Manager, Network Engineering (L2/L3)

Tract Capital Management, LP•Denver, CO

9d•$175,000 - $200,000•Hybrid

About The Position

The Manager, Network Engineering leads the active network engineering discipline within Tract Capital’s Site Communications & Network Infrastructure organization, owning the pre-construction design and construction-phase delivery of all Layer 2 / Layer 3 network infrastructure across the company’s data center campuses. It is accountable for the design and build of campus LAN and EVPN/VXLAN fabric, IP routing and addressing, segmentation, SD-WAN and WAN edge, firewall policy, metro and carrier connectivity, site-to-site VPN, mesh Wi-Fi and Private 5G, and the OT network layer carrying BMS, SCADA/EPMS, DCIM, and physical security systems — along with the network standards, policy set, performance-monitoring definition, and as-built record for every campus. Reporting to the VP, Site Communications & Network Infrastructure, this leader manages a team that includes the Senior Network Engineer, the Wireless & Private 5G Engineer, and the Network Commissioning Technician, and works shoulder-to-shoulder with the peer Managers of Inside Plant (ISP) and Outside Plant (OSP) Engineering — Network Engineering delivers the active L2/L3 layer riding on the physical plant those teams build, so the three disciplines are planned, sequenced, and commissioned as one campus package. The Manager translates design intent into buildable, secure, schedule-certain network packages and works with the Network Operations Center and Operations leadership to turn commissioned environments over cleanly. This is a Design & Build role — 24×7 monitoring, incident response, and moves/adds/changes are owned by the separate Daily Operations organization. This is a player-coach leadership role anchored in hands-on IP networking: the Manager sets direction and standards, holds genuine routing, switching, and network security depth, and holds vendors accountable for quality and schedule — while leaning on the team’s specialists in wireless/Private 5G and commissioning.

Requirements

10+ years in network engineering — L2/L3 design, routing and switching, network security, and build delivery — or an equivalent combination of education and experience. Substantial data center experience is required; exclusively enterprise/corporate IT backgrounds will not be a fit. You have delivered networks inside data center, colocation, or mission-critical facilities and understand their redundancy and change-control realities.
3+ years directly managing and developing a small technical team, in addition to leading integrators, vendors, and projects delivering network infrastructure. You do not need to have personally run routing/switching, wireless, and commissioning at once — the ability to coordinate specialists is what matters.
Deep, hands-on IP routing and switching expertise — the role’s anchor discipline — including VLANs and trunking, link aggregation, first-hop redundancy, VRFs and route policy, IP address plan design, and dynamic routing protocols (e.g., OSPF, BGP, IS-IS) including redistribution and convergence.
Hands-on VXLAN experience is required — designing, deploying, and troubleshooting leaf-spine EVPN/VXLAN fabrics, including underlay and overlay design, VNI and tenant segmentation, and multi-tenancy in a production data center environment.
Deep, hands-on experience with secure connectivity and network security enforcement — site-to-site VPNs (IPsec/IKEv2, route- and policy-based tunnels, crypto and key management, tunnel redundancy and failover, MTU/performance tuning) across campuses, remote sites, and third-party endpoints, plus next-generation firewalls, micro-segmentation, policy design, and out-of-band management.
Operational technology (OT) networking experience — designing segmented networks carrying BMS, SCADA/EPMS, DCIM, access control, and industrial control systems — with working knowledge of the protocols they run on (e.g., Modbus TCP/RTU, BACnet/IP, DNP3, OPC UA) and how these shape segmentation and QoS.
Experience evaluating metro connectivity and carrier DIA — comparing transport options (Ethernet, EPL/EVPL, dark fiber, DIA), assessing route and path diversity, and defining availability, latency, capacity, and SLA requirements — plus SD-WAN, carrier hand-off, and enough enterprise wireless familiarity (Wi-Fi 6/6E, mesh) to set acceptance criteria.
Experience authoring and enforcing network standards, policies, and configuration baselines, and defining network performance monitoring — metrics, thresholds, alerting logic, and telemetry (SNMP, streaming telemetry, flow, syslog, synthetic testing) — so environments turn over to operations with actionable visibility.
Working fluency with the physical layer — structured cabling, MDF/IDF and rack elevations, fiber pathways, entrance facilities — sufficient to collaborate credibly with inside-plant and outside-plant peers.
Strong vendor/integrator management, clear communication with internal stakeholders, and proficiency with common design and documentation tools (e.g., Visio, AutoCAD, IPAM/DDI, configuration management tooling).

