We are an AI-native data and technology partner for private capital and healthcare. Founded in 2010 and headquartered in Warsaw, we work with leading PE firms, VC funds, and healthcare organizations to build proprietary data infrastructure, deploy AI solutions, and drive AI-native transformation.
Our clients manage a cumulative $1.2T+ in assets. Our average engagement runs five years. Our NPS sits above 80. We don't need to claim credibility - we can show it.
We've also done to ourselves what we now do for clients. We've restructured our own company around AI - tools, policies, roles, delivery models. This isn't a pitch. It's a playbook we've already run, and we're hiring the engineers who will run it for others.
The Opportunity
A leading global alternative asset management firm is looking for a Senior NetOps Engineer to own cloud networking at scale — across ~413 AWS accounts, ~4,000 VPCs, and multiple regions. This is a hands-on role sitting at the boundary between Platform Engineering and Networking: the person who translates network requirements into infrastructure code, drives active migration programmes, and builds the reusable patterns that every engineering team provisions their networks against.
The environment is AWS-first with no on-premises data centres. You'll work directly with AWS CloudWAN (an active TGW → CloudWAN migration is in flight), AWS Network Firewall alongside Palo Alto NGFW via Gateway Load Balancers, and a centralized firewall programme replacing the legacy NACL model.
You won't be designing networks in Visio. You'll be writing Terraform — and deriving firewall rules from VPC Flow Log analysis.
What You'll Own
Drive the active Transit Gateway → AWS CloudWAN migration — ~10 Cloud WAN segments, tag-based segmentation, phased TGW decommission; this is already in flight and needs an engineer who can own it to completion
Lead the centralized firewall programme replacing the NACL model — policing cross-account traffic, analysing VPC Flow Logs in S3 to derive firewall rules, and managing the change control process at scale
Operate and evolve a hybrid firewall architecture: AWS Network Firewall for east-west traffic + Palo Alto NGFWs via Gateway Load Balancers; understand the boundary between them
Manage and extend Palo Alto Prisma SD-WAN — deployed at every site and in cloud, with tunnelless Cloud WAN attachment; you'll be inheriting a running deployment and improving it
Build and maintain a Terraform module library for network provisioning (VPC layouts, routing, firewall policies, Cloud WAN policies) consumed across the org via GitHub / GitHub Enterprise
Own IP address management via AWS IPAM at 400+ account scale; maintain hygiene, support account vending workflows
Manage DNS infrastructure: Route 53 + inbound resolvers to Active Directory; participate in the migration toward public hosted zones + AWS-managed certificates
Operate Direct Connect from NY (Virginia POP as failover), targeting four-nines availability; understand BGP, failover paths, and monitoring
Act as the primary technical bridge between Platform Engineering and the Networking organization — translating routing requirements, security standards, and network architecture into IaC that both sides can operate and trust
Production experience with AWS CloudWAN — core network policy documents, segments, tag-based routing, multi-region and multi-account topologies; ideally with involvement in a TGW → CloudWAN migration
Palo Alto NGFW + Gateway Load Balancer — operating Palo Alto firewalls in a GWLB insertion model; understanding the operational boundary with AWS-native firewall services
Palo Alto Prisma SD-WAN — site and cloud deployments, Cloud WAN tunnelless attachment mode; operational experience preferred over greenfield design
Direct Connect — NY-based DX, BGP routing, failover design, monitoring for HA targets
Route 53 — inbound resolvers, hybrid DNS with Active Directory, hosted zone management; exposure to migration from private to public hosted zones is a plus
AWS IPAM — IP address management across hundreds of accounts; allocation policies, pool hierarchy
Infrastructure as Code & Automation
Strong Terraform at scale — module design, state management, workspace patterns, remote backends, versioning — via GitHub / GitHub Enterprise
Experience building reusable, versioned Terraform modules consumed by multiple teams across a large account estate
Data-driven network automation: ability to query VPC Flow Logs in S3 — using Athena, Python/pandas, or equivalent — to analyse traffic patterns and translate findings into actionable firewall rule changes; this is where purely traditional network engineers fall short
Familiarity with CI/CD pipelines for infrastructure: plan/apply automation, drift detection, policy-as-code (OPA, Sentinel, or AWS Config rules)
Cross-domain Fluency
Comfortable working across DevOps and traditional Networking disciplines — pull request reviews and BGP routing discussions in the same week
Experience with multi-account AWS environments (AWS Organizations, SCPs, Resource Access Manager) where networking crosses account and organizational unit boundaries
Understanding of network security governance: least-privilege traffic control, traffic inspection architectures, audit logging (VPC Flow Logs, Firewall logs to CloudWatch/S3)
Change management discipline — operating a centralized firewall programme
