Infrastructure Architect

Information Technology / Operations

This position is not eligible for recruiting or sourcing by outside parties.

Disclaimer: Be cautious and only respond to emails from our “mesainc.com” domain. We will never ask for sensitive information, such as bank account details, SSN, etc., via email. If you receive any communication asking for such information, it is not from Mesa. For any concerns or to verify the authenticity of a message, please contact us through our official channels.

We’ve got the power to energize your career and spark YOUR work/life balance through professional development and exceptional benefits. Don’t delay, plug in today for an inclusive and meaningful career. Mesa Associates, Inc. is a woman/minority-owned full service engineering, procurement, & construction management firm covering power, defense, aerospace, industrial, commercial and municipal entities. We specialize in power generation and delivery services including electrical high-voltage, substations, switchyard, transmission line, & distribution design. We have been in the top 10 of EC&M's Top 40 Electrical Design Firms since 2012. With over 1,000 associates, we are big enough to perform, but small enough to care!

Position Summary

The Infrastructure Architect owns the design, security, and day-to-day health of Mesa’s hybrid, multi-site infrastructure: data center and colocation, storage and backup, virtualization and VDI, networking and wireless, network security, identity, Microsoft 365, Azure, and endpoint management. This is a senior, hands-on role. You will design solutions, build and change production systems yourself, lead incident response, and write the runbooks and change records that let others operate what you build.

You will also help shape where the environment goes next, including platform modernization, zero trust access, and a governed AI platform on Azure. You will work with a small IT team, application developers, outside consultants, carriers, and vendors, serve as the top technical escalation point, and bring major decisions to the Director of IT with a clear recommendation.

The ideal candidate is equally comfortable whiteboarding architecture, racking and cabling hardware in a colocation cage, writing a production-safe PowerShell script, holding a carrier to its commitments, and explaining risk and tradeoffs to leadership in plain language.

Key Responsibilities

Architecture, Strategy & Standards

• Set the technical direction and roadmap for infrastructure across corporate offices, branch sites, and colocation data centers, balancing security, cost, and reuse of existing hardware.
• Define standards for storage, compute, network, security, and identity; lead platform evaluations and migrations, including hypervisor and secure-access platforms.
• Design for resiliency: HA pairs, carrier and physical path diversity, replication, and documented failover.
• Design and maintain segmented, restricted environments for regulated work (e.g., nuclear and government projects), with dedicated network, firewall, virtualization, storage, and backup separation.
• Write clear recommendations, with tradeoffs, for the Director of IT and leadership.

Data Center, Storage & Backup

• Deploy, operate, and upgrade NetApp ONTAP clusters (AFF/FAS, NVMe, SSD, and SAS), including aggregates, volumes, QoS, SVM networking, NFS datastores, SnapMirror replication, shelf expansion, certificate renewals, and hardware FRU replacement.
• Plan and run data migrations, including file server moves between storage platforms and away from legacy storage, with minimal user impact.
• Maintain backup and disaster recovery with Veeam (including NetApp storage snapshot integration) and Zerto; test and validate restores.
• Manage colocation footprint: rack layout, power, structured and MPO fiber cabling, high-speed (100G) storage fabric, and smart-hands coordination.
• Manage data center power and UPS lifecycle, including battery replacement schedules.

Virtualization & VDI

• Administer VMware vSphere across multiple linked vCenter servers and Microsoft Hyper-V; support hypervisor migration planning and execution.
• Design and run Omnissa Horizon: instant-clone Windows 11 desktop pools, RDSH published application farms with NVIDIA vGPU, and App Volumes packaging.

Network, WAN & Wireless

• Design and support Cisco Catalyst/Nexus switching, routing, VLANs, and PoE for wireless and IoT devices.
• Deploy and support Aruba wireless (Aruba Central, AP refreshes, IoT segmentation) and Aruba ClearPass NAC (802.1X, device profiling, guest captive portal, onboarding).
• Lead circuit turn-ups, bandwidth upgrades, and cutovers with carriers and colocation providers; protect carrier and physical path diversity.
• Stand up new offices end to end: circuits, firewall, switching, wireless, and documentation.
• Maintain source-of-truth documentation in NetBox (IPAM/DCIM) and centralized network configuration backups.

