Infrastructure Architect

Mesa Associates•Madison, AL

1d•Onsite

About The Position

The Infrastructure Architect owns the design, security, and day-to-day health of Mesa’s hybrid, multi-site infrastructure, including data center and colocation, storage and backup, virtualization and VDI, networking and wireless, network security, identity, Microsoft 365, Azure, and endpoint management. This is a senior, hands-on role responsible for designing solutions, building and changing production systems, leading incident response, and documenting runbooks and change records. The role also helps guide platform modernization, zero trust access, and a governed AI platform on Azure. The Infrastructure Architect works with a small IT team, application developers, outside consultants, carriers, and vendors; serves as the top technical escalation point; and brings major decisions to the Director of IT with clear recommendations. The role is primarily office-based in Madison, Alabama, with periodic travel to regional offices and colocation data centers. It includes after-hours scheduled maintenance and escalation participation for major incidents, as well as occasional lifting of equipment up to approximately 50 pounds.

Requirements

10 or more years in IT infrastructure, including at least 5 years in a senior engineer or architect role.
Bachelor’s degree in Information Technology, Computer Science, or a related field, or equivalent experience.
Production experience with NetApp ONTAP (CLI and System Manager), including NFS, SnapMirror, upgrades, hardware, and certificate management.
Production experience with VMware vSphere/vCenter and Omnissa (VMware) Horizon VDI; working knowledge of Hyper-V and Linux.
Solid enterprise networking experience with routing, switching, VLANs, WAN circuits, VPN, and wireless.
Hands-on administration of Palo Alto firewalls (PAN-OS) and Zscaler ZIA and ZPA.
Strong Windows Server and Active Directory skills, including DNS, Group Policy, and ADCS certificate services.
Microsoft 365 and Entra ID tenant-level administration, including Conditional Access, Exchange Online, SharePoint, and Purview.
Endpoint management experience with Intune and Configuration Manager.
Working knowledge of backup and disaster recovery tools such as Veeam and Zerto.
Experience working in an ITSM process, with ServiceNow preferred, and formal change control.
Proven record of leading multi-site deployments and migrations in production environments.
Clear technical writing skills for runbooks, change records, incident summaries, and executive briefs.
Advanced PowerShell scripting skills and comfort working with REST APIs.
Ability to verify commands and vendor documentation, test with dry runs, and maintain backout plans.
Ability to investigate root causes across infrastructure layers and base conclusions on logs, documentation, and records.
Security-first judgment, clear communication, ownership, breadth across infrastructure domains, and ability to collaborate with teams, developers, consultants, and vendors.
Ability to travel periodically to regional offices and colocation data centers, participate in after-hours maintenance and major incident escalation, and occasionally lift equipment up to approximately 50 pounds.

Nice To Haves

Experience in engineering, energy, oil and gas, or manufacturing environments.
Experience supporting SOC 2 audits and regulated environments, such as nuclear or government.
Aruba Central and Aruba ClearPass Policy Manager experience; Cisco Catalyst/Nexus switching.
Okta Identity Engine administration and federation with Microsoft 365; SAML/SSO integrations.
Experience migrating workloads between hypervisors, such as VMware to Hyper-V, Nutanix AHV, or Proxmox.
NVIDIA vGPU and App Volumes experience in Horizon environments.
Azure administration, including Azure AI Foundry/Azure OpenAI, RBAC, and cost management.
Familiarity with Microsoft 365 Copilot, Copilot Studio, and AI governance controls.
Microsoft Purview and Varonis data classification and labeling.
Experience with Cortex XDR or similar EDR/XDR platforms.
Enterprise browser deployment, such as Island or Zscaler Zero Trust Browser.
NetBox, Docker, and PostgreSQL administration.
Colocation data center operations, structured/MPO fiber cabling, and UPS lifecycle management.
Certifications such as CISSP, NetApp NCIE/NCDA, VMware VCP, Palo Alto PCNSE, Cisco CCNP, Aruba ACMP/ACCP, Zscaler ZDTA/ZDTE, or Microsoft Identity and Access Administrator/Azure Administrator.

