Principal Cloud & WAN Network Architect

Role Overview

The Principal Cloud & WAN Network Engineer is a senior technical authority responsible for architecting, deploying, and operating enterprise-grade hybrid network infrastructure spanning multi-cloud environments (AWS, Azure, GCP) and on-premises WAN fabrics. Operating within the Business Enablement Foundation (BEF) and Centres of Excellence (COE), this role drives the end-to-end design of scalable, secure, and high-availability network platforms that support mission-critical workloads for thousands of global consumers.

The incumbent owns the complete lifecycle of cloud network designfrom Transit Gateway hub-and-spoke topologies and Gateway Load Balancer inspection chains to SD-WAN overlay fabrics, MPLS backbone optimization, and Zero Trust Network Access (ZTNA) integration. The role acts as the definitive escalation point for P1/P2 major incidents, provides architectural governance for change advisory boards, and mentors junior engineers across disciplines.

Key Responsibilities

1. Cloud Network Architecture & Design

Architect and own end-to-end AWS networking topologies: multi-region Transit Gateway meshes, AWS Network Firewall with centralized Suricata inspection via Gateway Load Balancer (GWLB), PrivateLink service endpoints, and VPC Lattice service networking.

Design AWS Direct Connect architectures using hosted and dedicated connections, LAG bonding, and MACsec encryption for private connectivity to on-premises sites; integrate with AWS Transit Gateway (TGW) route tables and association/propagation policies.

Architect hybrid DNS resolution strategies leveraging Route 53 Resolver, inbound/outbound endpoints, and forwarding rules integrated with corporate DNS (BIND/Infoblox) for seamless split-horizon resolution.

Design and govern AWS VPC segmentation strategies—CIDR planning, shared VPC models, IPAM (AWS VPC IPAM), and inter-VPC connectivity patterns (TGW, VPC Peering, AWS PrivateLink) aligned to zero-trust principles.

Lead Azure hybrid networking designs: Azure Virtual WAN (vWAN) hub deployment, ExpressRoute Global Reach, Azure Firewall Premium with IDPS and TLS inspection, Azure Private Link, Private DNS Zones, and Virtual Network Peering at scale.

Define and implement GCP network patterns: Shared VPC, Cloud Interconnect (Partner and Dedicated), Cloud Armor WAF policies, Private Service Connect, and Cloud NAT strategies for enterprise workloads.

2. On-Premises WAN & Campus Networking

Engineer and optimize enterprise WAN fabrics built on MPLS/SR-MPLS (Cisco IOS-XR, Juniper MX), BGP policy design including route reflectors, community tagging, and MED/local-pref optimization across multi-AS environments.

Architect and deploy SD-WAN overlays (Cisco SD-WAN / Viptela, VMware VeloCloud, or Fortinet Secure SD-WAN): control-plane policies, app-aware routing, SLA-based path selection, and zero-touch provisioning (ZTP) for branch rollouts.

Design resilient site-to-site IPsec VPN architectures with IKEv2, crypto map policies, DMVPN Phase 3, and BGP over tunnels; integrate with AWS Site-to-Site VPN for hybrid failover paths alongside Direct Connect.

Manage BGP peering with upstream ISPs and cloud providers; implement advanced BGP features including route dampening, max-prefix limits, prefix filtering with prefix-lists/route-maps, and communities for traffic engineering.

Oversee QoS end-to-end: DSCP marking, queuing policies (LLQ, CBWFQ), traffic shaping, and policing from branch CPE through WAN cloud to data center—ensuring SLA adherence for real-time (voice/video) and mission-critical application traffic.

Lead physical and logical data center network design: spine-leaf fabrics (EVPN/VXLAN, Cisco ACI or Aruba CX), BGP underlay, overlay tenant segmentation, and east-west traffic control.

3. Network Security & Zero Trust

Design and enforce Zero Trust Network Access (ZTNA) architecture integrating identity-aware proxy, micro-segmentation (NSX-T / AWS Security Groups / Azure NSG), and continuous verification across cloud and WAN.

Architect centralized security inspection models: GWLB-based bump-in-the-wire for inline IDS/IPS (Suricata, Palo Alto VM-Series), East-West inspection within VPCs, and North-South traffic hairpinning via AWS Network Firewall.

Own firewall policy governance across Palo Alto Networks (Panorama-managed), Cisco ASA/FTD, Azure Firewall Premium, and cloud-native firewall solutions; define rule lifecycle management and automated compliance validation.

Imple…