Lead Network Engineer

Astreya; Boulder (CO); On-site; USD 150,000 - 190,000; Full time

Job summary

Astreya is seeking an accomplished Lead/Principal Network Architect for its Physical Security estate in Boulder, CO. This hands-on architect role sets standards, drives perpetual improvement, and leads a small team to ensure resilient, secured network architectures aligned with governance and security boundaries.

You will work closely with Infrastructure Engineering, manage lifecycle strategies, and mentor engineers while owning automation and source-of-truth provisioning in a physically secure

Qualifications

• 10+ years of enterprise network engineering with leadership experience.
• Authoritative campus design across Cisco and Arista.
• Mastery of Layer 2 resilience design (MSTP, ring/topology).
• NAC architecture: 802.1X and MAC Bypass design.
• Network automation and config-as-code leadership (Python, Ansible, Git).
• Source-of-truth provisioning using NetBox or equivalent.
• Monitoring/inventory architecture (SolarWinds, PRTG, syslog).
• Hardware/firmware lifecycle strategy and vendor management.
• Brownfield refresh leadership across distributed estate.
• Willingness to act as a working architect with hands-on lab design.

Responsibilities

• Own network architecture standards and Building Block topology for the estate.
• Define perimeter resilience and HA strategy with ring architectures.
• Establish network security standards and incident routing to ops teams.
• Set the network access control and segmentation model for security VLANs.
• Own automation/config-as-code strategy and golden templates.
• Define source-of-truth, monitoring and observability standards.
• Lead hardware lifecycle, EOL, refresh planning and vendor selection.
• Drive global brownfield migration patterns and risk controls.
• Mentor senior network engineers and establish best practices.
• Collaborate with Infrastructure Engineering and governance on shared boundaries.

Skills

Network architecture

Cisco/Arista design

L2 resilience

NAC architecture

Automation leadership

NetBox provisioning

Monitoring & inventory

Brownfield migration

Mentoring

Hands-on lab work

Education

Bachelor's degree in CS/Engineering

CCNP/JNCIS

CCIE preferred

Tools

Python

Ansible

Git

Network automation tooling

Lab validation tooling

Job description

Lead / Principal Network Architect - Physical Security (L4)

About the Job

The Lead / Principal Network Architect owns the network architecture standards and perimeter resilience strategy for the physical security estate. Leading a small, centralized team, the role sets the Building Block topology framework, the resilience and survivability strategy for critical zones, the network security standards and the automation direction that governs deployment at scale including the move to a source-of-truth driven, configuration-as-code provisioning model. You will own vendor and lifecycle direction, serve as the final escalation point for complex network incidents and architectural decisions, and partner with the Infrastructure Engineering team and program governance on shared security boundaries. This is a working architect role: standards ownership is exercised alongside direct involvement in lab design and validation.

Key Responsibilities

• Own the network architecture standards and Building Block topology framework for the physical security estate, setting the designs the senior team builds against.
• Define perimeter resilience and high-availability strategy, including ring architecture standards (MSTP, or ERPS where platform support exists) and cable-cut survivability requirements for critical zones.
• Establish network security standards and the enforcement, monitoring, notification and mitigation model that routes network security events to the appropriate operational teams.
• Set the network access control standard, including 802.1X and MAC Authentication Bypass policy for non-supplicant security devices, and the segmentation model for security VLANs.
• Own the automation and configuration-as-code strategy - golden configuration templates, zero-touch configuration, and the pipeline that provisions from the source of truth.
• Set source-of-truth, monitoring, inventory and observability standards (NetBox, SolarWinds, PRTG, syslog) for the network estate, and direct the migration of address management into them.
• Own network hardware and firmware lifecycle strategy, EOL evaluation, refresh planning and vendor selection across the approved platform set.
• Direct the global brownfield refresh program at architecture level: standardization targets, migration patterns, risk and rollback posture.
• Serve as the final escalation point for the most complex network incidents and architectural decisions.
• Partner with enterprise network teams on migration architecture where security networks integrate with the wider corporate network.
• Partner with the Infrastructure Engineering team and program leadership to align network architecture with shared security boundaries, governance, SLAs and KPIs.
• Author and approve network architecture standards, design documentation and runbooks; drive continuous improvement of resilience and security posture.
• Mentor and develop senior network engineers, establishing best practice and building long-term capability.

Mandatory Skills

Candidates must demonstrate the following to be considered.

• 10 or more years of enterprise network engineering, including architecture leadership and standards ownership in large or critical environments.
• Authoritative enterprise campus design across Cisco and Arista, with deep routing, switching and segmentation expertise.
• Mastery of Layer 2 resilience design - MSTP, loop prevention, and ring or redundant topologies for survivability in critical zones.
• Network access control architecture: 802.1X and MAC Authentication Bypass policy design for mixed supplicant and non-supplicant device estates.
• Network automation and configuration-as-code leadership (Python, Ansible, Git) with the ability to define standards rather than only consume them.
• Source-of-truth driven provisioning - NetBox or equivalent as the authoritative data layer for automated network provisioning.
• Monitoring and inventory architecture (SolarWinds, PRTG, syslog) and operational integration with security event handling.
• Hardware and firmware lifecycle strategy and vendor management.
• Large-scale brownfield refresh leadership across a distributed estate, including standardization, migration patterning and risk control.
• Demonstrated architecture leadership: standards ownership, cross-functional partnership, mentoring and escalation leadership.
• Willingness to operate as a working architect, including hands-on lab design and validation.
• Based in or able to work from Boulder, Colorado.

Good-to-Have Skills

These strengthen an application but will not screen a candidate out.

• ERPS (ITU-T G.8032) or equivalent Ethernet ring protection architecture experience. Narrow skill set, treated as an advantage rather than a filter.
• Networks supporting physical security devices at scale - IP cameras, access control, intercoms - including PoE, multicast and video-stream design considerations.
• Experience leading a network team inside a managed services or vendor delivery model with contractual SLAs and KPIs.
• Network access control platform architecture (Cisco ISE, Aruba ClearPass or equivalent).
• Industrial, transportation, utility or campus backgrounds where ring resilience is standard practice.
• ITIL 4 or equivalent service management grounding.

Certifications

Level

Certification

Required

Cisco CCNP or Juniper JNCIS

Preferred

CCIE or an equivalent architect-level credential; Arista ACE

Beneficial

Network automation credentials (Cisco DevNet, Python or Ansible); ERPS or ring protocol design experience; ITIL 4