Infrastructure Architect

Mesa Associates, Inc•Madison, AL

2d•Onsite

About The Position

The Infrastructure Architect owns the design, security, and day-to-day health of Mesa’s hybrid, multi-site infrastructure, including data center and colocation systems, storage and backup, virtualization and VDI, networking and wireless, network security, identity, Microsoft 365, Azure, and endpoint management. This is a senior, hands-on role involving solution design, production implementation, incident response, and creation of runbooks and change records. The architect helps shape platform modernization, zero trust access, and a governed AI platform on Azure, working with a small IT team, application developers, outside consultants, carriers, and vendors. The position serves as the top technical escalation point and provides recommendations on major decisions to the Director of IT. The role sets infrastructure direction and standards; operates data center, storage, backup, virtualization, network, identity, cloud, and endpoint platforms; leads security operations and incident response; and supports compliance and regulated environments. It also leads multi-site projects and migrations, manages vendors, documents and automates production work, and communicates risks and status to IT leadership. The position is primarily office-based in Madison, Alabama, with periodic travel to regional offices and colocation data centers. After-hours work is required for scheduled maintenance windows, with participation in escalation for major incidents. Occasional lifting of equipment up to approximately 50 pounds is required.

Requirements

10+ years in IT infrastructure, including at least 5 years in a senior engineer or architect role.
Bachelor’s degree in Information Technology, Computer Science, or a related field, or equivalent experience.
Production experience with NetApp ONTAP (CLI and System Manager), including NFS, SnapMirror, upgrades, hardware, and certificate management.
Production experience with VMware vSphere/vCenter and Omnissa (VMware) Horizon VDI; working knowledge of Hyper-V and Linux.
Solid enterprise networking skills, including routing, switching, VLANs, WAN circuits, VPN, and wireless.
Hands-on administration of Palo Alto firewalls (PAN-OS) and Zscaler ZIA and ZPA.
Strong Windows Server and Active Directory skills, including DNS, Group Policy, and ADCS certificate services.
Microsoft 365 and Entra ID tenant-level administration, including Conditional Access, Exchange Online, SharePoint, and Purview.
Endpoint management experience with Intune and Configuration Manager.
Working knowledge of backup and disaster recovery tools such as Veeam and Zerto.
Experience working in an ITSM process; ServiceNow is preferred, with formal change control.
Proven record of leading multi-site deployments and migrations in production environments.
Clear technical writing skills for runbooks, change records, incident summaries, and executive briefs.
Advanced PowerShell scripting and comfort working with REST APIs.
Ability to work after hours for scheduled maintenance windows and participate in escalation for major incidents.
Ability to occasionally lift equipment up to approximately 50 pounds.

Nice To Haves

Experience within engineering, energy, oil and gas, or manufacturing environments.
Experience supporting SOC 2 audits and regulated environments such as nuclear or government.
Aruba Central and Aruba ClearPass Policy Manager experience; Cisco Catalyst/Nexus switching.
Okta Identity Engine administration and federation with Microsoft 365; SAML/SSO integrations.
Experience migrating workloads between hypervisors such as VMware, Hyper-V, Nutanix AHV, or Proxmox.
NVIDIA vGPU and App Volumes experience in Horizon environments.
Azure administration, including Azure AI Foundry/Azure OpenAI, RBAC, and cost management.
Familiarity with Microsoft 365 Copilot, Copilot Studio, and AI governance controls.
Microsoft Purview and Varonis data classification and labeling.
Experience with Cortex XDR or similar EDR/XDR platforms.
Enterprise browser deployment, such as Island or Zscaler Zero Trust Browser.
NetBox, Docker, and PostgreSQL administration.
Colocation data center operations, structured/MPO fiber cabling, and UPS lifecycle management.
Certifications such as CISSP, NetApp NCIE/NCDA, VMware VCP, Palo Alto PCNSE, Cisco CCNP, Aruba ACMP/ACCP, Zscaler ZDTA/ZDTE, or Microsoft Identity and Access Administrator/Azure Administrator.

