Infrastructure Systems Architect

The Aspen Group; Chicago (IL); Hybrid; USD 140,000 - 200,000; Full time

Benefits offered by this job

Benefits package

Job summary

The Aspen Group is seeking an Infrastructure Systems Architect to own architectural oversight for a 50,000-device fleet across 1,500 locations. You will shape target-state design for endpoint management, telemetry, and automation, then build integrations and tooling to realize it.

You will lead governance, drive proof-of-concept work, and align fleet architecture with Zero Trust, while enabling scalable provisioning, imaging, and deployment across clinical and enterprise endpoints.

Qualifications

• 10+ years in systems architecture or software engineering roles.
• Experience designing and operating device fleet management at enterprise scale (10,000+ devices).
• Proven ability to architect and deliver end‑to‑end fleet management and observability solutions.

Responsibilities

• Define target-state architecture for endpoint management, telemetry, inventory, patching, and remote support platforms.
• Establish governance: design reviews, ARs, non-functional requirements, and exception handling.
• Evaluate current endpoint management and observability tools; lead build-vs-buy analyses and proof-of-concept work.
• Design for scale and multi-tenant/separation across brands; enable safe rollouts.
• Partner with Security to align fleet architecture with Zero Trust and least-privilege controls.
• Produce architecture diagrams, data flows, contracts, runbooks, and roadmaps.

Skills

Endpoint management

Observability

CI/CD

Architecture governance

Zero Trust

REST/gRPC APIs

PowerShell scripting

Networking basics

Education

Bachelor's degree in CS/IS/EE

Tools

Microsoft Intune

Autopilot

MECM/SCCM

JAMF

Grafana

Prometheus

Terraform

ServiceNow

Job description

The Aspen Group (TAG) is one of the largest and most trusted retail healthcare business support organizations in the U.S., supporting over 23,000 healthcare professionals and team members at more than 1,150 locations across 48 states. Our five supported healthcare practices operate under the brands Aspen Dental, ClearChoice, WellNow, Chapter Aesthetic Studio, and Lovet. We’re committed to enabling healthcare professionals to focus on patient care while we handle the business operations that support them.

We are seeking an Infrastructure Systems Architect to own architectural oversight of the systems that manage, monitor, and secure a device ecosystem of approximately 50,000 endpoints supporting 20,000+ users across 1,500+ locations for a large dental services organization (DSO) and affiliated medical services businesses. This is a senior individual contributor role that is equal parts architecture and hands-on engineering: the successful candidate will help define the target-state design for fleet management, telemetry, and automation platforms, and then help build the integrations, services, and tooling that make that design real.

The majority of the scope centers on enterprise endpoint management and monitoring at scale. The role also extends to the platforms and workstations that run clinical applications and connected clinical devices, including digital X‑ray, CBCT imaging, and intraoral 3D scanning systems. The ideal candidate has built and supported scalable, enterprise-grade device fleet management and observability systems, writes production-quality code, and has led large-scale device deployment and integration programs.

This role provides architectural oversight and advanced technical support to the Endpoint Engineering, Field Support, Implementation, Network and Imaging Modality teams, and serves as the final technical authority for fleet management systems design.

Key Responsibilities:

Architecture & Strategy

• Champion the effort to define the target-state architecture, standards, design patterns, and roadmap for endpoint management, telemetry, inventory, patching, and remote support platforms.
• Establish architectural governance: design review processes, architecture decision records, non-functional requirements, and exception handling.
• Evaluate current state commercial endpoint management, RMM, and observability platforms to identify gaps and opportunities to upgrade or augment functionality with custom tooling. Lead proof-of-concept work and build-vs-buy analyses with TCO and operational‑burden reasoning.
• Design for scale and resilience: multi‑tenant/multi‑brand separation, safe and effective rollouts.
• Partner with Security and Infrastructure leadership to align fleet architecture with Zero Trust principles, conditional access, device compliance posture, and least‑privilege models.
• Produce and maintain authoritative documentation: architecture diagrams, data flows, integration contracts, runbooks, and roadmaps.
• Design and build the tooling, APIs, connectors, and automation frameworks that integrate endpoint management platforms with ITSM, CMDB, identity, asset, and location data systems of record.
• Collaborate with observability team to help build device telemetry and observability that provide accurate real‑time fleet health, compliance, and inventory reporting.
• Develop self‑healing and remediation automations that detect and corrects failed policy or application deployments and configuration non‑compliance without human intervention.
• Implement CI/CD, infrastructure‑as‑code, testing, and release management practices for all fleet management tooling and configuration artifacts.
• Prototype and harden new capabilities before transitioning them to the Endpoint Engineering and Operations teams for day‑to‑day ownership.