Nice To Haves

Hands-on experience with Arista switching and Arista CloudVision for provisioning, configuration compliance, change control, and network telemetry.
Experience delivering network infrastructure for hyperscale or cloud campuses or large capital projects, across multiple concurrent sites including greenfield and live/retrofit environments.
Experience designing OT network segmentation to a recognized framework (e.g., Purdue model, ISA/IEC 62443, NIST SP 800-82).
Experience with network automation and infrastructure-as-code approaches (e.g., Ansible, Python, Git-based configuration management) and monitoring/observability platforms.
Experience establishing network standards, SOPs, and QA/QC programs in a fast-growth organization, and driving commissioning turnover into a 24×7 NOC.

Responsibilities

Directly lead, manage, and develop a small team of three specialists — the Senior Network Engineer, the Wireless & Private 5G Engineer, and the Network Commissioning Technician — owning hiring, goal-setting, and performance management, allocating work against the campus build schedule, and building cross-coverage so the team can support multiple concurrent campuses without single points of failure.
Own the Network Engineering function end-to-end — campus LAN and leaf-spine EVPN/VXLAN fabric, IP routing and addressing, VLAN and VRF segmentation, SD-WAN and WAN edge, firewalls, and network services (DNS/DHCP/IPAM, AAA/802.1X) — from pre-construction design through commissioning and as-built turnover.
Design and validate site-to-site VPN and encrypted interconnect architecture across campuses, remote facilities, vendor support paths, and OT remote access — IPsec/IKEv2 tunnel design, crypto and key management, redundancy and failover, and MTU/performance tuning.
Own the network standards and policy set for Design & Build — reference architectures, configuration and device-hardening standards, IP addressing and naming conventions, segmentation and security policy, and acceptance criteria — governing design reviews, exceptions, and revision control.
Design the OT/ICS network layer with Facilities, Controls, and OT Cybersecurity — zoned, segmented architecture (e.g., Purdue-model / IEC 62443 zones and conduits) carrying industrial protocols such as Modbus TCP, BACnet/IP, DNP3, and OPC UA — embedding security through micro-segmentation, out-of-band management, and device hardening.
Oversee wireless and Private 5G design — mesh Wi-Fi architecture, coverage and capacity, Private 5G core integration, and spectrum planning — relying on the Wireless & Private 5G Engineer for depth while owning integration into the core L2/L3 and security architecture.
Review and validate integrator deliverables (network diagrams, IP and VLAN schedules, BOMs, configurations, as-builts) for accuracy and standards compliance; drive integrators and vendors to deliver on time and to quality; and ensure site acceptance testing — configuration validation, resiliency testing, and security policy verification — meets standards.
Define the network performance monitoring standard for each campus — what is instrumented, which metrics and thresholds matter, and how telemetry is collected — and collaborate with the Network Operations Center and Operations leadership to set turnover requirements early and hand over commissioned environments cleanly, including configuration baselines, monitoring onboarding, escalation paths, runbooks, and readiness reviews.
Partner continuously with the peer Managers of Inside Plant (ISP) and Outside Plant (OSP) Engineering — aligning active network design to structured cabling, MDF/IDF and rack layouts, port and pathway capacity, and campus fiber routes, and jointly sequencing design packages so physical and active layers commission together.
Evaluate and specify metro connectivity and carrier direct internet access (DIA) — assessing carrier proposals, route and path diversity, capacity, and hand-off architecture; defining availability, latency, loss, and SLA requirements; and validating performance at turn-up — partnering with Carrier & Vendor Relations, Delivery Management, Construction, and Design & Engineering.