Network Architect

With eleven offices across the United States, 500+ professionals and 350+ business professionals, Manatt, Phelps & Phillips, LLP (www.manatt.com), is a multidisciplinary, integrated national professional services firm known for quality and an extraordinary commitment to clients. The Firm’s groundbreaking approach - bringing together legal services, advocacy and business strategy - differentiates Manatt from its competitors and positions the Firm to provide a distinct and compelling value proposition.

The Opportunity We are seeking an experienced Network Architect to define, evolve, and govern the firm’s enterprise network architecture across remote offices, data centers, Microsoft Azure, hybrid cloud, wireless, internet connectivity, network security, and secure remote access. This role will establish architecture standards, reference designs, automation strategies, observability requirements, and technology roadmaps while providing senior technical leadership for major network modernization initiatives.

You will collaborate across the firm’s technology organization and with key technology partners to design and develop a secure, resilient, and highly available hybrid network environment. Our environment includes Cisco switching and routing, Palo Alto firewalls, Aruba wireless, SD-WAN, and Microsoft Azure hybrid networking, with a strong focus on security, resiliency, confidentiality, automation, and operational excellence.

Key Responsibilities

Enterprise Network Architecture

• Define and maintain the firm’s current-state, transitional, and target-state network architectures.
• Establish architecture standards and reference designs for enterprise routing and switching, WAN, wireless, cloud networking, remote access, network security, and related services.
• Define network resiliency, redundancy, high-availability, and recoverability standards.
• Conduct architecture and technical design reviews for significant network initiatives.
• Establish reusable design patterns that engineering teams can implement consistently.
• Identify opportunities to improve network security, performance, resiliency, scalability, standardization, and operational efficiency.

Microsoft Azure and Hybrid-Cloud Architecture

• Define the architectural direction for Microsoft Azure networking and hybrid connectivity.
• Establish standards for Azure virtual networks, subnets, IP addressing, routing, peering, network security, private connectivity, and DNS.
• Develop scalable networking patterns for Azure platforms, services, and workloads.
• Architect resilient hybrid connectivity between Azure and enterprise environments.
• Define architectural standards for ExpressRoute, VPN connectivity, BGP, private connectivity, and hybrid routing.
• Establish routing and DNS standards spanning cloud and on-premises infrastructure.
• Define Azure network segmentation and security architecture.
• Ensure new Azure solutions incorporate consistent networking, security, resiliency, observability, and automation patterns.

Zero Trust and Network Security Architecture

• Establish network architectures based on Zero Trust design principles.
• Define architectural standards for network segmentation, security boundaries, least-privilege connectivity, and secure access.
• Establish architecture standards for enterprise firewalls and secure remote access.
• Partner with Information Security and other technology teams to integrate network architecture with broader identity, endpoint, cloud, and security controls.
• Incorporate inspection, logging, telemetry, and visibility requirements into network designs.
• Ensure security considerations are integrated throughout the architecture and design process.
• Lead the evaluation and architectural direction for secure remote access, including Zero Trust Network Access (ZTNA) and application-aware or application-profiling VPN solutions. Define how the selected approach integrates with identity, endpoint, cloud, and network security controls.
• Define PKI and certificate lifecycle standards for VPN, wireless, and 802.1X authentication, including certificate authority strategy, automated renewal, and expiration monitoring.
• Define network access control (802.1X, Aruba ClearPass or comparable) and device-profiling standards.
• Lead the migration from a largely flat network to a segmented architecture in phases, without disrupting production services.
• Establish firewall policy governance and centralized management standards, including policy rationalization and cleanup (Palo Alto Panorama or Strata Cloud Manager).

Automation and Infrastructure as Code

• Define the enterprise network automation and Infrastructure-as-Code strategy.
• Establish standards and reusable patterns using Terraform, Bicep, PowerShell, Python, Ansible or Nornir, APIs, and source control.
• Develop reusable Infrastructure-as-Code patterns for Azure and hybrid networking.
• Establish governance for automation, including source control, peer review, testing, documentation, versioning, and controlled deployment.
• Advance the environment toward repeatable, configuration-driven network operations.
• Define approaches for automated configuration validation and drift detection.
• Ensure automation is incorporated into network architecture and modernization initiatives from the design stage.

Network Observability Architecture

• Define the firm’s network observability strategy across Azure, on-premises, WAN, wireless, network security, and remote-access environments.
• Establish standards for telemetry, logs, network flows, metrics, alerting, health validation, and performance visibility, using tools such as Azure Network Watcher, NetFlow/IPFIX, digital experience monitoring, and SIEM integration.
• Incorporate observability requirements into new architectures from the initial design stage.
• Define requirements for proactive service-health monitoring and network troubleshooting.
• Establish approaches for using telemetry and automation to validate network health and architectural compliance.
• Improve capabilities for early identification of service degradation and root-cause analysis.