Network Security & Zero Trust

• Design, deploy, and manage Palo Alto Networks firewalls: hardware refreshes, security rules, App-ID, threat and vulnerability profiles, site-to-site VPN, policy-based forwarding, subscriptions, and renewals.
• Own Zscaler ZIA and ZPA policy: SSL inspection and bypasses, URL categories, cloud app control, Cloud Firewall, locations, GRE tunnels, authentication policies, and VPN replacement.
• Support evaluation and rollout of zero trust access technologies, such as an enterprise browser.
• Harden email and DNS security (SPF, DKIM, DMARC) and administer email security and archiving.
• Run periodic policy audits and turn findings into prioritized remediation.

Identity, Microsoft 365 & Endpoints

• Administer Active Directory across multiple domain controllers, internal PKI (ADCS), DNS, Group Policy, and AD automation tooling.
• Manage Okta as the federation identity provider and Microsoft Entra ID, including Conditional Access, hybrid join, enterprise app consent and assignment, and SAML/SSO integrations for SaaS applications.
• Serve as a Global Administrator for Microsoft 365: Exchange Online (user, shared, room, and resource mailboxes; recovery), SharePoint, OneDrive, Teams, Defender for Cloud Apps, and licensing.
• Implement Microsoft Purview retention and sensitivity labels and data classification.
• Manage endpoints and servers with Intune/Autopilot and Configuration Manager (SCCM/WSUS), including upgrades, patching, and Windows Server lifecycle planning.

Security Operations & Incident Response

• Investigate alerts from XDR, identity, and secure web gateway platforms; separate real threats from noise and document outcomes.
• Lead response to identity-related incidents and put lasting controls in place afterward.
• Troubleshoot complex security-path issues (TLS inspection, certificate-based authentication, TCP resets) across endpoints, proxies, and cloud services.
• Track recurring risks, such as certificate expiry across infrastructure platforms, and fix the process behind them.

Compliance & Regulated Environments

• Apply least-privilege, segmentation, and data-protection controls that support company and client security requirements.
• Support SOC 2 Type 2, client security audits, security questionnaires, and quality audits for regulated (e.g., nuclear) work.
• Review vendor security commitments (e.g., SOC 2 reports) as part of procurement.

Cloud & AI Platform Governance

• Build and secure Azure environments, including Azure AI Foundry and Azure OpenAI resources, RBAC, network restrictions, logging, and cost separation for internal and billable work.
• Implement technical controls for AI use: Zscaler policy for AI services, Microsoft 365 Copilot and Copilot Studio agent licensing and governance, sensitivity labels, and blocking of unapproved tools.
• Support the AI governance program, its policies, and the outside consultants developing it.

Automation, Change Management & Documentation

• Write and maintain production-safe PowerShell automation (file/SMB share migrations, labeling, mailbox recovery, reporting) with dry-run and rollback logic; use REST APIs where no supported GUI path exists.
• Administer Linux and Docker-based services (e.g., NetBox, PostgreSQL, Redis/Valkey), including upgrades and recovery.
• Plan production changes in ServiceNow with implementation, test, risk, and backout plans; validate with dry runs before going live.
• Write and maintain runbooks, SOPs, knowledge articles, and build requests so procedures can be repeated by others.

Vendor, Project & Stakeholder Leadership

• Lead multi-site infrastructure projects from scoping and procurement through cutover, validation, and closeout.
• Manage VARs, manufacturers, carriers, and colocation providers; open and drive support/TAC cases; hold vendors to their commitments.
• Review vendor quotes, renewals, contract expirations, and contract terms for technical, security, data residency, and AI-use requirements.
• Support application developers with infrastructure needs (firewall access, integrations, API access).
• Communicate status, risks, and accomplishments to IT leadership in concise written updates and executive summaries.
• Serve as Tier 3 escalation; mentor infrastructure and service desk staff and lead knowledge transfer.