Deployment & Integration Programs

• Lead the implementation of best practices for fleetwide safe and effective application deployments.
• Provide architectural oversight for large‑scale device deployment, refresh, migration, and DeNovo/acquisition integration programs.
• Help design zero‑touch provisioning, imaging, and enrollment workflows that allow field and third‑party technicians to deploy devices consistently with minimal specialized skill.
• Define the technical integration playbook for acquired practices and new‑build locations, including device onboarding, standards conformance, and remediation of non‑standard estates.

Clinical Systems Scope

• Extend fleet management, monitoring, and patching standards to workstations and appliances that host clinical applications and connected clinical devices, including digital X‑ray, CBCT, and intraoral 3D scanning systems.
• Design management approaches for constrained or vendor‑controlled clinical endpoints, balancing security and patch currency against vendor support requirements and clinical uptime.
• Ensure fleet management designs support HIPAA safeguards and appropriate handling of systems that touch protected health information.

Leadership & Advanced Support

• Serve as the final escalation point for complex, cross‑domain technical issues involving application deployments, device management, telemetry, and integration systems.
• Mentor Principal, Senior, and mid‑level engineers in system design, software engineering practice, automation, and documentation rigor.
• Participate in cross‑functional design and readiness reviews ensuring solutions meet enterprise SLAs, security requirements, and supportability standards.
• Translate technical direction into clear recommendations and trade‑offs for leadership teams.

Skills & Qualifications:

Education:

Bachelor's degree in Computer Science, Software Engineering, Information Technology, or a related field (or equivalent work experience).

Experience:

10+ years in systems architecture, platform engineering, or software engineering roles, including significant experience designing and operating device fleet management and monitoring systems at enterprise scale (10,000+ devices; 50,000+ preferred) across a highly distributed, multi‑site footprint.

Technical Skills

• Experience with endpoint agent architecture and lifecycle: deployment, versioning, health monitoring, and safe rollback across a large fleet.
• Proven design and delivery of distributed, service‑oriented systems: REST/gRPC APIs, message queues and event‑driven patterns, relational and time‑series data stores, caching, and secure secrets management.
• Familiarity with commercial endpoint management platforms — Microsoft Intune, Autopilot, MECM/SCCM, and JAMF.
• Monitoring and observability tooling and practice (e.g., Grafana, Prometheus or equivalent), including metrics, logging, alerting design, and alert‑fatigue management.
• Cloud platform experience (Azure & GCP preferred; AWS acceptable), containerization, and infrastructure‑as‑code (Terraform or equivalent).
• Solid grasp of endpoint security fundamentals: EDR, disk encryption, patch and vulnerability management, hardening baselines, and compliance reporting.
• Windows and macOS internals, plus mobile and purpose‑built/appliance device management; scripting in PowerShell.
• Networking fluency sufficient to design across a distributed branch estate: DNS, DHCP, TCP/IP, VPN, SD‑WAN, proxy/firewall traversal, and bandwidth‑constrained site behavior.
• Data modeling and reporting for asset, inventory, and compliance data, with an emphasis on a single trusted source of fleet truth.

Soft Skills

• Strong analytical and systems‑thinking ability, with the judgment to choose simple, supportable designs over complex ones.
• Excellent written communication and documentation rigor; able to produce architecture artifacts that engineers can build from without further interpretation.
• Demonstrated ability to influence without authority and align engineering, security, operations, and business stakeholders around a shared technical direction.
• Self‑directed ownership: identifies gaps proactively, drives them to resolution.
• Mentorship and technical leadership capability across engineering levels.
• Comfort operating in a fast‑paced environment with multiple concurrent and competing priorities.

Additional Qualifications (Preferred):

• Experience in healthcare, dental, retail, restaurant, or another highly distributed multi‑site industry.
• Experience integrating device management platforms with ITSM/CMDB tooling (e.g., ServiceNow) and asset lifecycle systems.
• Experience with merger, acquisition, or de novo location IT integration at scale.
• Exposure to AI/ML‑assisted operations — anomaly detection, predictive hardware failure, or automated triage of endpoint telemetry.

Working Conditions:

Hours:

Full‑time. Occasional after‑hours or weekend work to support major deployments, migrations, and critical escalations.

Location:

Syracuse NY; Chicago IL or Remote

Travel:

Occasional travel (less than 10%) to corporate offices, staging facilities, and field locations.

Reporting:

Individual contributor role providing architectural direction to the Endpoint Engineering, Implementation, and Field Support teams; no direct reports to start with possibility of having one or two reports.

*A generous benefits package that includes paid time off, health, dental, vision, and 401(k) savings plan with match