Job Description
Lead / Principal Network Architect — Physical Security (L4)
\n
About the Job
\n
The Lead / Principal Network Architect owns the network architecture standards and perimeter resilience strategy for the physical security estate. Leading a small, centralized team, the role sets the Building Block topology framework, the resilience and survivability strategy for critical zones, the network security standards and the automation direction that governs deployment at scale including the move to a source-of-truth driven, configuration-as-code provisioning model. You will own vendor and lifecycle direction, serve as the final escalation point for complex network incidents and architectural decisions, and partner with the Infrastructure Engineering team and program governance on shared security boundaries. This is a working architect role: standards ownership is exercised alongside direct involvement in lab design and validation.
\n
Key Responsibilities
\n
- \n
- Own the network architecture standards and Building Block topology framework for the physical security estate, setting the designs the senior team builds against.
- Define perimeter resilience and high-availability strategy, including ring architecture standards (MSTP, or ERPS where platform support exists) and cable-cut survivability requirements for critical zones.
- Establish network security standards and the enforcement, monitoring, notification and mitigation model that routes network security events to the appropriate operational teams.
- Set the network access control standard, including 802.1X and MAC Authentication Bypass policy for non-supplicant security devices, and the segmentation model for security VLANs.
- Own the automation and configuration-as-code strategy — golden configuration templates, zero-touch configuration, and the pipeline that provisions from the source of truth.
- Set source-of-truth, monitoring, inventory and observability standards (NetBox, SolarWinds, PRTG, syslog) for the network estate, and direct the migration of address management into them.
- Own network hardware and firmware lifecycle strategy, EOL evaluation, refresh planning and vendor selection across the approved platform set.
- Direct the global brownfield refresh program at architecture level: standardization targets, migration patterns, risk and rollback posture.
- Serve as the final escalation point for the most complex network incidents and architectural decisions.
- Partner with enterprise network teams on migration architecture where security networks integrate with the wider corporate network.
- Partner with the Infrastructure Engineering team and program leadership to align network architecture with shared security boundaries, governance, SLAs and KPIs.
- Author and approve network architecture standards, design documentation and runbooks; drive continuous improvement of resilience and security posture.
- Mentor and develop senior network engineers, establishing best practice and building long-term capability.
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
Mandatory Skills
\n
Candidates must demonstrate the following to be considered.
\n
- \n
- 10 or more years of enterprise network engineering, including architecture leadership and standards ownership in large or critical environments.
- Authoritative enterprise campus design across Cisco and Arista, with deep routing, switching and segmentation expertise.
- Mastery of Layer 2 resilience design — MSTP, loop prevention, and ring or redundant topologies for survivability in critical zones.
- Network access control architecture: 802.1X and MAC Authentication Bypass policy design for mixed supplicant and non-supplicant device estates.
- Network automation and configuration-as-code leadership (Python, Ansible, Git) with the ability to define standards rather than only consume them.
- Source-of-truth driven provisioning — NetBox or equivalent as the authoritative data layer for automated network provisioning.
- Monitoring and inventory architecture (SolarWinds, PRTG, syslog) and operational integration with security event handling.
- Hardware and firmware lifecycle strategy and vendor management.
- Large-scale brownfield refresh leadership across a distributed estate, including standardization, migration patterning and risk control.
- Demonstrated architecture leadership: standards ownership, cross-functional partnership, mentoring and escalation leadership.
- Willingness to operate as a working architect, including hands-on lab design and validation.
- Based in or able to work from Boulder, Colorado.
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
Good-to-Have Skills
\n
These strengthen an application but will not screen a candidate out.
\n
- \n
- ERPS (ITU-T G.8032) or equivalent Ethernet ring protection architecture experience. Narrow skill set, treated as an advantage rather than a filter.
- Networks supporting physical security devices at scale — IP cameras, access control, intercoms — including PoE, multicast and video-stream design considerations.
- Juniper platform experience.
- Experience leading a network team inside a managed services or vendor delivery model with contractual SLAs and KPIs.
- Network access control platform architecture (Cisco ISE, Aruba ClearPass or equivalent).
- Industrial, transportation, utility or campus backgrounds where ring resilience is standard practice.
- ITIL 4 or equivalent service management grounding.
\n
\n
\n
\n
\n
\n
\n
\n
\n
Certifications
\n
Level
\n
Certification
\n
\n
Required
\n
Cisco CCNP or Juniper JNCIS
\n
Preferred
\n
CCIE or an equivalent architect-level credential; Arista ACE
\n
Beneficial
\n
Network automation credentials (Cisco DevNet, Python or Ansible); ERPS or ring protocol design experience; ITIL 4
\n