Required Qualifications

• 10+ years in IT infrastructure, with at least 5 years in a senior engineer or architect role.
• Bachelor’s degree in Information Technology, Computer Science, or a related field, or equivalent experience.
• Production experience with NetApp ONTAP (CLI and System Manager), including NFS, SnapMirror, upgrades, hardware, and certificate management.
• Production experience with VMware vSphere/vCenter and Omnissa (VMware) Horizon VDI; working knowledge of Hyper-V and Linux.
• Solid enterprise networking: routing, switching, VLANs, WAN circuits, VPN, and wireless.
• Hands-on administration of Palo Alto firewalls (PAN-OS) and Zscaler ZIA and ZPA.
• Strong Windows Server and Active Directory skills, including DNS, Group Policy, and ADCS certificate services.
• Microsoft 365 and Entra ID administration at the tenant level, including Conditional Access, Exchange Online, SharePoint, and Purview.
• Endpoint management with Intune and Configuration Manager.
• Working knowledge of backup and DR tools such as Veeam and Zerto.
• Experience working in an ITSM process (ServiceNow preferred) with formal change control.
• Proven record of leading multi-site deployments and migrations in production environments.
• Clear technical writing: runbooks, change records, incident summaries, and executive briefs.
• Advanced PowerShell scripting and comfort working with REST APIs.

Preferred Qualifications

• Experience within engineering, energy, oil and gas, or manufacturing environments.
• Experience supporting SOC 2 audits and regulated environments (nuclear, government, or similar).
• Aruba Central and Aruba ClearPass Policy Manager experience; Cisco Catalyst/Nexus switching.
• Okta Identity Engine administration and federation with Microsoft 365; SAML/SSO integrations.
• Experience migrating workloads between hypervisors (e.g., VMware to Hyper-V, Nutanix AHV, or Proxmox).
• NVIDIA vGPU and App Volumes in Horizon environments.
• Azure administration, including Azure AI Foundry/Azure OpenAI, RBAC, and cost management.
• Familiarity with Microsoft 365 Copilot, Copilot Studio, and AI governance controls.
• Microsoft Purview and Varonis data classification and labeling.
• Experience with Cortex XDR or similar EDR/XDR platforms.
• Enterprise browser deployment (e.g., Island or Zscaler Zero Trust Browser).
• NetBox, Docker, and PostgreSQL administration.
• Colocation data center operations, structured/MPO fiber cabling, and UPS lifecycle management.
• Certifications such as CISSP, NetApp NCIE/NCDA, VMware VCP, Palo Alto PCNSE, Cisco CCNP, Aruba ACMP/ACCP, Zscaler ZDTA/ZDTE, or Microsoft Identity and Access Administrator / Azure Administrator.

Core Competencies

• Production discipline: Verifies commands and vendor documentation before acting, tests with dry runs, and always has a backout plan.
• Root cause thinking: Traces problems across layers (storage, network, proxy, identity, client) instead of stopping at the first symptom.
• Evidence-driven: Bases conclusions on logs, documentation, and records rather than assumptions.
• Security-first judgment: Applies least privilege and defaults to the narrowest change that solves the problem.
• Clear communication: Writes short, accurate updates, adapts tone for engineers, vendors, and executives, and explains the reason behind each action.
• Ownership: Takes projects from evaluation through build, documentation, and handoff, and says plainly when something went wrong.
• Breadth with depth: Comfortable moving between storage, network, security, identity, and cloud in the same day.
• Collaboration: Works well with a small team, developers, consultants, and vendors, and holds vendors to their commitments.

Working Conditions

• Primarily office-based in Madison, AL, with periodic travel to regional offices and colocation data centers.
• After-hours work for scheduled maintenance windows and participation in escalation for major incidents.
• Occasional lifting of equipment up to approximately 50 lbs in server rooms, data closets, and colocation facilities.

Benefits

• Paid Time Off
• Holiday Pay – 10 Annually
• Group Medical/Dental Insurance
• Life Insurance (Company Paid)
• Disability Insurance (Company Paid)
• 401(K) Retirement Savings Plan
• 401(K) Matching Contribution
• Section 125 / Cafeteria Plan
• Long Term Care Insurance
• Tuition Reimbursement
• Fitness Center Reimbursement
• Annual Performance Bonus
• 9/80 Work Schedule

Notice to External Search Firms: Mesa Associates, Inc. and its subsidiaries do not accept unsolicited resumes and will not be obligated to pay a placement fee for unsolicited resumes. Mesa Associates, Inc. Talent Acquisition engages with approved search firms directly for specific hiring needs.