Network Engineer

About the role

About Client: Client is a global financial technology company that provides a wide range of solutions and services to the financial industry. As a leading provider of technology solutions, Client offers a comprehensive suite of products and services designed to facilitate efficient banking operations, enhance customer experiences, and drive digital transformation. Its offerings encompass core banking systems, digital banking platforms, payment processing solutions, risk management tools, and data analytics capabilities.

Rate: $70/Hr

Job Description:

• We are seeking a Senior Azure Government Cloud Network Engineer to design, automate, and maintain a high-performance, software-defined network that powers our zero-trust, shift-left deployment model.
• In this role, you will be the architectural anchor for our autonomous microservices platform.
• You will engineer fully automated, immutable networks across all lifecycle stages to completely eliminate environmental configuration drift and guarantee absolute environment parity.
• Operating within a multi-location Scaled Agile framework, you will build automated infrastructure gates, integrate service virtualization, and implement expert-level routing frameworks.
• You will leverage VWAN with Routing Intent, Secured Hubs, Forced Tunneling, and advanced BGP configurations to support dark launching, dynamic feature flagging via Azure App Configuration, and multi-tiered automated performance testing. Core Responsibilities: Expert-Level Enterprise Routing & Traffic Engineering:
• Advanced VWAN Orchestration: Design and manage global Azure Virtual WAN (VWAN) architectures utilizing Secured Virtual Hubs integrated with security partners or Azure Firewall to centrally govern all cloud-native traffic.
• Deterministic Routing Intent: Implement Routing Intent and Routing Policies within VWAN to systematically direct all private and internet-bound traffic (Internet and Private Traffic categories) through security appliances without complex manual programming.
• Dynamic Hybrid BGP Optimization: Engineer resilient, multi-site Azure ExpressRoute data paths using advanced Border Gateway Protocol (BGP) communities, multi-exit discriminators (MED), and AS-path prepending to enforce predictable failover paths for distributed federal sites.
• Forced Tunneling & Symmetric Routing: Author rigorous User-Defined Routes (UDRs) and BGP policies to mandate Forced Tunneling, ensuring all branch, cloud, and edge-bound traffic is backhauled to specific inspection boundaries without causing asymmetric routing drops. Immutable Infrastructure as Code (IaC) & Automation
• 100% Code-Driven Architecture: Define, provision, and lifecycle all complex routing fabrics including BGP peering, VWAN configurations, Hub policies, and UDR matrices strictly via modular, repeatable Terraform templates.
• State & Configuration Governance: Implement secure backend state management, drift detection mechanisms, and policy-as-code validations (e.g., Azure Policy, OPA/Rego) to prevent unauthorized, out-of-band manual network alterations.
• Automated Pipeline Gates: Embed network IaC directly into Azure DevOps CI/CD pipelines. Network deployments must automatically execute linting, static analysis security scans, and trigger immediate environment-specific compliance gates upon Git check-in. Azure Government Cloud Compliance & Security
• Sovereign Cloud Isolation: Architect and maintain high-fidelity environments within Azure GovCloud, ensuring strict compliance with US federal security frameworks (e.g., FedRAMP High, DoD SRG Impact Level 4/5, CJIS).
• Zero-Trust Micro-segmentation: Enforce rigorous Network Security Groups (NSGs) and Application Security Groups (ASGs) at the IaC layer to isolate autonomous microservices by default, blocking automated defects and lateral threat movement at the packet level.
• High-Assurance Gateways: Manage high-assurance cryptographic gateways, cross-domain solutions, and dedicated ExpressRoute Gov circuits to securely connect distributed government enclaves and multi-location development sites. Environment Parity & Distributed Scaled Agile Execution
• Eliminate Staging Drift: Manage identical software-defined networking layouts and routing boundaries across all pre-production and production tiers via automated nightly continuous deployment pipelines, preserving absolute multi-environment stability and parity.
• Decoupled Integration & DEV Isolation: Configure Azure Private DNS zones and localized routing mechanisms via IaC to support API Contract Testing and Service Virtualization, keeping early-stage testing entirely self-contained for distributed teams.
• Distributed Scaled Agile Collaboration: Partner closely with decentralized, multi-location engineering squads, Product Leads, Quality Leads, and App Leads across Agile release trains (ARTs) to map infrastructure requirements directly to ADO User Stories and maintain a 100% Requirements Traceability Matrix Depth.
• Performance-Ready Fabrics: Provision automated, high-throughput network segments to accommodate multi-tiered automated testing under heavy simulated traffic loads (Reliability, Scaling, Load, and extreme Stress/Chaos testing). Traffic Management & Zero-Day Validation
• Dark Launch Infrastructure: Design quiet routing paths and backend network connections to allow microservices and data migrations to run silently "in the dark" on live production infrastructure.
• Targeted UI Routing: Configure Azure Application Gateway and Azure Front Door to support targeting filters, allowing distributed QA and Product Managers to securely test features using real production data while keeping them logically hidden from standard users.
• Centralized Configuration Access: Secure and optimize ultra-low-latency network pathways (via Azure Private Link) to Microsoft Azure App Configuration across all geographic deployment regions.
• Instantaneous Failure Recovery: Optimize routing tables, global traffic managers, and DNS TTLs to support automated tracking mechanisms that trigger millisecond-level traffic routing rollbacks if telemetry spikes or memory leaks occur.
• Required Technical Skills & Qualifications
• Expert-Level Azure Routing Toolkit: Proven history deploying Azure Virtual WAN (VWAN) with Routing Intent, Secured Virtual Hubs, Forced Tunneling, and complex User-Defined Routes (UDRs).
• Advanced BGP & Hybrid Connectivity: Mastery of Border Gateway Protocol (BGP) engineering over multi-circuit Azure ExpressRoute and VPN gateways in high-availability enterprise configurations.
• Advanced Infrastructure as Code (IaC): Proven mastery of Terraform to build declarative, production-grade, and immutable multi-environment architectures.
• Azure Government Cloud Expertise: Deep experience navigating the specific constraints, endpoint differences, and compliance parameters of Azure GovCloud.
• Microservices & Container Networking: Strong understanding of service-to-service communication, ingress controllers, and overlay/underlay networking (e.g., Azure CNI) for autonomous microservices.
• Scaled Agile Workflow Integration: Solid experience operating in distributed, multi-location environments utilizing frameworks like SAFe or Scrum-at-Scale, leveraging Azure DevOps (ADO) for linking infrastructure work items to application features.
• Traffic & Packet Analytics: Proficiency using Azure Network Watcher, Traffic Analytics, and Azure Monitor to capture database lag, CPU/memory telemetry, and error behaviors under heavy simulated traffic loads. Preferred:
• Shift-Left Advocate: You believe that infrastructure validation belongs as early in the deployment lifecycle as possible and should be codified entirely.
• TDD/BDD Aligned: While you may not write application code, you understand Git workflows (Draft PRs) and appreciate how automated network rules protect the stability required to trigger product readiness tests.
• Zero-Bug Accountability: You maintain an exceptionally high bar for infrastructure deployment quality, targeting zero escaped architectural defects into subsequent environments. Other Requirements:
• Position is in the the client Government Services division and has the following requirements
• Candidate must be a US Citizen or already have a Green Card
• Candidate must pass a mandatory US Government background check prior to starting
• Travel:
• Approximately 5% travel to other office locations is expected Technology/Skill:
• Total Experience in Years
• Latest year of Experience
• Additional Comments
• Design/Manage Azure VWAN
• Secured Virtual Hubs in Azure
• Forced Tunneling in Azure
• Complex User Defined Routes (UDR) in Azure
• Setup/Maintain Border Gateway Protocol (BGP) on multicircuit Azure ExpressRoute and VPN gateways in high availability configurations
• Terraform scripting
• Azure GovCloud
• Azure CNI (i.e. Microservices & Container Networking)
• Working in physically distributed environments (Multi locations)
• SAFe Agile/Scrum-at-Scale
• Azure Network Watcher
• Azure Traffic Analytics
• Azure Monitor

