Lead Network & Security Architect 1

Celestica Inc.; Toronto; On-site; CAD 140,000 - 190,000; Full time

Job summary

Celestica Inc. is seeking a highly experienced Lead Network & Security Architect to own the RDL reference architecture for the Hardware Platform Solutions group.

The role involves deploying and maintaining an air-gapped network environment across multiple global hubs, with strict isolation from standard corporate IT networks. You will manage secure access paths, private SD-WAN overlays, and a multi-tier data distribution system, enabling rapid spin-up of project-specific instantiations while

Qualifications

• Extensive experience in designing isolated, air-gapped networks.
• Proven ability to deploy and manage multi-site RDL architectures.
• Strong knowledge of secure access methods and RBAC.

Responsibilities

• Deploy and standardize the RDL reference design across global centers.
• Spin up new RDL network instances with subnetting and VLANs.
• Enforce strict isolation and prevent public internet access.
• Design and maintain the private SD-WAN overlay.
• Configure enterprise firewalls and segmentation.
• Manage core and access switches to segment VLANs.
• Oversee CyberArk for remote access.
• Configure ZTNA and jump hosts for secure connections.
• Define local account procedures in absence of AD.

Skills

Network architecture

Security engineering

SD-WAN design

RBAC & IAM

Jump host management

Tools

Cisco Catalyst switches

Checkpoint 3980

Zscaler ZTNA

CyberArk vPAM

Local jump hosts

Job description

Lead Network & Security Architect 1

Date: Oct 6, 2026

Location: Toronto, ON, CA

Summary

We are seeking a highly experienced and meticulous Lead Network & Security Architect to join the IT Support team for the Hardware Platform Solutions (HPS) group. In this role, you will take ownership of our global Research and Development Lab (RDL) reference architecture and drive its deployment, management, and scaling across all current and future HPS Design Centers (including Silicon Valley, Richardson, Thailand, and other global hubs).

The successful candidate will be responsible for implementing and maintaining a completely isolated, air-gapped network environment that operates independently of standard corporate IT networks. You will manage complex secure access paths, isolated VLAN provisioning, private full-mesh SD-WAN overlays, and a multi-tiered global data package replication and distribution system. You will also serve as the key enablement architect, helping project teams quickly spin up new project-specific instantiations of the RDL network model while adhering to strict security constraints.

Core Responsibilities

• Deploy Reference Architecture: Standardize and implement the RDL reference design across all global HPS design locations (San Jose, Richardson, Thailand, Shanghai, SongShan Lake, Penang, Chennai and future locations).


• Support New Instantiations: Act as the primary technical design authority to spin up new RDL network instances (allocating subnets, configuring dedicated VLANs, establishing local jump hosts, and defining user authentication parameters) for upcoming HPS design projects.


• Strict Constraint Enforcement: Maintain absolute isolation of the RDL environments. Ensure zero direct or indirect public internet connectivity and guarantee that out-of-scope systems or agents (e.g., CrowdStrike, Threat Locker, Big Fix, ServiceNow Agents, ClearPass NAC, and Windows Domain joins) are strictly excluded from the lab network.




• SD-WAN & Routing: Design, configure, and maintain the private, full-mesh SD-WAN overlay connecting global RDL sites.


• Secure Firewalling: Configure and administer enterprise-grade firewalls (Checkpoint 3980) protecting the perimeter of each localized lab, defining strict ingress/egress filtering rules.


• Switching & Segmentation: Manage core and access layer switches (Cisco Catalyst 9400/9200 series, Celestica DS2000, ES1500 switches) to segment the RDL into logical, multi-tenant VLAN environments—specifically separating Export Controlled and Non-Export Controlled network zones.

3. Identity and Remote Access Management

• Remote Customer Access: Oversee the implementation and administration of CyberArk vPAM (Virtual Privileged Access Management) for remote customer connections.


• Corporate Remote Access: Configure and maintain Zscaler ZTNA (Zero Trust Network Access) and App Connectors to terminate connections securely on Linux-based local jump hosts.


• Decentralized Authentication: Design and maintain a secure user management protocol on jump hosts and local RDL nodes. As the RDL operates without Windows Active Directory, you will define standard operating procedures for the manual/programmatic creation of local system accounts and localized role-based access control (RBAC).


• Repository Architecture: Maintain the multi-tier secure data distribution system:
  
  
  • IT Repository Server: