{"id":3641906,"url":"https://alion.io/job/mesa-associates-infrastructure-architect","title":"Infrastructure Architect","company":{"id":2305500,"name":"Mesa Associates","domain":"mesainc.com","url":"https://alion.io/company/mesainc","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"UltiPro","truth_index":{"grade":"B","score":75,"open_postings":3,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":22,"computed_at":"2026-11-04T06:34:25Z"}},"role":"DevOps","role_family":"DevOps","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Madison, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Azure","optional":false},{"name":"Copilot","optional":false},{"name":"Copilot Studio","optional":false},{"name":"DNS","optional":false},{"name":"Docker","optional":false},{"name":"Hyper-V","optional":false},{"name":"ITSM","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Okta","optional":false},{"name":"OneDrive","optional":false},{"name":"OpenAI","optional":false},{"name":"PKI","optional":false},{"name":"PostgreSQL","optional":false},{"name":"PowerShell","optional":false},{"name":"Redis","optional":false},{"name":"Rest API","optional":false},{"name":"Service Desk","optional":false},{"name":"ServiceNow","optional":false},{"name":"SharePoint","optional":false},{"name":"SOC 2","optional":false},{"name":"VMWare","optional":false},{"name":"VPN","optional":false},{"name":"Windows","optional":false},{"name":"Windows Server","optional":false},{"name":"Zero Trust","optional":false},{"name":"Zscaler","optional":false},{"name":"Cortex XDR","optional":true},{"name":"Proxmox VE","optional":true}],"status":"live","first_seen_at":"2026-11-02T18:45:11Z","employer_posted_date":"2026-11-02","last_verified_at":"2026-11-04T02:47:28Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Information Technology / Operations\nThis position is not eligible for recruiting or sourcing by outside parties.\nDisclaimer: Be cautious and only respond to emails from our “mesainc.com” domain. We will never ask for sensitive information, such as bank account details, SSN, etc., via email. If you receive any communication asking for such information, it is not from Mesa. For any concerns or to verify the authenticity of a message, please contact us through our official channels.\nWe’ve got the power to energize your career and spark YOUR work/life balance through professional development and exceptional benefits. Don’t delay, plug in today for an inclusive and meaningful career. Mesa Associates, Inc. is a woman/minority-owned full service engineering, procurement, & construction management firm covering power, defense, aerospace, industrial, commercial and municipal entities. We specialize in power generation and delivery services including electrical high-voltage, substations, switchyard, transmission line, & distribution design. We have been in the top 10 of EC&M's Top 40 Electrical Design Firms since 2012. With over 1,000 associates, we are big enough to perform, but small enough to care!\nPosition Summary\nThe Infrastructure Architect owns the design, security, and day-to-day health of Mesa’s hybrid, multi-site infrastructure: data center and colocation, storage and backup, virtualization and VDI, networking and wireless, network security, identity, Microsoft 365, Azure, and endpoint management. This is a senior, hands-on role. You will design solutions, build and change production systems yourself, lead incident response, and write the runbooks and change records that let others operate what you build.\nYou will also help shape where the environment goes next, including platform modernization, zero trust access, and a governed AI platform on Azure. You will work with a small IT team, application developers, outside consultants, carriers, and vendors, serve as the top technical escalation point, and bring major decisions to the Director of IT with a clear recommendation.\nThe ideal candidate is equally comfortable whiteboarding architecture, racking and cabling hardware in a colocation cage, writing a production-safe PowerShell script, holding a carrier to its commitments, and explaining risk and tradeoffs to leadership in plain language.\nKey Responsibilities \nArchitecture, Strategy & Standards\nSet the technical direction and roadmap for infrastructure across corporate offices, branch sites, and colocation data centers, balancing security, cost, and reuse of existing hardware.\nDefine standards for storage, compute, network, security, and identity; lead platform evaluations and migrations, including hypervisor and secure-access platforms.\nDesign for resiliency: HA pairs, carrier and physical path diversity, replication, and documented failover.\nDesign and maintain segmented, restricted environments for regulated work (e.g., nuclear and government projects), with dedicated network, firewall, virtualization, storage, and backup separation.\nWrite clear recommendations, with tradeoffs, for the Director of IT and leadership.\nData Center, Storage & Backup\nDeploy, operate, and upgrade NetApp ONTAP clusters (AFF/FAS, NVMe, SSD, and SAS), including aggregates, volumes, QoS, SVM networking, NFS datastores, SnapMirror replication, shelf expansion, certificate renewals, and hardware FRU replacement.