Sr. Network Engineer & Connectivity Architect

APCO Holdings partners with dealerships across North America to deliver innovative vehicle protection products and services that enhance the ownership experience for customers and drive growth for our partners. Through our family of brands, we bring together industry expertise, technology, and data-driven insights to help dealers strengthen their finance and insurance performance and build lasting relationships with their customers. Our teams work collaboratively across operations, technology, risk, finance, marketing, and sales to deliver solutions that create measurable value and support the continued growth of APCO and the partners we serve. The Sr. Network Engineer & Connectivity Architect serves as the principal architect of the organization’s enterprise connectivity platform (“The Backbone”), with a primary focus on Microsoft Azure networking, Cisco Meraki infrastructure, and identity-driven access (Active Directory & Entra ID). This role is responsible for designing and operating a secure, highly resilient, and cloud-aligned network architecture, where access decisions are governed by user identity, device posture, and real-time risk signals, rather than traditional network boundaries. Leveraging Infrastructure as Code (IaC), AIOps, and Zero Trust principles, this position ensures seamless, secure connectivity across Azure, on-prem environments, branch networks (Meraki), and SaaS platforms such as Microsoft 365, while enabling a scalable, automated, and self-healing infrastructure.

Responsibilities

Design and implement network architecture where identity is the primary control plane, integrating Active Directory, Entra ID, and identity providers (Okta) with network enforcement points; Architect and support enterprise-scale hybrid identity environments including Active Directory design, Entra Connect synchronization, authentication protocols, and secure integration with cloud and network services; Design, implement, and optimize Conditional Access policies including MFA enforcement, device compliance (Intune), risk-based and session-based access controls; Lead implementation of Zero Trust architecture aligning identity, network, and endpoint; Ensure secure, high-performance access to Microsoft 365; Design and implement scalable Azure networking solutions including VNets, Hub-and-Spoke, Private Endpoints, Private Link, Azure Firewall, NSGs, and DNS; Lead design, deployment, and optimization of Cisco Meraki environments (MX, MS, MR, Auto VPN); Architect and manage secure hybrid connectivity using ExpressRoute, VPN Gateways, and Meraki SD-WAN; Manage network and cloud configurations as code using Terraform, Bicep, or ARM templates and CI/CD pipelines; Implement monitoring and telemetry across Azure and Meraki using Azure Monitor, Log Analytics, Meraki Dashboard, and observability tools; Design and maintain highly resilient network architecture eliminating single points of failure and enabling automated failover; Establish and enforce governance using Azure Policy, Policy-as-Code, and identity governance (access reviews, RBAC, least privilege)

Requirements

Bachelor’s degree in Computer Science, Information Technology, or a related technical field; In lieu of a degree, 12+ years of enterprise-level infrastructure experience with a proven track record of delivering automation-first networking projects; 8–10+ years of enterprise networking experience; 5+ years of Active Directory experience (enterprise scale); 3+ years of Entra ID (Azure AD), Conditional Access, and MFA; 3+ years of Azure networking experience; 3+ years of Cisco Meraki experience (SD-WAN, switching, wireless); Experience designing hybrid connectivity (ExpressRoute, VPN, SD-WAN); Experience implementing IaC (Terraform, Bicep, ARM); Experience integrating identity with network and Zero Trust frameworks; Proven experience leading a transition from legacy "box-by-box" management to a centralized, API-driven orchestration model; Deep expertise in Active Directory (architecture, GPOs, replication), Entra ID, Conditional Access, MFA, federation (SAML, OAuth, OIDC), hybrid identity; Experience implementing identity-driven access integrating network, endpoint, and SaaS; VNets, ExpressRoute, VPN Gateway, Azure Firewall, Private Link, DNS, Hub-Spoke design; MX (SD-WAN), MS (switching), MR (wireless), Auto VPN, Meraki Dashboard; Terraform, Bicep, ARM templates, CI/CD pipelines; Identity and network dependency across Exchange, Teams, SharePoint; Intune/device compliance integration with access policies; Azure Monitor, Log Analytics, Meraki Dashboard, Dynatrace, Splunk; PowerShell, Python, or similar scripting experience

Nice to have

Master’s degree in Information Systems Management; Microsoft 365 performance and connectivity optimization; Microsoft Certified: Azure Network Engineer Associate (AZ-700); Microsoft Certified: Identity and Access Administrator (SC-300); Microsoft Certified: Azure Solutions Architect Expert; Cisco Meraki Solutions Specialist (CMSS); Cisco Certified Internetwork Expert (CCIE) or CCNP Enterprise; Cisco Certified DevNet Professional; HashiCorp Certified: Terraform Associate; Certified Kubernetes Administrator (CKA)