IT Networking Engineer

Telenav•Santa Clara, CA

7d•Hybrid

About The Position

The automotive industry is undergoing massive transformation – a digital transformation. Software, connectivity and cloud-connected services are redefining the driving experience. Here at Telenav, we’re proud and excited to be a part of this transformation. We started with in-car navigation and location-based services over a decade ago and are now enabling leading automotive companies like GM, Ford, Toyota and Mercedes to redefine the overall connected car digital experiences. Position Summary We are seeking an experienced IT Networking Engineer to design, deploy, operate, and secure our global hybrid network environment. This role spans our corporate offices across the US (Santa Clara), China (Shanghai and Xi’an), and Europe (Germany and Romania), our collocated data-center at Telx, and our production and development environments in AWS. The network engineer will also own the network-security posture and the integration of two-factor authentication (2FA) with GM backend. The ideal candidate is equally comfortable racking switches in a colo cage, troubleshooting BGP at 2 a.m., writing Terraform for AWS VPCs, coordinating with regional IT contacts across three continents, and tightening firewall rules to satisfy auditors.

Requirements

Bachelor’s degree in Computer Science, Information Technology, or equivalent practical experience.
5+ years of hands-on enterprise networking experience across corporate, data-center, and cloud environments.
Strong knowledge of TCP/IP, BGP, OSPF, VLAN, VXLAN, MPLS, QoS, multicast, and IPv6.
Proficiency with at least one major vendor stack (Cisco, Arista, Juniper, Palo Alto, Fortinet, F5).
Production experience with AWS networking (VPC, Transit Gateway, Direct Connect, Route 53, ELB, security groups).
Hands-on experience operating equipment in a colocation / data-center environment (Telx, Equinix, Digital Realty, or similar).
Experience supporting multi-region / multi-country office networks, including site-to-site VPN, SD-WAN, and regional ISP coordination.
Practical experience implementing MFA/2FA, RADIUS/TACACS+, SAML, and integrating with identity backends.
Solid grounding in network security: firewalls, IDS/IPS, VPN, segmentation, and incident response.
Scripting/automation skills (Python, Bash, Ansible, Terraform).
Excellent troubleshooting skills and the ability to communicate clearly with both technical and non-technical stakeholders.

Nice To Haves

Industry certifications: CCNP / CCIE, JNCIP, AWS Advanced Networking – Specialty, PCNSE, Palo Alto / Fortinet, CISSP.
Experience with SD-WAN platforms (Cisco Meraki, Viptela, Versa, Fortinet) deployed across global offices.
Experience with Kubernetes networking (CNI, Istio/Linkerd, ingress controllers).
Familiarity with SOC 2 / PCI-DSS / ISO 27001 / GDPR controls related to network and access management.
Experience integrating bespoke or in-house auth backends (similar to our GM backend) via standard protocols.
Prior experience supporting offices in mainland China (cross-border connectivity, ICP licensing, MPLS into APAC).
Working proficiency in Mandarin, German, or Romanian is a plus, but not required.

Responsibilities

Design, deploy, and maintain corporate LAN, WLAN, and WAN — including switches, routers, wireless controllers, access points, and SD-WAN appliances.
Manage office connectivity (ISP circuits, MPLS/SD-WAN, site-to-site VPNs) across all corporate locations.
Administer DNS, DHCP, IPAM, NTP, and 802.1X/NAC for wired and wireless access.
Support end-user connectivity issues escalated from the Help Desk and drive root-cause resolution.
Plan capacity, lifecycle, and refresh cycles for corporate networking hardware.
Engineer reliable connectivity into and out of mainland China, accounting for cross-border latency, the Great Firewall, and regional ISP behavior.
Maintain compliant site-to-site VPN / SD-WAN links to HQ and to AWS regions used by China teams, and partner with local carriers and ICP-licensed providers as required.
Operate office networks in compliance with GDPR and EU data-handling requirements.
Maintain redundant WAN links to HQ and to the Telx data-center, and ensure consistent identity, Wi-Fi, and security policies across both sites.
Establish a consistent global standard for switching, Wi-Fi, firewalls, and remote access across all offices, while allowing for region-specific carriers and regulatory constraints.
Coordinate with regional IT contacts, MSPs, and on-site smart-hands for installations, moves/adds/changes, and incident response across multiple time zones.
Optimize WAN performance for collaboration tools (Zoom, Teams, VoIP), code repositories, and engineering build/test traffic between regions.
Maintain regional documentation, circuit inventories, vendor contacts, and escalation paths for every site.
Participate in a follow-the-sun on-call model so that global users receive timely support regardless of region.
Own the physical and logical network at our Telx data-center, including top-of-rack and core/aggregation switching, routing, load balancers, and out-of-band management.
Manage cross-connects, carrier circuits, and peering relationships at Telx; coordinate smart-hands work with the facility.
Operate and tune dynamic routing (BGP, OSPF), VLANs/VXLAN, MLAG/stacking, and QoS.
Maintain hybrid connectivity between the Telx data-center and AWS via AWS Direct Connect, IPsec VPNs, and Transit Gateway.
Ensure environmental, power, and rack-level documentation is current; participate in DR and failover testing.
Architect and operate AWS network constructs: VPCs, subnets, route tables, NAT/IGW, Transit Gateway, Direct Connect, VPC Peering, PrivateLink, Route 53, ELB/ALB/NLB, CloudFront, Global Accelerator.
Segment and isolate production, staging, and development environments using a multi-account / Transit Gateway strategy.
Codify network infrastructure with Terraform (or CloudFormation/CDK); enforce changes through CI/CD with peer review.
Monitor performance and cost of network components; tune for latency, throughput, and spend.
Partner with DevOps/SRE teams on service connectivity, Kubernetes/EKS networking (CNI, ingress, service mesh), and observability.
Design and enforce a defense-in-depth network security posture: next-gen firewalls, IDS/IPS, web filtering, DDoS protection (AWS Shield / WAF), and micro-segmentation.
Manage perimeter, internal, and cloud security groups, NACLs, and firewall rule lifecycles with formal change control.
Implement and maintain zero-trust principles for remote access (ZTNA / SASE), site-to-site, and admin access (jump hosts, bastion, SSM Session Manager).
Maintain TLS/PKI for internal services, certificate lifecycle automation, and secrets handling for network devices.
Support compliance efforts (SOC 2, PCI-DSS, ISO 27001, GDPR, and applicable China data-protection requirements) — including evidence collection, vulnerability remediation, and audit response.
Lead incident response for network-related security events and conduct post-incident reviews.
Own the two-factor authentication (2FA/MFA) integration between network access systems (VPN, admin consoles, Wi-Fi, jump hosts, AWS SSO) with GM backend authentication service.
Configure RADIUS/TACACS+, SAML, and OIDC flows that delegate authentication and MFA challenges to the GM backend.
Maintain device-trust, conditional access, and step-up authentication policies for all global offices.
Work with the Identity team on user/group provisioning, role-based access control (RBAC), and break-glass procedures.
Monitor authentication telemetry for anomalies and integrate logs into the SIEM.
Build and maintain monitoring, alerting, and dashboards (e.g., SNMP, NetFlow/sFlow, syslog, Prometheus, Grafana, Datadog, CloudWatch, ELK).
Automate repetitive tasks with Python, Ansible, or Terraform; reduce manual change windows.
Participate in a global on-call rotation for Sev-1/Sev-2 network incidents; deliver clear RCAs and remediation plans.
Produce and maintain accurate network documentation, diagrams (Visio/Lucid/Draw.io), and runbooks for every site and environment.