\nPlan and run data migrations, including file server moves between storage platforms and away from legacy storage, with minimal user impact.\nMaintain backup and disaster recovery with Veeam (including NetApp storage snapshot integration) and Zerto; test and validate restores.\nManage colocation footprint: rack layout, power, structured and MPO fiber cabling, high-speed (100G) storage fabric, and smart-hands coordination.\nManage data center power and UPS lifecycle, including battery replacement schedules.\nVirtualization & VDI\nAdminister VMware vSphere across multiple linked vCenter servers and Microsoft Hyper-V; support hypervisor migration planning and execution.\nDesign and run Omnissa Horizon: instant-clone Windows 11 desktop pools, RDSH published application farms with NVIDIA vGPU, and App Volumes packaging.\nNetwork, WAN & Wireless\nDesign and support Cisco Catalyst/Nexus switching, routing, VLANs, and PoE for wireless and IoT devices.\nDeploy and support Aruba wireless (Aruba Central, AP refreshes, IoT segmentation) and Aruba ClearPass NAC (802.1X, device profiling, guest captive portal, onboarding).\nLead circuit turn-ups, bandwidth upgrades, and cutovers with carriers and colocation providers; protect carrier and physical path diversity.\nStand up new offices end to end: circuits, firewall, switching, wireless, and documentation.\nMaintain source-of-truth documentation in NetBox (IPAM/DCIM) and centralized network configuration backups.\nNetwork Security & Zero Trust\nDesign, deploy, and manage Palo Alto Networks firewalls: hardware refreshes, security rules, App-ID, threat and vulnerability profiles, site-to-site VPN, policy-based forwarding, subscriptions, and renewals.\nOwn Zscaler ZIA and ZPA policy: SSL inspection and bypasses, URL categories, cloud app control, Cloud Firewall, locations, GRE tunnels, authentication policies, and VPN replacement.\nSupport evaluation and rollout of zero trust access technologies, such as an enterprise browser.\nHarden email and DNS security (SPF, DKIM, DMARC) and administer email security and archiving.\nRun periodic policy audits and turn findings into prioritized remediation.\nIdentity, Microsoft 365 & Endpoints\nAdminister Active Directory across multiple domain controllers, internal PKI (ADCS), DNS, Group Policy, and AD automation tooling.\nManage Okta as the federation identity provider and Microsoft Entra ID, including Conditional Access, hybrid join, enterprise app consent and assignment, and SAML/SSO integrations for SaaS applications.\nServe as a Global Administrator for Microsoft 365: Exchange Online (user, shared, room, and resource mailboxes; recovery), SharePoint, OneDrive, Teams, Defender for Cloud Apps, and licensing.\nImplement Microsoft Purview retention and sensitivity labels and data classification.\nManage endpoints and servers with Intune/Autopilot and Configuration Manager (SCCM/WSUS), including upgrades, patching, and Windows Server lifecycle planning.\nSecurity Operations & Incident Response\nInvestigate alerts from XDR, identity, and secure web gateway platforms; separate real threats from noise and document outcomes.\nLead response to identity-related incidents and put lasting controls in place afterward.\nTroubleshoot complex security-path issues (TLS inspection, certificate-based authentication, TCP resets) across endpoints, proxies, and cloud services.\nTrack recurring risks, such as certificate expiry across infrastructure platforms, and fix the process behind them.\nCompliance & Regulated Environments\nApply least-privilege, segmentation, and data-protection controls that support company and client security requirements.\nSupport SOC 2 Type 2, client security audits, security questionnaires, and quality audits for regulated (e.g., nuclear) work.\nReview vendor security commitments (e.g., SOC 2 reports) as part of procurement.\nCloud & AI Platform Governance\nBuild and secure Azure environments, including Azure AI Foundry and Azure OpenAI resources, RBAC, network restrictions, logging, and cost separation for internal and billable work.\nImplement technical controls for AI use: Zscaler policy for AI services, Microsoft 365 Copilot and Copilot Studio agent licensing and governance, sensitivity labels, and blocking of unapproved tools.\nSupport the AI governance program, its policies, and the outside consultants developing it.\nAutomation, Change Management & Documentation\nWrite and maintain production-safe PowerShell automation (file/SMB share migrations, labeling, mailbox recovery, reporting) with dry-run and rollback logic; use REST APIs where no supported GUI path exists.\nAdminister Linux and Docker-based services (e.g., NetBox, PostgreSQL, Redis/Valkey), including upgrades and recovery.\nPlan production changes in ServiceNow with implementation, test, risk, and backout plans; validate with dry runs before going live.\nWrite and maintain runbooks, SOPs, knowledge articles, and build requests so procedures can be repeated by others.\nVendor, Project & Stakeholder Leadership\nLead multi-site infrastructure projects from scoping and procurement through cutover, validation, and closeout.