Director of Network

Role Overview

The Director of Network is a senior technology leader responsible for the strategy, architecture, and operational excellence of Subway's enterprise network infrastructure. This role owns WAN/LAN, SD-WAN, ZTNA, DNS, and load balancing across corporate, cloud (Azure/AWS), and franchise restaurant environments.

Key Responsibilities

• Network Strategy & Architecture

• Define enterprise network strategy: WAN/LAN, SD-WAN (Silver Peak/Aruba EdgeConnect), restaurant connectivity, NGFW (Palo Alto), and cloud networking (Azure vNET/ExpressRoute/Firewall/NSGs; AWS Transit Gateway/VPC/Direct Connect).
• Own the ZTNA roadmap, replacing legacy VPN with zero trust access.
• Design DNS, DHCP, IPAM, and load balancing for high availability across corporate and franchise environments.
• Partner with Cyber Security on segmentation and firewall policy compliance.
• Drive cloud-native architecture (hub-and-spoke, shared services, IaC provisioning) across Azure and AWS.

• Infrastructure-as-Code & Automation

• Lead Terraform adoption as the primary IaC tool; enforce module governance and state management.
• Build CI/CD pipelines (GitHub Actions/Azure DevOps) for automated network config deployment.
• Supplement Terraform with light scripting (Python/Ansible) only where needed.
• Champion automation-first culture; implement drift detection and remediation.

• Cloud Networking

• Own multi-cloud architecture and operations across Azure and AWS with consistent security posture and routing design.
• Manage VNets, peering, private endpoints, NSGs, route tables, and cloud-native firewalls.
• Lead observability (flow logs, performance monitoring, alerting) and cost optimization (right-sizing, traffic engineering, egress governance).
• Partner with Cloud Engineering and Application teams on scalable architectures.

• Franchise & Restaurant Network Operations

• Oversee connectivity/performance for 37,000+ restaurant locations globally.
• Standardize restaurant network architecture (POS, guest Wi-Fi, digital menu boards, IoT).
• Manage ISP/MSP/equipment vendor relationships for SLA adherence and cost control.

• Team Leadership & Vendor Management

• Lead a blended team (FTE + managed services) across network engineering and operations.
• Hold vendors/system integrators accountable to SOWs, SLAs, and milestones.
• Manage annual operating/capital budgets; champion AI tooling adoption.

• Governance, Risk & Compliance

• Ensure network controls meet SOX, PCI-DSS, GDPR, CCPA; serve as audit point of contact.
• Maintain and test DR/BC plans.
• Identify and mitigate availability and security risks.
• Run change advisory board (CAB) reviews.

Required Qualifications

• Bachelor's in Computer Science, Network Engineering, Cybersecurity, IT, or related field.
• 12–15+ years in IT infrastructure/network engineering, including 5+ years in senior leadership over enterprise network functions.
• Multi-site franchise/retail/QSR experience preferred.
• Deep expertise in ZTNA, routing/switching (BGP, OSPF, VXLAN), Palo Alto NGFW (PAN-OS, Panorama), and Silver Peak/Aruba EdgeConnect SD-WAN (overlay design, path conditioning, QoS).
• Strong cloud networking across Azure (vNET, ExpressRoute, Firewall, NSGs, App Gateway) and AWS (Transit Gateway, VPC, Direct Connect, Security Groups, Network Firewall), including hub-and-spoke and shared services at scale.
• Terraform required as primary automation mechanism — modular codebases, remote state, drift detection, CI/CD integration. Light scripting (Python/Ansible) a plus.
• Certifications: CCNP or CCIE required; AZ-700 or AWS Advanced Networking Specialty preferred; Terraform Associate and ITIL v4 a plus.
• Proven leadership of blended FTE/MSP teams, multi-million-dollar budget management, and vendor accountability.
• Strong executive communication skills, able to translate technical topics for business audiences.
• Hands-On Technical Requirements (direct build/design/operate experience, not just oversight)
• Azure VNet: peering, hub-and-spoke, route tables, private/service endpoints
• AWS VPC: subnetting, routing, peering, PrivateLink, security groups, NACLs across multi-account environments
• AWS Transit Gateway: multi-VPC/account connectivity, route segmentation, inter-region peering, centralized inspection
• NSGs: rule design and automated enforcement at scale
• Guardicore (Akamai Segmentation): microsegmentation, ring-fencing, label-based policy
• Palo Alto Networks: NGFW administration, policy management, threat prevention
• Silver Peak (Aruba EdgeConnect) SD-WAN: overlay design, path conditioning, QoS
• Terraform: production-grade modules for Azure/AWS, remote state, workspaces, pipelines
• Cloud observability: flow logs, network watcher, traffic analytics, alerting

Preferred

• QSR/franchise/hospitality experience at 10,000+ location scale
• Legacy VPN-to-ZTNA migration experience
• Zero Trust framework familiarity (CISA, Forrester, NIST 800-207)
• PCI-DSS network segmentation knowledge
• AIOps/generative AI familiarity for network automation and troubleshooting

What We Offer

• Insurance Plans (Medical, Life)
• Pension/401K/RSP (country specific)
• Competitive Bonus
• Mobility Allowance
• Tuition Reimbursement
• Company Holidays
• Volunteering time
• And More….

Compensation

The base pay range for this role is $184,500-230.600 annually