Lead Network Engineer

Lead Network Engineer

Lead the technical evaluation and deployment of ZTNA and Secure Web Gateway (SWG) capabilities alongside Enterprise Architecture and Cyber Security, driving the organization's transition from always-on VPN toward a Zero Trust access model.

Manage the AWS network platform in a multi-account hub-spoke landing zone, including VPCs, Transit Gateway, IPAM, Route 53, Direct Connect, Gateway Load Balancer inspection paths, NACLs, security groups, and VPC sharing via AWS RAM across our network and workload accounts.

Own the Palo Alto environment, including VM-Series firewalls in AWS and Panorama-based policy management, the current GlobalProtect remote-access VPN (including contractor and third-party access groups and HIP checks), and east-west / ingress / egress inspection design.

Drive network infrastructure as code with Terraform as the core tool, building and evolving modular, reusable patterns so network changes are version-controlled, peer-reviewed, and repeatable rather than one-off manual edits (transferable IaC experience from other tools is welcome).

Treat the network as a self-service platform: build the modules, guardrails, documentation, and tooling that let application and operations teams provision and troubleshoot their own connectivity, and make stepping in for one-off work the exception, not the norm.

Build observability, alerting, and redundancy into the network by default, instrumenting telemetry, logs, and SNMP into our observability stack (Dynatrace and Observe) so issues are caught early and the platform is resilient across regions and availability zones.

Set and enforce network standards across the organization, reduce configuration drift, and partner on the program to detect and alert on manual changes that bypass IaC.

Execute changes through our ServiceNow change-management process, including CAB review for significant changes, and participate in the support and on-call rotation.

Treat every one-off build or manual fix as a signal: either a defect in the platform to be fixed or a missing feature to be added, and close that gap so the work becomes self-service next time.

Use AI-assisted tools to accelerate troubleshooting, draft and improve runbooks, and reduce repetitive operational overhead, with a practical focus on where AI adds value in network operations.

Required Experience

• Strong, hands-on networking fundamentals across routing, switching, DNS, load balancing, NAT, and segmentation, in both cloud and on-premise contexts.
• Proven ability to lead a ZTNA and Secure Web Gateway (SWG) evaluation and deployment (e.g., Zscaler, Netskope, Prisma Access, or comparable), owning the technical direction alongside Enterprise Architecture and Cyber Security as the organization moves from always-on VPN to a Zero Trust access model.
• Hands-on experience managing a Palo Alto environment (NGFW / VM-Series, Panorama, security policy, and traffic inspection).
• Strong AWS networking experience in a multi-account environment: VPC design, Transit Gateway, Direct Connect, Route 53, IPAM, NACLs and security groups, and VPC sharing patterns.
• Practical infrastructure as code experience, with Terraform as the core tool (transferable experience from other IaC tools is acceptable) and a track record of replacing manual changes with version-controlled, peer-reviewed automation.
• A platform mindset: experience building reusable modules, guardrails, and self-service capabilities so other teams can provision and troubleshoot without one-off engineering help.
• Comfort coordinating and prioritizing a team’s delivery and keeping work on track while you focus on larger initiatives.
• A strong instinct for observability, alerting, and redundancy, and experience instrumenting networks for monitoring and resilience.
• Security-first thinking, including segmentation, least privilege, and secure connectivity patterns across hybrid environments.
• Comfort operating in production with formal change management (CAB / ServiceNow) and on-call responsibility.
• Scripting fluency (Python, Bash, or similar) for automation and operational tooling.
• Comfort using AI tools (Claude, GitHub Copilot, or similar) to ramp on unfamiliar systems, write automation, and diagnose issues.

Nice to Have

• Experience with hub-spoke AWS landing zones, Account Factory for Terraform (AFT), or comparable account-vending and network-sharing automation.
• On-premise enterprise networking depth (Cisco routing and switching, wireless) in a hybrid environment.
• BGP and dynamic routing experience, particularly routes learned over Direct Connect.
• Experience driving SD-WAN deployments.
• Experience with Dynatrace and Observe, or comparable APM, observability, and network telemetry platforms (NetFlow, syslog, SNMP).
• Familiarity with WAF and edge traffic management (Imperva a strong plus).
• Experience deploying and operating workloads on Kubernetes / EKS and supporting GitOps and CI/CD tooling (ArgoCD, GitHub Actions, or similar).
• Experience standardizing networks across multiple environments (prod, non-prod, beta, DR) with cross-environment isolation and DR/failover requirements.