\nManage VARs, manufacturers, carriers, and colocation providers; open and drive support/TAC cases; hold vendors to their commitments.\nReview vendor quotes, renewals, contract expirations, and contract terms for technical, security, data residency, and AI-use requirements.\nSupport application developers with infrastructure needs (firewall access, integrations, API access).\nCommunicate status, risks, and accomplishments to IT leadership in concise written updates and executive summaries.\nServe as Tier 3 escalation; mentor infrastructure and service desk staff and lead knowledge transfer.\nRequired Qualifications\n10+ years in IT infrastructure, with at least 5 years in a senior engineer or architect role.\nBachelor’s degree in Information Technology, Computer Science, or a related field, or equivalent experience.\nProduction experience with NetApp ONTAP (CLI and System Manager), including NFS, SnapMirror, upgrades, hardware, and certificate management.\nProduction experience with VMware vSphere/vCenter and Omnissa (VMware) Horizon VDI; working knowledge of Hyper-V and Linux.\nSolid enterprise networking: routing, switching, VLANs, WAN circuits, VPN, and wireless.\nHands-on administration of Palo Alto firewalls (PAN-OS) and Zscaler ZIA and ZPA.\nStrong Windows Server and Active Directory skills, including DNS, Group Policy, and ADCS certificate services.\nMicrosoft 365 and Entra ID administration at the tenant level, including Conditional Access, Exchange Online, SharePoint, and Purview.\nEndpoint management with Intune and Configuration Manager.\nWorking knowledge of backup and DR tools such as Veeam and Zerto.\nExperience working in an ITSM process (ServiceNow preferred) with formal change control.\nProven record of leading multi-site deployments and migrations in production environments.\nClear technical writing: runbooks, change records, incident summaries, and executive briefs.\nAdvanced PowerShell scripting and comfort working with REST APIs.\nPreferred Qualifications\nExperience within engineering, energy, oil and gas, or manufacturing environments.\nExperience supporting SOC 2 audits and regulated environments (nuclear, government, or similar).\nAruba Central and Aruba ClearPass Policy Manager experience; Cisco Catalyst/Nexus switching.\nOkta Identity Engine administration and federation with Microsoft 365; SAML/SSO integrations.\nExperience migrating workloads between hypervisors (e.g., VMware to Hyper-V, Nutanix AHV, or Proxmox).\nNVIDIA vGPU and App Volumes in Horizon environments.\nAzure administration, including Azure AI Foundry/Azure OpenAI, RBAC, and cost management.\nFamiliarity with Microsoft 365 Copilot, Copilot Studio, and AI governance controls.\nMicrosoft Purview and Varonis data classification and labeling.\nExperience with Cortex XDR or similar EDR/XDR platforms.\nEnterprise browser deployment (e.g., Island or Zscaler Zero Trust Browser).\nNetBox, Docker, and PostgreSQL administration.\nColocation data center operations, structured/MPO fiber cabling, and UPS lifecycle management.\nCertifications such as CISSP, NetApp NCIE/NCDA, VMware VCP, Palo Alto PCNSE, Cisco CCNP, Aruba ACMP/ACCP, Zscaler ZDTA/ZDTE, or Microsoft Identity and Access Administrator / Azure Administrator.\nCore Competencies\nProduction discipline: Verifies commands and vendor documentation before acting, tests with dry runs, and always has a backout plan.\n Root cause thinking: Traces problems across layers (storage,...","description_format":"text","description_chars":13795,"description_truncated":true,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":["Cafeteria","Dental insurance","Life insurance","Professional development","Retirement plans"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Civil & Structural Engineering","Engineering Services"],"lifecycle":[{"event":"open","at":"2026-11-02T22:05:32Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 8 · green card filings: 5","filings_12m":8,"filings_prev_12m":8,"green_card_filings_12m":5,"median_offered_wage_usd":82500,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":2}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":22,"reasons":["conf:3","win:early"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/mesa-associates-infrastructure-architect","json_url":"https://alion.io/job/mesa-associates-infrastructure-architect.json","meta":{"generated_at":"2026-11-04T07:18:21Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11413,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2305500},"rest":"https://alion.io/mcp/rest/get_company?id=2305500"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmesa-associates-infrastructure-architect"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmesa-associates-infrastructure-architect"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmesa-associates-infrastructure-architect"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/mesa-associates-infrastructure-architect\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmesa-associates-infrastructure-architect"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3641906}},{"tool":"search_jobs","arguments":{"company":"mesainc.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3641906},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}