LAN Architect

The LAN Architect is a senior subject matter expert responsible for enterprise campus and data center local area network (LAN) design and operations. This role owns LAN architecture standards, leads complex design and migration initiatives, and serves as the technical authority for wired access, segmentation, and IEEE 802.1X network access policy. The position requires deep Cisco and Juniper switching experience and strong Cisco Identity Services Engine (ISE) expertise.

Responsibilities:

• Design, document, and govern LAN architectures across access, distribution, core, and fabric layers on Cisco and Juniper platforms, including Ethernet VPN-Virtual Extensible LAN (EVPN-VXLAN) and campus fabric where applicable.

• Architect and refine Cisco ISE deployments, including 802.1X, MAC Authentication Bypass (MAB), authorization policy, profiling, posture, Cisco TrustSec and Security Group Tags (SGTs), guest access, bring your own device (BYOD), and policy-set design.

• Define reference designs, configuration standards, and templates, and lead design reviews for new sites, technology refreshes, and migrations.

• Lead complex troubleshooting and root-cause analysis for Layer 2, Layer 3, and authentication issues, and drive permanent corrective actions.

• Plan and support cutovers, change windows, lifecycle upgrades, rollback procedures, and post-change validation.

• Partner with network security, wireless, wide area network (WAN), and tools teams to align LAN designs with segmentation, visibility, and automation goals.

• Contribute to automation of configuration, compliance, and testing using Python, Ansible, or similar tooling.

• Collaborate openly with architects, engineers, project managers, and customer stakeholders; share knowledge, document work for others, and communicate clearly in a team setting.

• 10 or more years of enterprise network engineering or architecture experience with a primary focus on LAN environments.

• Expert-level knowledge of Cisco Catalyst and Nexus and Juniper EX and QFX switching, including Spanning Tree Protocol (STP), virtual LANs (VLANs), Link Aggregation Control Protocol (LACP), Open Shortest Path First (OSPF), Border Gateway Protocol (BGP), multicast, quality of service (QoS), and high availability.

• Hands-on production design and administration experience with Cisco ISE, including distributed deployments, policy sets, profiling, certificates, and integration with Active Directory (AD), Lightweight Directory Access Protocol (LDAP), and mobile device management (MDM).

• Strong understanding of network segmentation and zero-trust access concepts.

• Proven ability to produce high-quality design documents, diagrams, and runbooks.

Preferred qualifications

• Experience with Cisco DNA Center or Catalyst Center, Juniper Mist or Apstra, and Cisco Software-Defined Access (SD-Access).

• Scripting and automation experience using Python, Ansible, and REST application programming interfaces (APIs).

• Experience working in a regulated environment such as life sciences or pharmaceuticals.

• Cisco Certified Network Professional (CCNP) or Cisco Certified Internetwork Expert (CCIE) in Enterprise or Security, Juniper Networks Certified Internet Professional (JNCIP) or Juniper Networks Certified Internet Expert (JNCIE), or Cisco ISE certification.

Tools and Technologies:

Cisco Catalyst and Nexus; Juniper EX and QFX; Cisco Identity Services Engine (ISE); 802.1X; MAB; Cisco TrustSec and SGTs; EVPN-VXLAN; STP; VLANs; LACP; OSPF; BGP; multicast; QoS; Cisco DNA Center or Catalyst Center; Juniper Mist; Apstra; SD-Access; Python; Ansible; REST APIs; AD; LDAP; and MDM.