Job Description

• Own the end-to-end architecture and solution design for enterprise network programs spanning campus/LAN, WAN, data center, cloud, and security-edge (SASE) domains.
• Produce High-Level Designs (HLD), Low-Level Designs (LLD), reference architectures, and design standards, including topology diagrams, IP/routing schemes, migration plans, and bill of materials.
• Lead technology evaluations, PoCs, and OEM/vendor selection, comparing solutions against functional, commercial, operational, and security criteria.
• Support pre-sales and solutioning activities — respond to RFPs/RFIs, size and cost solutions, present designs to customers and executives, and defend design decisions in technical reviews.
• Define transformation and migration strategies for legacy-to-software-defined transitions (e.g., traditional WAN → SD-WAN/SASE, classic DC → spine-leaf fabric, campus → SD-Access/fabric).
• Embed security-by-design — micro-segmentation, Zero Trust, secure edge, and integration with the broader security architecture.
• Drive network automation and Infrastructure-as-Code adoption across designs (templating, ZTP, CI/CD for network config).
• Establish design governance — architecture review boards, design patterns, guardrails, and documentation standards.
• Provide technical leadership and mentoring to network engineers and junior architects; act as design escalation point during delivery.
• Partner with cloud, security, applications, and infrastructure teams to ensure the network architecture aligns with the wider enterprise architecture and roadmaps.

Software-Defined LAN (Campus / SD-Access)

• Deep design experience with campus fabric / SD-Access architectures (e.g., Cisco SD-Access with Catalyst/DNA Center, ISE; Aruba CX / Central / ESP fabric; Juniper Mist).
• Fabric technologies: VXLAN, LISP, EVPN, fabric overlays/underlays, group-based / policy-based segmentation.
• Wired–wireless convergence, network access control (NAC/802.1X), and identity-driven segmentation.

SD-WAN

• Architecture and design across leading platforms — Cisco Catalyst SD-WAN (Viptela), Versa, VMware VeloCloud, Fortinet Secure SD-WAN, Palo Alto Prisma SD-WAN, Aruba EdgeConnect (Silver Peak).
• Core concepts: overlay/underlay design, transport independence, application-aware routing, dynamic path selection, QoS, ZTP, controller/orchestrator architecture, and hub-and-spoke vs. full-mesh topologies.
• WAN transformation and MPLS-to-internet/hybrid migration strategies.

SASE (Secure Access Service Edge)

• Design of converged network-and-security-edge architectures integrating SWG, CASB, ZTNA, FWaaS, and DLP.
• Hands-on solutioning with platforms such as Zscaler (ZIA/ZPA), Palo Alto Prisma Access, Netskope, Cisco Umbrella/Secure Access, Cato Networks, Fortinet FortiSASE.
• Zero Trust Network Access design, remote/hybrid workforce connectivity, and secure branch/direct-internet-access architectures.

Load Balancing / Application Delivery (ADC)

• Design and optimization with F5 BIG-IP (LTM, GTM/DNS, ASM, APM), Citrix ADC (NetScaler), A10, VMware NSX Advanced Load Balancer (Avi), HAProxy/NGINX.
• GSLB, SSL/TLS offload, health monitoring, persistence, WAF integration, and application high-availability design.
• Cloud-native load balancing (AWS ALB/NLB, Azure Load Balancer/Application Gateway, GCP LB).

DDI (DNS, DHCP, IPAM)

• Enterprise DDI architecture and consolidation using Infoblox, BlueCat, EfficientIP (or equivalent).

Software-Defined Data Center LAN

• Spine-leaf fabric design with Cisco ACI (APIC), VMware NSX-T/NSX, Arista (CloudVision, EVPN/VXLAN), Juniper (Apstra, QFX EVPN-VXLAN).
• Data center overlay/underlay, VXLAN-EVPN, micro-segmentation, multi-site/multi-pod, and DC interconnect (DCI).

IT/OT networks

• Experience bridging enterprise IT and operational technology (OT) environments — designing converged, segmented, and secure architectures for industrial and mission-critical networks.

Cross-Cutting Foundations

• Expert-level routing and switching: BGP, OSPF, IS-IS, EIGRP, MPLS, multicast, QoS, and high-availability/first-hop redundancy.
• Cloud networking across AWS / Azure / GCP — VPC/VNet design, Transit Gateway/vWAN, Direct Connect/ExpressRoute, hybrid connectivity, and cloud-to-DC integration.
• Network automation & IaC — Python, Ansible, Terraform, REST APIs, source control (Git), and CI/CD for network operations; source-of-truth tooling (e.g., NetBox).
• Observability & assurance — ServiceNOW, Remedy, Jira, Splunk, ThousandEyes, network performance monitoring, telemetry/streaming telemetry, and AIOps concepts.
• Security architecture integration — next-gen firewalls, segmentation, Zero Trust principles, and secure design patterns.
• Strong grasp of resiliency, capacity, performance, and DR design principles.

AI-Driven Network Operations & Assurance (AIOps)

• Design and adoption of AIOps / AI-driven assurance platforms — e.g., Cisco AI Network Analytics (Catalyst/DNA Center), Juniper Mist AI (Marvis), Aruba Central AIOps — for anomaly detection, predictive analytics, and automated root-cause analysis.
• Applying ML-driven insights to capacity planning, performance optimization, and proactive fault prediction.

• Cisco: CCIE / CCNP, Cisco Certified Specialist – SD-WAN, ACI
• Juniper: JNCIE / JNCIP; Aruba: ACMX / ACDX
• SASE / Security-edge: Zscaler (ZDTA/ZCCP), Palo Alto PCNSE / Prisma certifications, Netskope (NCCSA/NCCSP), Fortinet NSE 4–7

• Experience in a network architecture / design / solutioning capacity.
• Demonstrated track record of designing and delivering large, multi-vendor, multi-domain network solutions end to end.
• Proven experience leading network transformation / modernization programs (e.g., SD-WAN, SASE, or DC fabric migrations).
• Hands-on experience in converged IT/OT environments (e.g., manufacturing, utilities, energy, oil & gas, transportation, or similar) is strongly preferred.