Network Modernization and Technical Leadership

• Provide architectural leadership for SD-WAN, Azure networking, network segmentation, wireless, security, and secure-access modernization.
• Translate infrastructure assessments and security requirements into architecture standards and modernization priorities.
• Establish technology lifecycle and infrastructure-refresh principles.
• Provide technical direction to engineers during major implementations and complex technical issues.
• Evaluate emerging networking and cloud technologies against enterprise security, resiliency, scalability, operational, and cost requirements.
• Develop and maintain architecture diagrams, standards, reference designs, and technical design documentation.
• Work with strategic technology partners on assessments, architecture reviews, technical designs, and technology roadmaps.
• Contribute to multi-year network modernization and investment planning.
• Be accountable for enterprise network availability, performance, lifecycle, roadmap, and strategic vendor performance. Own the network end to end, with responsibility extending beyond standards and design.
• Design network controls that support law-firm confidentiality requirements, including ethical walls and HIPAA-driven requirements for healthcare workloads. Support responses to client security questionnaires concerning those controls.

Qualifications

• Ten or more years of progressive enterprise network engineering and architecture experience, including significant experience designing highly available, multi-site environments.
• Advanced experience with Microsoft Azure networking and hybrid-cloud architecture.
• Deep knowledge of enterprise routing, switching, WAN, WLAN, BGP, OSPF, TCP/IP, DNS, QoS, and high-availability design.
• Strong experience architecting enterprise firewall, segmentation, and secure-access solutions.
• Experience evaluating, designing, or implementing modern secure remote-access solutions, including ZTNA/SSE and application-aware or application-profiling VPN technologies.
• Experience designing PKI and certificate-based authentication for VPN, wireless, and 802.1X, including certificate lifecycle management.
• Experience with network access control (802.1X, ClearPass or comparable).
• Demonstrated experience designing network segmentation and security-zone architectures.
• Experience migrating an existing flat or lightly segmented network to a segmented design in production.
• Strong understanding and practical application of Zero Trust architecture principles.
• Experience designing SD-WAN and enterprise WAN architectures.
• Experience establishing network automation and Infrastructure-as-Code practices.
• Experience with Terraform, Bicep, PowerShell, Python, APIs, source control, or comparable automation technologies.
• Strong understanding of modern network observability, telemetry, logging, metrics, flows, and proactive monitoring.
• Familiarity with compliance frameworks that drive network controls (ISO 27001, SOC 2, HIPAA); professional services or legal industry experience is a plus.
• Experience developing architecture standards, reference designs, reusable patterns, and technology roadmaps.
• Ability to translate business, cloud, infrastructure, and security requirements into practical technical architectures.
• Strong written, presentation, documentation, and technical communication skills.
• Bachelor’s degree in information technology, Computer Science, Engineering, or a related discipline preferred.
• Industry certifications are preferred but not required; equivalent demonstrated experience will be considered. Preferred certifications are listed below.

Preferred Certifications

• Network design: Cisco CCNP Enterprise or higher is preferred, not required; CCDE or CCIE is a plus.
• Azure: AZ-700 Azure Network Engineer Associate or AZ-305 Azure Solutions Architect Expert
• Firewall: Palo Alto Networks PCNSE
• Security architecture: CISSP or Microsoft SC-100 Cybersecurity Architect Expert
• Automation: HashiCorp Terraform Associate or Cisco CCNP Automation

Hybrid Workplace Expectations

• On-Site Schedule: Work on-site three days per week for team collaboration, sprint planning, solution design, development, and support.
• Remote Work Schedule: Work remotely two days per week while maintaining strong communication and meeting delivery commitments.
• On-Call Support: Willingness to be available outside standard business hours to troubleshoot and resolve critical technical issues as needed.

The base annual pay range for this role is between $160K-$190K. The base pay to be offered will vary and depend on skills and qualifications, experience, location and will also take into account internal equity. A full range of medical, financial and/or other benefits dependent on the position will also be offered. EEO/AA EMPLOYER/Veterans/Disabled

Manatt is an equal opportunity employer, dedicated to a policy of non-discrimination in employment on any basis including race, color, physical or mental disability, religion, creed, national origin, citizenship status, ancestry, sex or gender (including gender identity, gender expression, status as a transgender or transsexual individual, pregnancy, childbirth, or related medical conditions), age (over 40), genetic information, past, current, or prospective service in the uniformed services, sexual orientation, political activity or affiliation, genetic or and any other protected classes or characteristic protected under applicable federal, state, or local law. Consistent with the American Disabilities Act, applicants may request accommodations needed to participate in the application process.

This employer will provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS), with information from each new employee’s Form I-9 to confirm work authorization. IMPORTANT: If the Government cannot confirm that you are authorized to work, this employer is required to provide you written instructions and an opportunity to contact SSA and/or DHS before taking adverse action against you, including terminating your employment.

Employers may not use E-Verify to pre-screen job applicants or to re-verify current employees and may not limit or influence the choice of documents presented for use on the Form I-9. In order to determine whether Form I-9 documentation is valid, this employer uses E-Verify’s photo screening tool to match the photograph appearing on some permanent resident and employment authorization cards with the official U.S. Citizenship and Immigration Services’ (USCIS) photograph. If you believe that your employer has violated its responsibilities under this program or has discriminated against you during the verification process based upon your national origin or citizenship status, please call the Office of Special Counsel at 1-800-255-7688 (TDD: 1-800-237-2515).