Please note that ApTask offers subsidized insurance coverage to our employees.

About ApTask: ApTask is a leading global provider of workforce solutions and talent acquisition services, dedicated to shaping the future of work. As an African American-owned and Veteran-owned company, ApTask offers a comprehensive suite of services, including staffing and recruitment solutions, managed services, IT consulting, and project management. With a focus on excellence, collaboration, and innovation, ApTask provides unparalleled opportunities for professional growth and development. As a member of the ApTask team, you will have the chance to connect businesses with top-tier professionals, optimize workforce performance, and drive success across diverse industries. Join us at ApTask and be part of our mission to empower organizations to thrive while fostering a diverse and inclusive work environment.

Applicants may be required to attend interviews in person or by video conference. In addition, candidates may be required to present their current state or government issued ID during each interview.

Candidate Data Collection Disclaimer: At ApTask, we prioritize safeguarding your privacy. As part of our recruitment process, certain Personally Identifiable Information (PII) may be requested by our clients for verification and application purposes. Rest assured, we strictly adhere to confidentiality standards and comply with all relevant data protection laws. Please note that we only collect the necessary information as specified by each client and do not request sensitive details during the initial stages of recruitment.

If you have any concerns or queries about your personal information, please feel free to contact our compliance team at compliance@aptask.com.

Applicant Consent: By submitting your application, you agree to ApTask's (https://aptask.com) Terms of Use and Privacy Policy, and provide your consent to receive SMS and voice call communications regarding employment opportunities that match your resume and qualifications. You understand that your personal information will be used solely for recruitment purposes and that you can withdraw your consent at any time by contacting us at 732-355-8000 or help@aptask.com. Message frequency may vary. Msg & data rates may apply.

About technology at ApTask

Technology roles at ApTask cover the software, cloud, data, security, and platform-engineering functions that power Fortune 500 digital operations. Our recruiters specialize in high-signal technical calibration — every candidate is validated against the specific stack, framework versions, and deployment context the client runs, not a keyword match. Our largest engagements sit inside AWS, Azure, GCP, Snowflake, Databricks, and modern data-mesh estates. Because we route through Fieldglass, Beeline, Workday VNDLY, and Coupa VMS, technology contractors placed through ApTask carry MBE diversity spend against the client's supplier program while remaining W-2 with full benefits under our payroll.