Cloud Network Architect

OnX; Toronto; Hybrid; CAD 120,000 - 170,000; Full time

Job summary

OnX is seeking a Cloud/Network Architect for a full-time hybrid role with 2 in-office days per week in Toronto, Windsor, or Montreal. The candidate will design and operate enterprise and cloud networking including switching, routing, firewall/IPS, and ZTNA integration across on-prem and cloud environments.

The role demands 8–10 years of experience, strong knowledge of Zero Trust, cloud networking (AWS/Azure/GCP), and IaC with Terraform.

Qualifications

• 8–10 years of experience in enterprise network engineering and support
• Experience with Zero Trust / ZTNA concepts and shared-responsibility security model
• Cloud networking across AWS/Azure/GCP with VPCs/VNet, DNS, load balancing
• Hybrid connectivity incl. IPsec VPN, BGP, ExpressRoute/Direct Connect
• Infrastructure as Code for networking (Terraform), Git, CI/CD
• API-driven automation for provisioning networking resources
• Strong TCP/IP, DNS, and web tech knowledge
• LAN (Cisco/Meraki) and Wireless networks
• SD-WAN (Aruba/SilverPeak)
• Experience with network security appliances and incident response
• Excellent written and oral communication; ability to engage across levels

Responsibilities

• Lead design, deployment, and operation of enterprise and cloud networking environments
• Ensure SLA delivery for internal and external customers
• Develop and maintain network runbooks and operational processes
• Implement NetDevOps practices for network changes and automated validation
• Manage hybrid and cloud connectivity, including security policy alignment
• Mentor more junior staff and provide on-call support
• Collaborate with Security to enforce least privilege and ZTNA controls
• Partner with IT and business teams for new networking solutions
• Travel as required to client sites or offices

Skills

Cloud networking

Zero Trust

IaC (Terraform)

Ansible

Python scripting

VPN/SD-WAN

Networking protocols

CI/CD for network configs

Communication skills

Education

University degree/College diploma in CS or related

Tools

Terraform

Ansible

Python

Viavi

PRTG

Job description

Our client is looking for add a Cloud/Network Architect on a full time basis.

Its a full time role with hybrid presence like 2 days onsite at their Toronto, Windsor or Montreal locations. Hybrid Model: 2 days a week in office (Tuesday, Wednesday)

Below are the top skills they would need and also provided the complete job description as well.

Candidates must currently hold or be eligible to obtain a Government of Canada Reliability Status security clearance

• 8-10 years of experience
• Insurance experience would be an asset
• Zero Trust and ZTNA concepts, including a shared-responsibility model where Security owns access policy and the Network team operates the underlying access platform
• Cloud networking: AWS/Azure/GCP virtual networks (VPC/VNet), route tables, network security constructs, load balancing, and DNS integration
• Hybrid connectivity and routing: IPsec site-to-site VPN, BGP routing, and private cloud connectivity services (e.g., ExpressRoute/Direct Connect)
• Automation and Infrastructure as Code for networking: Terraform (modules/state), Ansible, and scripting (e.g., Python) with Git-based workflows and CI/CD pipelines for repeatable deployments and change control
• API-driven automation: ability to use cloud and platform APIs/SDKs to provision and manage networking (e.g., security rules, routes, connectivity), and to implement automated checks (linting/policy guardrails) before changes are applied
• TCP/IP, DNS and web-based technologies
• LAN (Cisco/Meraki)
• Routing (OSPF, BGP)
• SD-WAN (Aruba/SilverPeak)
• Wireless network (Cisco/Meraki)
• Network Analysis Tools (Viavi/PRTG)
• Clear and effective written and oral communication skills with the ability to communicate to all levels of internal and external customers.
• Excellent planning, organizing, and time management skills with strong attention to detail.

.

THE ROLE IN A NUTSHELL:

Reporting to the Manager, Network Operations, the Network Engineer plays a lead role in the Network Administration team responsible for the design, implementation, and operational support of enterprise and cloud networking environment—including switching, routing, firewall/IPS, and hybrid connectivity across on-premises and public cloud platforms.

