Network Architect L4 / Lead Network Architect

Astreya; Boulder (CO); On-site; USD 150,000 - 190,000; Full time

Job summary

Astreya is seeking a Lead / Principal Network Architect — Physical Security to own the network architecture standards and perimeter resilience strategy for the physical security estate in Boulder, CO. This working architect role combines standards ownership with hands-on lab design and validation.

The position leads a small team, sets the Building Block topology framework, and drives automation and source-of-truth provisioning while coordinating with Infrastructure Engineering and governance

Qualifications

• 10+ years of enterprise network engineering experience, including architecture leadership and standards ownership in large or critical environments.
• Authoritative enterprise campus design across Cisco and Arista with deep routing, switching and segmentation expertise.
• Mastery of Layer 2 resilience design — MSTP, loop prevention, and ring or redundant topologies for survivability in critical zones.
• Network access control architecture: 802.1X and MAC Authentication Bypass policy design for mixed device estates.
• Network automation and configuration-as-code leadership (Python, Ansible, Git) with the ability to define standards.
• Source-of-truth driven provisioning — NetBox or equivalent as the authoritative data layer for automated provisioning.
• Monitoring and inventory architecture (SolarWinds, PRTG, syslog) and security event integration.
• Hardware and firmware lifecycle strategy and vendor management.
• Large-scale brownfield refresh leadership across a distributed estate with standardization and migration patterns.
• Demonstrated architecture leadership including mentoring and escalation leadership.
• Willingness to operate as a working architect with hands-on lab design and validation.
• Based in or able to work from Boulder, Colorado.

Responsibilities

• Own the network architecture standards and Building Block topology framework for the physical security estate.
• Define perimeter resilience and high-availability strategy with ring architecture standards and survivability requirements.
• Establish network security standards and the enforcement, monitoring, notification and mitigation model.
• Set the network access control standard including 802.1X and MAC Authentication Bypass for mixed device estates.
• Own automation and configuration-as-code strategy with golden configurations and provisioning from the source of truth.
• Set source-of-truth, monitoring, inventory standards (NetBox, SolarWinds, PRTG, syslog).
• Own hardware and firmware lifecycle strategy, EOL evaluation and vendor selection.
• Direct the global brownfield refresh program at architecture level: standardization targets and migration patterns.
• Serve as final escalation point for complex network incidents and architectural decisions.
• Partner with enterprise network teams on migration architecture integrating with the corporate network.
• Collaborate with Infrastructure Engineering to align architecture with governance, SLAs and KPIs.
• Author and approve architecture standards, design docs, and runbooks; drive resilience and security.

Skills

Enterprise network engineering

Campus design leadership

Layer 2 resilience design

Network access control architecture

Network automation & code

Source-of-truth provisioning

Monitoring & inventory architecture

Hardware & firmware lifecycle

Brownfield refresh leadership

Mentoring & escalation leadership

Hands-on lab design

Tools

Python

Ansible

Git

Cisco IOS

Arista EOS

NetBox

SolarWinds

PRTG

Syslog

Job description

Lead / Principal Network Architect — Physical Security (L4)

About the Job

The Lead / Principal Network Architect owns the network architecture standards and perimeter resilience strategy for the physical security estate. Leading a small, centralized team, the role sets the Building Block topology framework, the resilience and survivability strategy for critical zones, the network security standards and the automation direction that governs deployment at scale including the move to a source-of-truth driven, configuration-as-code provisioning model. You will own vendor and lifecycle direction, serve as the final escalation point for complex network incidents and architectural decisions, and partner with the Infrastructure Engineering team and program governance on shared security boundaries. This is a working architect role: standards ownership is exercised alongside direct involvement in lab design and validation.

Key Responsibilities

• Own the network architecture standards and Building Block topology framework for the physical security estate, setting the designs the senior team builds against.
• Define perimeter resilience and high-availability strategy, including ring architecture standards (MSTP, or ERPS where platform support exists) and cable-cut survivability requirements for critical zones.
• Establish network security standards and the enforcement, monitoring, notification and mitigation model that routes network security events to the appropriate operational teams.
• Set the network access control standard, including 802.1X and MAC Authentication Bypass policy for non-supplicant security devices, and the segmentation model for security VLANs.
• Own the automation and configuration-as-code strategy — golden configuration templates, zero-touch configuration, and the pipeline that provisions from the source of truth.
• Set source-of-truth, monitoring, inventory and observability standards (NetBox, SolarWinds, PRTG, syslog) for the network estate, and direct the migration of address management into them.
• Own network hardware and firmware lifecycle strategy, EOL evaluation, refresh planning and vendor selection across the approved platform set.
• Direct the global brownfield refresh program at architecture level: standardization targets, migration patterns, risk and rollback posture.
• Serve as the final escalation point for the most complex network incidents and architectural decisions.
• Partner with enterprise network teams on migration architecture where security networks integrate with the wider corporate network.
• Partner with the Infrastructure Engineering team and program leadership to align network architecture with shared security boundaries, governance, SLAs and KPIs.
• Author and approve network architecture standards, design documentation and runbooks; drive continuous improvement of resilience and security posture.
• Mentor and develop senior network engineers, establishing best practice and building long-term capability.

Mandatory Skills

Candidates must demonstrate the following to be considered.

• 10 or more years of enterprise network engineering, including architecture leadership and standards ownership in large or critical environments.
• Authoritative enterprise campus design across Cisco and Arista, with deep routing, switching and segmentation expertise.
• Mastery of Layer 2 resilience design — MSTP, loop prevention, and ring or redundant topologies for survivability in critical zones.
• Network access control architecture: 802.1X and MAC Authentication Bypass policy design for mixed supplicant and non-supplicant device estates.
• Network automation and configuration-as-code leadership (Python, Ansible, Git) with the ability to define standards rather than only consume them.
• Source-of-truth driven provisioning — NetBox or equivalent as the authoritative data layer for automated network provisioning.
• Monitoring and inventory architecture (SolarWinds, PRTG, syslog) and operational integration with security event handling.
• Hardware and firmware lifecycle strategy and vendor management.
• Large-scale brownfield refresh leadership across a distributed estate, including standardization, migration patterning and risk control.
• Demonstrated architecture leadership: standards ownership, cross-functional partnership, mentoring and escalation leadership.
• Willingness to operate as a working architect, including hands‑on lab design and validation.
• Based in or able to work from Boulder, Colorado.

Good-to-Have Skills

These strengthen an application but will not screen a candidate out.

• ERPS (ITU-T G.8032) or equivalent Ethernet ring protection architecture experience. Narrow skill set, treated as an advantage rather than a filter.
• Networks supporting physical security devices at scale — IP cameras, access control, intercoms — including PoE, multicast and video-stream design considerations.
• Experience leading a network team inside a managed services or vendor delivery model with contractual SLAs and KPIs.
• Network access control platform architecture (Cisco ISE, Aruba ClearPass or equivalent).
• Industrial, transportation, utility or campus backgrounds where ring resilience is standard practice.
• ITIL 4 or equivalent service management grounding.

Certifications

Level

Certification

Required

Cisco CCNP or Juniper JNCIS

Preferred

CCIE or an equivalent architect-level credential; Arista ACE

Beneficial

Network automation credentials (Cisco DevNet, Python or Ansible); ERPS or ring protocol design experience; ITIL 4