Leadership and ways of working Able to run the team independently: plan work review designs make decisions and escalate only when needed. Comfortable owning a customer relationship at technical lead level and presenting to CIO or CISO level stakeholders. Calm under pressure in major incidents; structured in root cause analysis. Mentors engineers and raises the bar on quality and documentation. Clear written and spoken English. Willing to travel for site surveys cutovers and customer workshops. Preferred CCNP Enterprise or Security CCIE PCNSE NSE7 Cato CCE Zscaler ZCCP or ZDTA Microsoft AZ-700 or SC-300. Experience with OT or manufacturing networks and IEC 62443 style segmentation. Automation with Python Ansible or Terraform and vendor REST APIs. SIEM integration and log design for network security monitoring. Experience in a managed service provider or consulting environment with multiple customers. Education Bachelor degree in engineering computer science or a related field or equivalent experience.

Required Skills:

enterprise networkingCCNP