The Opportunity
We are seeking an experienced Network Architect to define, evolve, and govern the firm’s enterprise network architecture across remote offices, data centers, Microsoft Azure, hybrid cloud, wireless, internet connectivity, network security, and secure remote access.
This role will establish architecture standards, reference designs, automation strategies, observability requirements, and technology roadmaps while providing senior technical leadership for major network modernization initiatives.
You will collaborate across the firm’s technology organization and with key technology partners to design and develop a secure, resilient, and highly available hybrid network environment. Our environment includes Cisco switching and routing, Palo Alto firewalls, Aruba wireless, SD-WAN, and Microsoft Azure hybrid networking, with a strong focus on security, resiliency, confidentiality, automation, and operational excellence.
Key Responsibilities
Enterprise Network Architecture
- Define and maintain the firm’s current-state, transitional, and target-state network architectures.
- Establish architecture standards and reference designs for enterprise routing and switching, WAN, wireless, cloud networking, remote access, network security, and related services.
- Define network resiliency, redundancy, high-availability, and recoverability standards.
- Conduct architecture and technical design reviews for significant network initiatives.
- Establish reusable design patterns that engineering teams can implement consistently.
- Identify opportunities to improve network security, performance, resiliency, scalability, standardization, and operational efficiency.
Microsoft Azure and Hybrid-Cloud Architecture
- Define the architectural direction for Microsoft Azure networking and hybrid connectivity.
- Establish standards for Azure virtual networks, subnets, IP addressing, routing, peering, network security, private connectivity, and DNS.
- Develop scalable networking patterns for Azure platforms, services, and workloads.
- Architect resilient hybrid connectivity between Azure and enterprise environments.
- Define architectural standards for ExpressRoute, VPN connectivity, BGP, private connectivity, and hybrid routing.
- Establish routing and DNS standards spanning cloud and on-premises infrastructure.
- Define Azure network segmentation and security architecture.
- Ensure new Azure solutions incorporate consistent networking, security, resiliency, observability, and automation patterns.
Zero Trust and Network Security Architecture
- Establish network architectures based on Zero Trust design principles.
- Define architectural standards for network segmentation, security boundaries, least-privilege connectivity, and secure access.
- Establish architecture standards for enterprise firewalls and secure remote access.
- Partner with Information Security and other technology teams to integrate network architecture with broader identity, endpoint, cloud, and security controls.
- Incorporate inspection, logging, telemetry, and visibility requirements into network designs.
- Ensure security considerations are integrated throughout the architecture and design process.
- Lead the evaluation and architectural direction for secure remote access, including Zero Trust Network Access (ZTNA) and application-aware or application-profiling VPN solutions. Define how the selected approach integrates with identity, endpoint, cloud, and network security controls.
- Define PKI and certificate lifecycle standards for VPN, wireless, and 802.1X authentication, including certificate authority strategy, automated renewal, and expiration monitoring.
- Define network access control (802.1X, Aruba ClearPass or comparable) and device-profiling standards.
- Lead the migration from a largely flat network to a segmented architecture in phases, without disrupting production services.
- Establish firewall policy governance and centralized management standards, including policy rationalization and cleanup (Palo Alto Panorama or Strata Cloud Manager).
Automation and Infrastructure as Code
- Define the enterprise network automation and Infrastructure-as-Code strategy.
- Establish standards and reusable patterns using Terraform, Bicep, PowerShell, Python, Ansible or Nornir, APIs, and source control.
- Develop reusable Infrastructure-as-Code patterns for Azure and hybrid networking.
- Establish governance for automation, including source control, peer review, testing, documentation, versioning, and controlled deployment.
- Advance the environment toward repeatable, configuration-driven network operations.
- Define approaches for automated configuration validation and drift detection.
- Ensure automation is incorporated into network architecture and modernization initiatives from the design stage.
Network Observability Architecture
- Define the firm’s network observability strategy across Azure, on-premises, WAN, wireless, network security, and remote-access environments.
- Establish standards for telemetry, logs, network flows, metrics, alerting, health validation, and performance visibility, using tools such as Azure Network Watcher, NetFlow/IPFIX, digital experience monitoring, and SIEM integration.
- Incorporate observability requirements into new architectures from the initial design stage.
- Define requirements for proactive service-health monitoring and network troubleshooting.
- Establish approaches for using telemetry and automation to validate network health and architectural compliance.
- Improve capabilities for early identification of service degradation and root-cause analysis.
Network Modernization and Technical Leadership
- Provide architectural leadership for SD-WAN, Azure networking, network segmentation, wireless, security, and secure-access modernization.
- Translate infrastructure assessments and security requirements into architecture standards and modernization priorities.
- Establish technology lifecycle and infrastructure-refresh principles.
- Provide technical direction to engineers during major implementations and complex technical issues.
- Evaluate emerging networking and cloud technologies against enterprise security, resiliency, scalability, operational, and cost requirements.
- Develop and maintain architecture diagrams, standards, reference designs, and technical design documentation.
- Work with strategic technology partners on assessments, architecture reviews, technical designs, and technology roadmaps.
- Contribute to multi-year network modernization and investment planning.
- Be accountable for enterprise network availability, performance, lifecycle, roadmap, and strategic vendor performance. Own the network end to end, with responsibility extending beyond standards and design.
- Design network controls that support law-firm confidentiality requirements, including ethical walls and HIPAA-driven requirements for healthcare workloads. Support responses to client security questionnaires concerning those controls.
Qualifications
- Ten or more years of progressive enterprise network engineering and architecture experience, including significant experience designing highly available, multi-site environments.
- Advanced experience with Microsoft Azure networking and hybrid-cloud architecture.
- Deep knowledge of enterprise routing, switching, WAN, WLAN, BGP, OSPF, TCP/IP, DNS, QoS, and high-availability design.
- Strong experience architecting enterprise firewall, segmentation, and secure-access solutions.
- Experience evaluating, designing, or implementing modern secure remote-access solutions, including ZTNA/SSE and application-aware or application-profiling VPN technologies.
- Experience designing PKI and certificate-based authentication for VPN, wireless, and 802.1X, including certificate lifecycle management.
- Experience with network access control (802.1X, ClearPass or comparable).
- Demonstrated experience designing network segmentation and security-zone architectures.
- Experience migrating an existing flat or lightly segmented network to a segmented design in production.
- Strong understanding and practical application of Zero Trust architecture principles.
- Experience designing SD-WAN and enterprise WAN architectures.
- Experience establishing network automation and Infrastructure-as-Code practices.
- Experience with Terraform, Bicep, PowerShell, Python, APIs, source control, or comparable automation technologies.
- Strong understanding of modern network observability, telemetry, logging, metrics, flows, and proactive monitoring.
- Familiarity with compliance frameworks that drive network controls (ISO 27001, SOC 2, HIPAA); professional services or legal industry experience is a plus.
- Experience developing architecture standards, reference designs, reusable patterns, and technology roadmaps.
- Ability to translate business, cloud, infrastructure, and security requirements into practical technical architectures.
- Strong written, presentation, documentation, and technical communication skills.
- Bachelor’s degree in information technology, Computer Science, Engineering, or a related discipline preferred.
- Industry certifications are preferred but not required; equivalent demonstrated experience will be considered. Preferred certifications are listed below.
Preferred Certifications
- Network design: Cisco CCNP Enterprise or higher is preferred, not required; CCDE or CCIE is a plus.
- Azure: AZ-700 Azure Network E
