Senior Network Engineer

Vesta•Atlanta, GA

About The Position

Vesta Corporation is seeking a Senior Network Engineer to lead the design, implementation, and ongoing operations of its global enterprise network. This senior individual-contributor role combines complex multi-site networking, hybrid cloud infrastructure, and PCI compliance. The engineer will drive infrastructure modernization initiatives with limited oversight and support production environments spanning data centers, remote sites, AWS, and Azure. The role covers on-premises and cloud network architecture, routing and switching, firewalls, application delivery, DNS, hybrid connectivity, AWS network security and governance, monitoring, automation, and documentation. It includes coordination with vendors and carriers, supporting compliance and audit evidence collection, participating in an on-call rotation, working after hours for incidents, and domestic travel as needed. The position is a 6–12 month contract.

Requirements

10+ years of hands-on enterprise networking experience in large-scale, multi-site environments.
Expert-level Cisco routing and switching experience with IOS/NX-OS, BGP, OSPF, EIGRP, VLANs, STP, and QoS.
Enterprise firewall administration experience with Cisco ASA/FTD, pfSense, and Check Point, including rule management, segmentation strategy, and change control.
F5 BIG-IP LTM/GTM experience, including virtual servers, pools, iRules, traffic policies, and GTM topology records.
Cloudflare experience managing DNS, WAF rulesets, and security policies.
FireMon experience with policy analysis, rule-review workflows, and access-path validation.
Deep understanding of TCP/IP, DNS, DHCP, routing and switching protocols, and secure remote access.
Experience in PCI DSS-compliant environments, including control implementation and audit evidence collection.
Hands-on proficiency with AWS networking and security services in production environments.
Knowledge of AWS VPC architecture, subnet design and CIDR planning, route tables, internet and NAT gateways, and VPC endpoints.
Experience with VPC Peering, Transit Gateway, and AWS PrivateLink for inter-VPC and cross-account routing.
Experience configuring Site-to-Site VPN and Direct Connect, BGP peering, and failover design.
Knowledge of AWS Security Groups, Network ACLs, and VPC Flow Logs for traffic visibility and PCI segmentation.
Experience with Route 53 private hosted zones, resolver endpoints, conditional forwarding, and health-check-based failover.
Experience with ALB, NLB, and Elastic IP management.
Experience with CloudWatch metrics, alarms, dashboards, VPC Flow Logs analysis, and Transit Gateway Network Manager.
Knowledge of CloudTrail, GuardDuty, Security Hub, AWS Config, IAM policy review, and ACM.
Knowledge of AWS Organizations, SCPs, and Control Tower network guardrails.
Ability to work independently and drive projects to completion without heavy oversight.
Strong vendor management skills, including coordinating service delivery and incident resolution with carriers, ISPs, and hardware vendors.
Ability to document infrastructure for audits, incident response, and operational continuity.
Willingness and ability to travel domestically as needed; a valid driver’s license is required.
Availability for on-call rotation and after-hours support windows.
Bachelor’s degree in Information Technology, Computer Science, or a related field, or equivalent professional experience.
Cisco CCNP or higher certification in an Enterprise, Data Center, or Security track.

Nice To Haves

Proxmox VE experience, including VM/LXC provisioning, cluster management, and software-defined networking.
Infrastructure as Code experience using Terraform or CloudFormation for network provisioning and drift detection.
Experience deploying FOSS tools to replace commercial networking or monitoring products, such as Oxidized or NetBox.
Azure networking experience with Azure Firewall, NSGs, and Azure DNS private zones.
Experience with zero-trust or overlay VPN concepts and tools such as Tailscale or WireGuard.
AWS advanced networking experience, including CloudFront distributions, WAF on ALB/CloudFront, PrivateLink endpoint services, or Network Firewall.
Scripting or automation experience with Python, Bash, or Ansible.
Vendor management experience with circuit provisioning, carrier escalations, and hardware lifecycle coordination.
AWS Certified Advanced Networking – Specialty (ANS-C01) or AWS Solutions Architect – Professional.
AWS Certified Security – Specialty (SCS).
Microsoft Azure Network Engineer Associate or equivalent Azure networking certification.
Check Point CCSE or equivalent firewall platform certification.
CCIE (any track), F5 Certified BIG-IP Administrator, HashiCorp Terraform Associate, or other advanced certifications.

Responsibilities

Design, implement, and maintain secure, scalable network infrastructure across data centers, remote sites, and AWS/Azure environments.
Architect and operate routing and switching infrastructure, including BGP, NAT, VLANs, Spanning Tree, IPsec VPNs, and HSRP.
Manage and tune enterprise firewalls in alignment with PCI DSS segmentation and access-control requirements.
Administer F5 BIG-IP LTM/GTM for application delivery, load balancing, and traffic steering.
Manage Cloudflare DNS, WAF, and network security policies for internet-facing properties.
Maintain network security policy management through FireMon, including access-path analysis and rule lifecycle management.
Manage Proxmox-based virtualization for network-adjacent workloads and VM/LXC networking.
Coordinate with vendors and carriers on WAN circuits, outages, and cost optimization.
Design, deploy, and maintain AWS VPCs, including subnet and CIDR design, route tables, internet gateways, and NAT gateways across multi-account and multi-region environments.
Architect and manage VPC connectivity using VPC Peering, AWS Transit Gateway, and PrivateLink.
Configure and maintain AWS Site-to-Site VPN and Direct Connect for hybrid connectivity.
Design and enforce AWS Security Group and Network ACL policies aligned with PCI DSS segmentation requirements.
Manage AWS Route 53 DNS architecture, including private hosted zones, resolver endpoints, conditional forwarding, and failover.
Configure AWS NAT Gateways, Elastic IPs, and ALB/NLB load balancers for workload exposure and traffic routing.
Maintain AWS network connectivity for partner data and compute workloads, considering GDPR and data-sovereignty requirements.
Implement and maintain AWS network-layer security controls, including Security Groups, NACLs, VPC Flow Logs, and WAF rules on CloudFront and ALB.
Enable and manage AWS CloudTrail across accounts, integrate with centralized SIEM, and support alerting and audit evidence collection.
Configure and maintain GuardDuty, triage findings, and coordinate remediation with the security team.
Manage AWS Security Hub findings and produce compliance posture reports for PCI DSS and SOC 1 Type 2 audits.
Administer IAM policies, roles, and permission boundaries for network resource access, enforcing least privilege.
Use AWS Config rules and AWS Organizations SCPs to enforce network security standards and detect configuration drift.
Monitor AWS network health using VPC Flow Logs, CloudWatch, Transit Gateway Network Manager, and Reachability Analyzer.
Build and maintain CloudWatch dashboards and alarms for network throughput, latency, NAT Gateway utilization, VPN tunnel status, and Direct Connect metrics.
Evaluate and operationalize FOSS tools as replacements for commercial products where appropriate.
Contribute to Infrastructure as Code and automation for network resources and configuration consistency.
Maintain network topology and configuration documentation, operational runbooks, and PCI DSS/SOC 1 Type 2 audit evidence.
Participate in an on-call rotation and provide after-hours support, including for unscheduled incidents.
Travel to domestic data center and office locations as needed for deployments or incidents.