Responsibilities

Set technical direction and the infrastructure roadmap across corporate offices, branch sites, and colocation data centers, balancing security, cost, and reuse of existing hardware.
Define standards for storage, compute, network, security, and identity; lead platform evaluations and migrations, including hypervisor and secure-access platforms.
Design for resiliency through high-availability pairs, carrier and physical path diversity, replication, and documented failover.
Design and maintain segmented, restricted environments for regulated work, including dedicated network, firewall, virtualization, storage, and backup separation.
Prepare recommendations and tradeoffs for the Director of IT and leadership.
Deploy, operate, and upgrade NetApp ONTAP clusters, including aggregates, volumes, QoS, SVM networking, NFS datastores, SnapMirror replication, shelf expansion, certificate renewals, and hardware replacement.
Plan and execute data migrations, including file server moves between storage platforms and away from legacy storage, with minimal user impact.
Maintain backup and disaster recovery using Veeam and Zerto, and test and validate restores.
Manage the colocation footprint, including rack layout, power, structured and MPO fiber cabling, high-speed storage fabric, and smart-hands coordination.
Manage data center power and UPS lifecycle, including battery replacement schedules.
Administer VMware vSphere across linked vCenter servers and Microsoft Hyper-V; support hypervisor migration planning and execution.
Design and operate Omnissa Horizon environments, including Windows 11 instant-clone desktop pools, RDSH published application farms with NVIDIA vGPU, and App Volumes packaging.
Design and support Cisco Catalyst/Nexus switching, routing, VLANs, and PoE for wireless and IoT devices.
Deploy and support Aruba wireless and Aruba ClearPass NAC, including access point refreshes, IoT segmentation, 802.1X, device profiling, guest captive portal, and onboarding.
Lead circuit turn-ups, bandwidth upgrades, and cutovers with carriers and colocation providers while protecting carrier and physical path diversity.
Stand up new offices end to end, including circuits, firewall, switching, wireless, and documentation.
Maintain source-of-truth documentation in NetBox and centralized network configuration backups.
Design, deploy, and manage Palo Alto Networks firewalls, including hardware refreshes, security rules, App-ID, threat and vulnerability profiles, site-to-site VPN, policy-based forwarding, subscriptions, and renewals.
Own Zscaler ZIA and ZPA policy, including SSL inspection and bypasses, URL categories, cloud app control, Cloud Firewall, locations, GRE tunnels, authentication policies, and VPN replacement.
Support evaluation and rollout of zero trust access technologies, such as an enterprise browser.
Harden email and DNS security, including SPF, DKIM, and DMARC, and administer email security and archiving.
Conduct periodic policy audits and turn findings into prioritized remediation.
Administer Active Directory, internal PKI (ADCS), DNS, Group Policy, and AD automation tooling.
Manage Okta and Microsoft Entra ID, including Conditional Access, hybrid join, enterprise app consent and assignment, and SAML/SSO integrations.
Administer Microsoft 365 services, including Exchange Online, SharePoint, OneDrive, Teams, Defender for Cloud Apps, and licensing.
Implement Microsoft Purview retention and sensitivity labels and data classification.
Manage endpoints and servers with Intune/Autopilot and Configuration Manager (SCCM/WSUS), including upgrades, patching, and Windows Server lifecycle planning.
Investigate alerts from XDR, identity, and secure web gateway platforms; distinguish real threats from noise and document outcomes.
Lead response to identity-related incidents and implement lasting controls afterward.
Troubleshoot complex security-path issues across endpoints, proxies, and cloud services.
Track recurring risks, such as certificate expiry across infrastructure platforms, and address the underlying process.
Apply least-privilege, segmentation, and data-protection controls that support company and client security requirements.
Support SOC 2 Type 2, client security audits, security questionnaires, and quality audits for regulated work.
Review vendor security commitments, such as SOC 2 reports, during procurement.
Build and secure Azure environments, including Azure AI Foundry and Azure OpenAI resources, RBAC, network restrictions, logging, and cost separation for internal and billable work.
Implement technical controls for AI use, including Zscaler policy for AI services, Microsoft 365 Copilot and Copilot Studio licensing and governance, sensitivity labels, and blocking unapproved tools.
Support the AI governance program, its policies, and outside consultants developing it.
Write and maintain production-safe PowerShell automation with dry-run and rollback logic, and use REST APIs where no supported GUI path exists.
Administer Linux and Docker-based services, including NetBox, PostgreSQL, and Redis/Valkey, including upgrades and recovery.
Plan production changes in ServiceNow with implementation, test, risk, and backout plans; validate changes with dry runs before implementation.
Write and maintain runbooks, SOPs, knowledge articles, and build requests so procedures can be repeated by others.
Lead multi-site infrastructure projects from scoping and procurement through cutover, validation, and closeout.
Manage VARs, manufacturers, carriers, and colocation providers; open and drive support/TAC cases and hold vendors to commitments.
Review vendor quotes, renewals, contract expirations, and contract terms for technical, security, data residency, and AI-use requirements.
Support application developers with infrastructure needs, including firewall access, integrations, and API access.
Communicate status, risks, and accomplishments to IT leadership in concise written updates and executive summaries.
Serve as Tier 3 escalation, mentor infrastructure and service desk staff, and lead knowledge transfer.