Prinicipal Network Engineer/Architect(M&A)

*This position requires prior M&A(Mergers & Acquisitions) or related experience. 30-40% travel is also required for this role*

What You'll Do

Key Responsibilities

Own the Network Domain for Each OpCo

• Domain Team Leadership: Lead the network domain team: engineers who rack, stack and configure at main offices and data rooms, and field service technicians who replace routers, switches, firewalls and access points at the distributed sites. Assign work, review configurations before they are deployed, and brief the field on what to do at each location.
• Network Discovery: Document the OpCo’s existing network: WAN and edge, circuits and carriers, site count and site types, firewall and wireless estate, IP address space, and remote and jobsite connectivity. Most acquired companies have no accurate documentation, so this is discovery work. Provide the findings to the wider integration assessment.
• Network Solution Design: Develop the OpCo’s target network against the parent company’s SD-WAN pattern and reference designs, review it with the program’s architects and domain leads, and implement the agreed design. Decisions that cross domains are made by the integration core team.
• Downstream Network Impact: Assess the impact of network changes on applications, voice and site systems, and account for those dependencies in cutover sequencing.
• Estimation and Sequencing: Estimate the network effort for the OpCo and define the sequence of work, including the connectivity other domains depend on and when they need it. Provide this to the program’s technical program manager for the integration plan.
• Risk and Rollback: Identify the risks in each network cutover, assess the impact of a failure on users and dependent sites, and define the rollback plan before the change window opens.
• Re-baselining In-Flight Work: For an integration already underway, assess the current state of the network work and the effort remaining. Partner with the parent company’s OpCo integration lead to reset the network plan and completion criteria.

Migrate and Cut Over

• Interconnect and Transit: Establish connectivity between the OpCo and the parent company network, starting with interim site-to-site VPN where that accelerates the program and moving to permanent circuits and SD-WAN transport.
• Isolation and Hardening: Deliver the segmentation, filtering and hardening the security domain requires before an OpCo network is allowed to join. Work with the parent company security architects through their review and approval.
• IP Address Space Remediation: Identify overlap between the OpCo’s address space and the parent company’s, and resolve it through re-addressing or interim translation before the networks are joined. Re-addressing DNS servers at headquarters and main branch sites carries downstream impact, so account for it in the approach chosen.
• Cisco Infrastructure: Configure, stage and deploy Cisco routing, switching, firewall and wireless infrastructure, which anchors the network solution.
• Heterogeneous Edge Estates: Assess and transition the firewall and edge platforms an OpCo arrives with, including Palo Alto Networks, Fortinet and Meraki, onto the parent company pattern.
• Cloud Network Connectivity: Deliver Azure network connectivity (VWAN, VNet and peering, VPN, firewall and NSG) as OpCo workloads move into the parent company’s subscriptions, and address AWS where an OpCo brings it.
• Field and Site Connectivity: Deliver connectivity for jobsites, yards and remote locations alongside office sites, including the circuit types and wireless coverage those locations need.
• Staging and Deployment: Run staging and deployment of network hardware ahead of each cutover, including shipping, site scheduling and the field technician assignments at each location.
• Automation and Repeatable Tooling: Build automation that makes deployment and cutover steps consistent deal to deal: configuration templates, Python or Ansible, and vendor tooling.
• Pre-Cutover Validation: Determine how each network change will be proven before the change window: lab or staged validation, a pilot site, and verification of routing, failover and the application paths that matter most. Recommend an approach and run it.
• Transition-Period Support: Keep the acquired company’s WAN and legacy remote access running while sites migrate, and change routing as each site moves. Parts of the inherited environment stay in service until the last site is cut over.
• Troubleshooting and Escalation: Take the issues the team cannot resolve, work them to root cause with logs, packet captures and device output, and keep driving resolution while high-impact problems are escalated.
• Cutover Execution: Execute the network cutover, including readiness verification, the go/no-go decision for network, rollback if required, and support through the stabilization period that follows.

Work Across the Program and Inside the OpCo

• Network Security Standards: Convey the parent company’s network security standards and their practical impact to OpCo stakeholders, and implement to those standards. Setting them is the security domain’s responsibility.
• Change Management and Evidence: Run network changes through the program change control process and produce the records it requires, in coordination with the compliance team that owns those controls.
• Service Management Records: Raise and track the domain’s work in the parent company’s service-management system, following the process for each request type, and keep it current enough that program status and completion evidence come out of it.
• Identity and Endpoint Dependencies: Partner with the identity and endpoint domain leads on the connectivity their work depends on, including directory synchronization, device enrollment and authentication paths across sites.
• Carrier and Vendor Coordination: Own the bills of materials for each site build and manage the circuit orders, carrier escalations and hardware lead times that cutover dates depend on.
• End-User Impact: Identify what changes for end users at each site: outage windows during cutover, wireless network names and remote access. Provide the technical content behind the communications to the program’s change and adoption lead, who runs them.
• Coaching OpCo Counterparts: Work with the acquired company’s network staff so they can review the design, confirm site readiness and provide business acceptance. Explain the parent company standard and how it applies to their environment.

What You'll Bring

Required Education and Experience

• Network Engineering Experience: 8-10
  • years of hands-on network engineering across routing, switching, firewall and wireless.
• Demonstrated Migration Experience: Proven network staging, deployment, migration and cutover work against live environments.
• Cisco Depth: Deep hands-on Cisco experience at the IOS and IOS-XE CLI: Catalyst 9200 and 9300 access switching, Catalyst 8000-series SD-WAN routers, Catalyst 9800 wireless controllers and Cisco Secure Firewall (FTD), or directly comparable platforms.
• Protocols and Fundamentals: IPv4 and IPv6, BGP and MBGP, OSPF, VPN, LAN and Layer 2 switching.
• SD-WAN: Hands-on experience designing and deploying SD-WAN.
• IP Address Management: Experience resolving overlapping address space, including re-addressing and translation as an interim measure.
• Network Access Control: Practical 802.1X and MAB experience and the ability to troubleshoot authentication failures end to end. Cisco ISE preferred.
• Scripting and Automation: Strong Python and Ansible or comparable configuration management tooling; infrastructure as code, Terraform preferred.
• Azure Networking: Proficiency with Azure networking, including VWAN, VNet and peering, VPN, firewall and NSG.
• Multi-Vendor Edge: Working experience with the firewall and edge platforms found in acquired environments, such as Palo Alto Networks, Fortinet and Meraki.
• Security Awareness: Understanding of network security standards and what operating inside a public-company security perimeter requires. The network is often the security boundary, so this role works closely with the parent company security architects.
• Leading Field Resources: Experience directing field service technicians or comparable on-site resources through scheduled physical work.
• Off-Hours Availability: Willingness to support scheduled weekend and off-hours work for staging, cutovers and implementation.

Direct experience that maps to this program is always a plus. Examples include:

• M&A Integration: Prior network work inside an acquisition integration.
• Public-Company Controls: Familiarity with SOX change controls and the requirements of building in a public-company environment. Helpful but not required; this can be learned on the job.
• Certifications: CCNP or CCNA, or an equivalent Cisco certification; an Azure networking certification.
• Scale Experience: Campus, data center or global WAN environments at enterprise scale.
• Wireless Depth: Enterprise wireless design and site survey experience across office and industrial locations.
• Additional Clouds: AWS networking in addition to Azure.
• Distributed Field Operations: Experience in construction, energy, utilities or similar environments with a heavy field and jobsite footprint.
• Client-Facing Delivery: Experience in a consulting or multi-firm delivery setting.