• Support the delivery of IT services to meet service level agreements (SLA) for internal and external customers.
• Lead and/or assist in the engineering (planning, design, implementation, and operation) of complex network infrastructure systems, including:
• Enterprise networking environments including Data Centre, Campus, and Cloud/Hybrid networks (AWS, Azure, GCP) including virtual networks (VPC/VNet), subnets, routing, and segmentation
• Hybrid and cloud connectivity services including site-to-site VPN (IPsec), private connectivity (e.g., ExpressRoute/Direct Connect), cloud peering, and transit architectures
• Campus Wired & Wireless environments
• Platform administration for wired/wireless access and secure remote access, including ZTNA (replacing legacy VPN) platforms and control planes
• Accountable for the ZTNA platform lifecycle and operations (availability, performance, upgrades, connectors, troubleshooting, monitoring, and vendor engagement), while partnering with Security who owns and administers access policy (identity context, least privilege, and enforcement rules)
• Network-based security appliances such as firewalls & intrusion prevention system (IPS)
• Network services automation and Infrastructure as Code (IaC) to standardize, deploy, and operate network configurations (e.g., Terraform), including version control, reusable modules, and automated validation to reduce configuration drift
• Apply NetDevOps practices for network changes: use CI/CD pipelines for plan/review/apply, infrastructure code peer review, secrets management, and automated rollback where applicable
• Engineer network security controls across on-premises and cloud environments, including firewall policy, segmentation, secure remote access, and alignment to Zero Trust principles
• Implement and integrate Zero Trust / ZTNA capabilities across cloud and on-prem environments (e.g., app segmentation, connector placement, routing/DNS considerations, and logging), and support policy automation/guardrails by providing the technical patterns and platform capabilities required by Security
• Customer Engagement - IP telephony & Contact Center services
• Room-based video collaboration endpoints and video interoperability systems
• Monitor network performance and capacity in the areas of response, throughput, availability, and capacity.
• Leads change, incident, and problem management tasks with production network team.
• Knowledge management input, development of support runbooks and transition to operational process.
• Conduct performance monitoring and baseline analysis, with a keen focus on improving service robustness, resilience, and stability.
• Participate in maintenance and testing of disaster recovery plans, processes, and procedures necessary to recover services in the event of a disaster.
• Responsible to comply with corporate IT and Security policies.
• Manage vendor relationships for maintenance and support of existing systems. Also, leverage these relationships to explore new technologies.
• Collaborate closely with other IT and business teams in the development and implementation of new solutions following the project delivery processes.
• Provide mentorship within the Team as a Senior technical resource.
• Provide 24x7 on-call support on a rotating basis.
• The ability to work occasional early or late shifts to support changes.
• Occasional travel will be required.

WHO WE ARE LOOKING FOR

• A university degree or college diploma in Computer Science or a related discipline.
• Minimum of 8–10 years’ experience engineering and supporting enterprise network infrastructure, including cloud and hybrid connectivity.
• Experience with the following is required:
• Zero Trust and ZTNA concepts, including a shared-responsibility model where Security owns access policy and the Network team operates the underlying access platform
• Cloud networking: AWS/Azure/GCP virtual networks (VPC/VNet), route tables, network security constructs, load balancing, and DNS integration
• Hybrid connectivity and routing: IPsec site-to-site VPN, BGP routing, and private cloud connectivity services (e.g., ExpressRoute/Direct Connect)
• Automation and Infrastructure as Code for networking: Terraform (modules/state), Ansible, and scripting (e.g., Python) with Git-based workflows and CI/CD pipelines for repeatable deployments and change control
• API-driven automation: ability to use cloud and platform APIs/SDKs to provision and manage networking (e.g., security rules, routes, connectivity), and to implement automated checks (linting/policy guardrails) before changes are applied
• TCP/IP, DNS and web-based technologies
• LAN (Cisco/Meraki)
• Routing (OSPF, BGP)
• SD-WAN (Aruba/SilverPeak)
• Wireless network (Cisco/Meraki)
• Network Analysis Tools (Viavi/PRTG)
• Clear and effective written and oral communication skills with the ability to communicate to all levels of internal and external customers.
• Excellent planning, organizing, and time management skills with strong attention to detail.
• Possess strong analytical skills and the ability to creatively develop solutions to problems.
• Must be a team player with the ability to work independently in a rapidly changing environment.
• Candidates must currently hold or be eligible to obtain a Goverment of Canada Relibaility Status security clearance.
• Experience with the following will be an asset:
• Firewall (CheckPoint), IPS (Cisco Firewpower)
• Video Conference
• Contact Center applications (Verint WFO and EM)
• Experience supporting Intel servers, AIX servers, and Pure Storage are a definite asset.

NICE TO HAVE

• Cisco Certified Design Professional (CCDP)
• Bilingual French/English would be an asset