Senior Network Security Architect

About Alpha Origin

Alpha Origin is a profitable, bootstrapped, independent engineering firm for critical infrastructure. We help operators find where their systems are vulnerable to compromise or failure, then engineer and test the fixes.

Our work spans hyperscale and AI data centers, financial services, telecom, and energy. Our team brings experience from Special Operations, the intelligence community, national laboratories, and infrastructure operations. We work across vendors and technologies, with the freedom to recommend what a customer should keep, change, buy, or build.

The role

You will design, build, harden, and secure the networks and infrastructure behind our customer engagements and internal platforms. You will lead enterprise network implementations, evaluate unfamiliar environments independently, and make practical recommendations that customers can act on.

This is a hands-on senior engineering role with responsibility from architecture through implementation and validation. You should understand why a configuration works, how it can fail, and how to verify a change safely in a production environment.

You will work directly with AO's founders, engineers, offensive security team, and customers. You will also help shape what we build next by turning recurring customer problems into better tools, services, and engineering capabilities.

What you'll do

• Analyze, configure, audit, and troubleshoot networks, firewalls, and routing across multiple vendors. Adapt to the customer's environment and make sound decisions about what to retain, improve, or replace.

• Lead architecture and configuration reviews against applicable CIS benchmarks, NIST guidance, and vendor hardening recommendations. Present findings and recommendations directly to technical and executive stakeholders.

• Prioritize remediation by risk reduction, cost, implementation effort, and operational impact. Make the tradeoffs explicit and identify improvements that work within the customer's budget and existing infrastructure.

• Work with engineering and offensive security teams to validate controls under realistic attack scenarios, within agreed scope and operating constraints.

• Produce clear architecture diagrams, configurations, findings, implementation plans, and runbooks that customer teams can use and maintain.

• Identify recurring gaps across engagements and propose new tools, products, or service offerings, with a clear problem statement and a practical path to a prototype.

• Identify and interview SMEs, build context, map systems as built and compare to as designed. Understand the customer system better than they do.

• Define and implement host and network controls, including firewalls, access control lists, proxies, and SELinux policies.

• Assess, design and operate secure routed and switched networks, including OSPF, BGP, VLAN segmentation, and inter-site connectivity.

What you'll bring

Extensive hands-on experience in engineering and enterprise networking, typically gained over 15+ years, with current responsibility for production environments.

Systems engineering

• Systems architecture. Depth across network, compute, cloud, identity, and the supporting systems that touch everything: backups, monitoring, orchestration, automation, and vendor access. Enough range to know what a sound design of each looks like.

• Scale and duration. Ten or more years building, breaking, or operating production infrastructure, with work you can describe in detail.

• Networking. Hands-on experience with routing, switching, segmentation, VPN and tunnel design, firewall policy, management-plane design, defense in depth. Fluency in at least two vendor ecosystems. Can work across vendors and learn unfamiliar technologies without depending on one product ecosystem.

• Linux and virtualization. Processes, filesystems, namespaces, containers, SELinux or AppArmor, hypervisors, high availability.

• Security architecture. Identity and authentication, PKI and certificate handling, secrets management, privileged access, zero trust network access, logging and detection design.

• Automation. Scripting and automation using Python, Bash, Ansible, Puppet, or similar.

• Software delivery. Python, shipped at engagement speed. AI multiplies your output and the standard does not move: you scope the tool, review what the model produced, catch the wrong answer before a client does, and own the result.

• Applied AI. Local model deployment where data cannot leave, judging whether a model's output can be trusted, and knowing where deterministic implementation is required instead.

Consulting and judgment

• Adversary perspective. Attack surface, persistence, lateral movement, evasion of monitoring, and what an attacker reaches next from any given foothold.

• Assess. The ability to enter an unfamiliar customer environment, wade through complexity, build the big picture, establish the facts, identify consequential weaknesses, and make a defensible recommendation.

• Writing. Tell a story rooted in fact and standards, rich with real-world examples. Findings the engineer can act on, and analysis the executive can understand and support.

• Respect. Confidence communicating difficult findings respectfully and directly, including to senior stakeholders.

• Advise. A track record of recommending practical, budget-aware improvements and recognizing when a targeted change is more useful than replacing an entire system.

• Ownership. The ability to own work independently, follow through on commitments, and know when to bring in another specialist.

Education and certifications

• A bachelor's or master's degree in Computer Science or a closely related field. Equivalent practical experience will be considered.

• One or more relevant certifications, such as CISSP, CCNP, CCIE, CompTIA Security+, or CEH. Proven experience supported by professional references may substitute for certifications.

Useful additional experience

• OT/ICS or other critical infrastructure environments.

• Turning a customer problem into an internal tool, productized service, or commercial product.

Why AO

You will join a small team where senior engineers stay close to the work and have a direct voice in technical decisions. You will see projects through from understanding the environment to building and validating improvements.

There is room to grow through technical leadership, ownership of complex engagements, and development of new capabilities. That scope will grow with your judgment, execution, and the needs you identify.

Location and working arrangements

• Hybrid role based in the DC metro area, with in-person work in Arlington, VA.

• Ad hoc travel based on customer and engagement needs.

• Must be legally authorized to work in the United States. AO does not sponsor employment visas at this time.

Compensation and benefits

The base salary range for this role is $180,000–$300,000, depending on relevant experience, technical depth, and demonstrated ability to lead complex customer engagements independently.

Eligible for a meaningful discretionary bonus based on individual and company performance. Profit sharing from day one. Participation in long-term company upside. Excellent healthcare and other benefits. Unlimited PTO.