Principal Network Engineer

Progressive Leasing is a leading provider of in-store and e-commerce lease-to-own solutions. With more than 20 years in FinTech, we’ve grown from start-up to industry leader by innovating, simplifying, and valuing people. We are a subsidiary of PROG Holdings (NYSE: PRG), a FinTech holding company with three business segments: Progressive Leasing, Purchasing Power (a leading employee purchase program for consumer products and services using payroll deduction), and Four, a Buy Now Pay Later (BNPL) platform. We are currently hiring a Principal Network Engineer to take ownership of the network that powers the business across a hybrid environment of AWS cloud and on-premise branch offices. You’ll work close to the foundations (AWS networking, Palo Alto firewalls, routing and connectivity, automation, and infrastructure as code) and set the direction for how the network is standardized, secured, and operated end to end. A team of network engineering contractors helps deliver the work; you’ll coordinate and prioritize what they take on while you focus on the larger initiatives. This role is a work‑from‑home position and can be performed remotely anywhere in the continental US. Employee Value Proposition (EVP): PROG is dedicated to providing people with opportunity — opportunity for inclusive collaboration, opportunity for innovation, and opportunity for development. WE ARE: The Tech team at PROG and we’re cloud-first, security-aware, and heavily invested in automation and IaC-driven workflows. We treat our infrastructure as a platform: our “customers” are the application, security, and operations teams who should be able to self-serve their own network needs and troubleshoot with the tooling and guardrails we provide. You’ll have ownership from day one and the autonomy to decide how the network platform runs and improves. YOU ARE: You’ll be the technical owner of our network platform, balancing day-to-day operational excellence with the longer-term work of standardizing and hardening the environment. You’ll focus on platform direction, reliability, and security. YOUR DAY‑TO‑DAY: Own and operate our hybrid network end to end, spanning AWS cloud networking and the limited but critical on-premise branch and data center footprint, with a focus on standardization, reliability, and security Lead the technical evaluation and deployment of ZTNA and Secure Web Gateway (SWG) capabilities alongside Enterprise Architecture and Cyber Security, driving the organization’s transition from always-on VPN toward a Zero Trust access model Own the AWS network platform in a multi-account hub-spoke landing zone, including VPCs, Transit Gateway, IPAM, Route 53, Direct Connect, Gateway Load Balancer inspection paths, NACLs, security groups, and VPC sharing via AWS RAM across our network and workload accounts Manage the Palo Alto environment, including VM-Series firewalls in AWS and Panorama-based policy management, the current GlobalProtect remote-access VPN (including contractor and third-party access groups and HIP checks), and east-west / ingress / egress inspection design Drive network infrastructure as code with Terraform as the core tool, building and evolving modular, reusable patterns so network changes are version-controlled, peer-reviewed, and repeatable rather than one-off manual edits (transferable IaC experience from other tools is welcome) Treat the network as a self-service platform: build the modules, guardrails, documentation, and tooling that let application and operations teams provision and troubleshoot their own connectivity, and make stepping in for one-off work the exception, not the norm Build observability, alerting, and redundancy into the network by default, instrumenting telemetry, logs, and SNMP into our observability stack (Dynatrace and Observe) so issues are caught early and the platform is resilient across regions and availability zones Set and enforce network standards across the organization, reduce configuration drift, and partner on the program to detect and alert on manual changes that bypass IaC Support hybrid connectivity across on-premise branch routing and switching and Direct Connect into AWS Execute changes through our ServiceNow change-management process, including CAB review for significant changes, and participate in the support and on-call rotation Treat every one-off build or manual fix as a signal: either a defect in the platform to be fixed or a missing feature to be added, and close that gap so the work becomes self-service next time Use AI-assisted tools to accelerate troubleshooting, draft and improve runbooks, and reduce repetitive operational overhead, with a practical focus on where AI adds value in network operations YOU’LL BRING: We need a strong network engineer who is equally comfortable in the cloud and on traditional network gear, can lead a team and delegate effectively, and has the instinct to standardize and automate rather than firefight. Breadth across cloud and network, plus the discipline to build a platform, matter more here than deep specialization in any single tool. Required experience: Strong, hands-on networking fundamentals across routing, switching, DNS, load balancing, NAT, and segmentation, in both cloud and on-premise contexts Proven ability to lead a ZTNA and Secure Web Gateway (SWG) evaluation and deployment (e.g., Zscaler, Netskope, Prisma Access, or comparable), owning the technical direction alongside Enterprise Architecture and Cyber Security as the organization moves from always-on VPN to a Zero Trust access model Hands-on experience managing a Palo Alto environment (NGFW / VM-Series, Panorama, security policy, and traffic inspection) Strong AWS networking experience in a multi-account environment: VPC design, Transit Gateway, Direct Connect, Route 53, IPAM, NACLs and security groups, and VPC sharing patterns Practical infrastructure as code experience, with Terraform as the core tool (transferable experience from other IaC tools is acceptable) and a track record of replacing manual changes with version-controlled, peer-reviewed automation A platform mindset: experience building reusable modules, guardrails, and self-service capabilities so other teams can provision and troubleshoot without one-off engineering help Comfort coordinating and prioritizing a team’s delivery and keeping work on track while you focus on larger initiatives A strong instinct for observability, alerting, and redundancy, and experience instrumenting networks for monitoring and resilience Security-first thinking, including segmentation, least privilege, and secure connectivity patterns across hybrid environments Comfort operating in production with formal change management (CAB / ServiceNow) and on-call responsibility Scripting fluency (Python, Bash, or similar) for automation and operational tooling Strong cross-team communication and a consultative approach to supporting application, security, and operations teams Comfort using AI tools (Claude, GitHub Copilot, or similar) to ramp on unfamiliar systems, write automation, and diagnose issues Nice to have: Experience with hub-spoke AWS landing zones, Account Factory for Terraform (AFT), or comparable account-vending and network-sharing automation On-premise enterprise networking depth (Cisco routing and switching, wireless) in a hybrid environment BGP and dynamic routing experience, particularly routes learned over Direct Connect Experience driving SD-WAN deployments Hands-on experience with Dynatrace and Observe, or comparable APM, observability, and network telemetry platforms (NetFlow, syslog, SNMP) Familiarity with WAF and edge traffic management (Imperva a strong plus) Experience deploying and operating workloads on Kubernetes / EKS and supporting GitOps and CI/CD tooling (ArgoCD, GitHub Actions, or similar) Experience standardizing networks across multiple environments (prod, non-prod, beta, DR) with cross-environment isolation and DR/failover requirements Prior experience operating in a regulated or FinTech environment WE OFFER: Competitive Compensation Full Health Benefits; Medical/Dental/Vision/Life Insurance + Paid Parental Leave Company‑Matched 401(k) Paid Time Off + Paid Holidays + Paid Volunteer Hours Employee Resource Groups (Black Inclusion Group, Women in Leadership, PRIDE, Adelante) Employee Stock Purchase Program Tuition Reimbursement Charitable Gift Matching Job‑required equipment and services Progressive Leasing welcomes and encourages diversity in the workplace. We do not discriminate in any aspect of employment on the basis of race, color, religion, national origin, ancestry, gender, sexual orientation, gender identity and/or expression, age, veteran status, disability, or any other characteristic protected by federal, state, or local employment discrimination laws where Progressive Leasing does business.