Responsibilities

Set the technical direction and roadmap for infrastructure across corporate offices, branch sites, and colocation data centers, balancing security, cost, and reuse of existing hardware.
Define standards for storage, compute, network, security, and identity; lead platform evaluations and migrations, including hypervisor and secure-access platforms.
Design for resiliency, including high-availability pairs, carrier and physical path diversity, replication, and documented failover.
Design and maintain segmented, restricted environments for regulated work, with dedicated network, firewall, virtualization, storage, and backup separation.
Prepare recommendations and explain tradeoffs to the Director of IT and leadership.
Deploy, operate, and upgrade NetApp ONTAP clusters, including storage configuration, replication, shelf expansion, certificate renewals, and hardware replacement.
Plan and execute data migrations, including file server moves between storage platforms, with minimal user impact.
Maintain backup and disaster recovery with Veeam and Zerto, and test and validate restores.
Manage colocation operations, including rack layout, power, structured and MPO fiber cabling, high-speed storage fabric, and smart-hands coordination.
Manage data center power and UPS lifecycle, including battery replacement schedules.
Administer VMware vSphere across multiple linked vCenter servers and Microsoft Hyper-V; support hypervisor migration planning and execution.
Design and operate Omnissa Horizon environments, including Windows 11 desktop pools, RDSH published application farms with NVIDIA vGPU, and App Volumes packaging.
Design and support Cisco Catalyst/Nexus switching, routing, VLANs, and PoE for wireless and IoT devices.
Deploy and support Aruba wireless and Aruba ClearPass NAC, including access point refreshes, segmentation, 802.1X, device profiling, guest access, and onboarding.
Lead circuit turn-ups, bandwidth upgrades, and cutovers with carriers and colocation providers, maintaining carrier and physical path diversity.
Stand up new offices end to end, including circuits, firewall, switching, wireless, and documentation.
Maintain network source-of-truth documentation in NetBox and centralized network configuration backups.
Design, deploy, and manage Palo Alto Networks firewalls, including refreshes, security rules, profiles, VPN, policy-based forwarding, subscriptions, and renewals.
Own Zscaler ZIA and ZPA policies, including SSL inspection, URL categories, cloud app control, Cloud Firewall, locations, GRE tunnels, authentication policies, and VPN replacement.
Support evaluation and rollout of zero trust access technologies, such as an enterprise browser.
Harden email and DNS security, administer email security and archiving, and run policy audits with prioritized remediation.
Administer Active Directory, internal PKI (ADCS), DNS, Group Policy, and AD automation tooling.
Manage Okta and Microsoft Entra ID, including Conditional Access, hybrid join, enterprise app consent and assignment, and SAML/SSO integrations.
Administer Microsoft 365, including Exchange Online, SharePoint, OneDrive, Teams, Defender for Cloud Apps, and licensing.
Implement Microsoft Purview retention and sensitivity labels and data classification.
Manage endpoints and servers with Intune/Autopilot and Configuration Manager (SCCM/WSUS), including upgrades, patching, and Windows Server lifecycle planning.
Investigate alerts from XDR, identity, and secure web gateway platforms; distinguish threats from noise and document outcomes.
Lead response to identity-related incidents and implement lasting controls afterward.
Troubleshoot complex security-path issues across endpoints, proxies, and cloud services.
Track recurring risks, such as certificate expiry, and improve the processes that address them.
Apply least-privilege, segmentation, and data-protection controls supporting company and client security requirements.
Support SOC 2 Type 2, client security audits, security questionnaires, and quality audits for regulated work.
Review vendor security commitments as part of procurement.
Build and secure Azure environments, including Azure AI Foundry and Azure OpenAI resources, RBAC, network restrictions, logging, and cost separation.
Implement technical controls for AI use, including Zscaler policies, Microsoft 365 Copilot and Copilot Studio licensing and governance, sensitivity labels, and blocking unapproved tools.
Support the AI governance program, its policies, and outside consultants developing it.
Write and maintain production-safe PowerShell automation with dry-run and rollback logic, and use REST APIs where no supported GUI path exists.
Administer Linux and Docker-based services, including NetBox, PostgreSQL, and Redis/Valkey, including upgrades and recovery.
Plan production changes in ServiceNow with implementation, test, risk, and backout plans; validate changes with dry runs.
Write and maintain runbooks, SOPs, knowledge articles, and build requests.
Lead multi-site infrastructure projects from scoping and procurement through cutover, validation, and closeout.
Manage VARs, manufacturers, carriers, and colocation providers; drive support cases and hold vendors to their commitments.
Review vendor quotes, renewals, contract expirations, and contract terms for technical, security, data residency, and AI-use requirements.
Support application developers with infrastructure needs, including firewall access, integrations, and API access.
Communicate status, risks, and accomplishments to IT leadership in written updates and executive summaries.
Serve as Tier 3 escalation, mentor infrastructure and service desk staff, and lead knowledge transfer.