Systems Operations Architect

Allen Media Group•Atlanta, GA

17d•Hybrid

About The Position

The Systems Operations Architect is the systems team’s senior technical design authority, responsible for the architecture and recoverability of the platform estate, including directory and identity infrastructure, virtualization and compute, storage and data protection, and Windows and Linux operating environments. This is a hands-on role: the architect builds proofs of concept, writes automation, participates in maintenance windows, and takes escalations when recovery does not proceed as documented. The role leads through design authority and technical credibility, without direct reports or authority over matrixed engineers or application owners. The position owns the correctness of platform architecture, proven recovery capability, and deliberate reduction of technical debt. It sets engineering standards, reviews significant designs and changes, leads recovery for major platform incidents, drives architecture-related postmortem actions, mentors engineers, and coordinates shared work across business units. It also serves as the Director’s technical delegate in vendor and architecture reviews and supports audits, assessments, and cyber insurance questionnaires. The role requires clear, architecture-grade documentation and communication: documenting requirements, constraints, alternatives, failure modes, and migration paths; presenting decisions to technical peers; translating cost, risk, and business impact for executives; and providing accurate, timely incident updates. The successful candidate verifies designs through testing, surfaces problems early with recommendations, and takes accountability for architectural outcomes. The position is based in Atlanta with hybrid/onsite expectations. It participates in an on-call rotation, serves as a senior escalation for major platform incidents and recoveries, and may work outside business hours for maintenance windows, migrations, and recovery exercises. Occasional travel to sites or facilities is required.

Requirements

10 or more years of enterprise systems engineering experience, including at least 3 years in an architect- or principal-level role.
Expert-level Active Directory design, hardening, tiering, and enterprise-scale remediation experience beyond administration alone.
Deep design and operational experience with VMware vSphere/vCenter, including storage and failure-domain design.
Demonstrated ownership of backup, recovery, and disaster recovery architecture, with real recovery experience under pressure.
Architecture-level competence in both Windows Server and Linux; the role cannot be filled by a Windows-only or Linux-only engineer.
Experience designing patch and configuration management across a mixed estate, with automation and infrastructure-as-code using PowerShell, Python, Terraform, Ansible, or equivalent.
Experience operating in a 24x7 environment where downtime is externally visible.
Working understanding of identity and privileged access platforms, such as Okta and BeyondTrust or comparable PAM tools, as an integration partner.
Track record of leading technical work through people who do not report directly to the candidate.
Bachelor’s degree or equivalent practical experience.
Ability to take ownership of architecture and its consequences, verify recovery and redundancy through testing, surface bad news early with recommendations, make independent technical decisions, and deliberately retire technical debt.
Ability to document and defend architecture, communicate technical decisions and business impact, and provide clear updates during incidents.

Nice To Haves

VCP/VCAP, Microsoft Windows Server or Entra ID certifications, RHCE, or equivalent depth demonstrated through work history; CISSP is a plus.
Experience executing a directory, hypervisor, or backup platform migration.
Experience with a data center or facility build, migration, or consolidation.
Experience supporting broadcast, playout, or media asset management infrastructure.
Production experience applying hardening frameworks such as CIS or STIG.
Media, broadcast, or another 24x7 operational background.

Responsibilities

Own Active Directory and Entra ID architecture, including forest and domain design, trust model, sites and replication, DNS, and hybrid identity synchronization.
Own the tiered administration model, including administrative tiering, privileged access workstations, clean-source principles, and reducing standing domain-level privilege.
Own Group Policy and configuration architecture, including migration toward modern management where appropriate.
Own Active Directory Certificate Services design, including hierarchy, templates, autoenrollment, lifecycle, and CA-expiration planning.
Design service account and machine identity architecture, including gMSAs, credential rotation, and privileged access management integration.
Partner with the identity function on Okta integration, authoritative sources of truth, and authentication flows across on-premises and SaaS services.
Own VMware vSphere/vCenter architecture, including cluster and failure-domain design, HA and DRS policy, admission control sizing, host lifecycle, and storage presentation.
Evaluate hypervisor platform strategy and alternatives, including the Broadcom licensing trajectory, and provide the Director with a defensible recommendation based on cost, risk, and migration effort.
Design platform storage architecture, including capacity, performance tiering, replication, and interactions with media storage.
Own capacity planning and hardware refresh cycles, supporting purchasing decisions with data.
Design hybrid and cloud IaaS footprints across GCP, AWS, and Azure, including landing zones, connectivity, workload placement criteria, and migration paths.
Own backup and recovery architecture, including coverage, immutability, isolated copies, retention, and replication topology.
Define workload recovery tiers and business-agreed RTO and RPO commitments.
Design and prove ransomware recovery capabilities, including isolated recovery environments, clean-room restore procedures, and Active Directory forest recovery; own the runbook and lead exercises.
Establish restore testing as an architectural requirement and publish test results.
Own disaster recovery design for critical platform services, including dependency mapping and recovery order.
Own standards, hardening baselines, and golden images for Windows Server, Windows endpoints, and Ubuntu Linux, using CIS Benchmarks or DISA STIG as references.
Own patch architecture across Windows and Linux, including tooling, ring strategy, maintenance windows, exception handling, and emergency patch capability.
Own configuration management and infrastructure-as-code direction and drive declarative, repeatable builds.
Own OS lifecycle and end-of-support planning so migrations are scheduled in advance.
Design provisioning and decommissioning so systems have correct monitoring, backup, patching, and inventory records.
Set engineering standards, review designs and significant changes, and serve as a top technical escalation for platform incidents and difficult recoveries.
Own postmortems for architecture-related system failures and drive corrective actions to completion.
Mentor engineers and build team capability to reduce single points of failure.
Coordinate matrixed engineers and application owners on shared work, setting outcomes and expectations and following through to closure.
Act as the Director’s technical delegate in vendor and architecture review sessions.
Support audits, assessments, and cyber insurance questionnaires with accurate architectural detail and evidence.
Produce architecture-grade designs, standards, runbooks, and recovery procedures; present and defend architecture and communicate business impact to executives.
Participate in an on-call rotation, major incident response, maintenance windows, migrations, and recovery exercises, including work outside business hours.
Travel occasionally to sites or facilities.