Systems Operations Architect

Systems Operations Architect

Reports to: Director, Systems Operations & Cybersecurity

Direct reports: None. Design authority for the systems estate; works alongside the Lead Systems Engineer and through matrixed engineers in the business units.

Location: Atlanta / Hybrid

Position Summary

This is the deepest technical seat on the systems team. It owns how the platform estate is designed — directory and identity infrastructure, virtualization and compute, storage and data protection, and the Windows and Linux operating environments — and it owns whether that design holds up when something fails.

The role has no direct reports and no authority over matrixed engineers or application owners. It leads through design authority, technical credibility, and follow-through. On a lean team it is also a working role: the architect builds the proof of concept, writes the automation, joins the maintenance window, and takes the escalation when a recovery is not going as documented.

Depth is the point of this position. It is not a role for a generalist who reviews vendor reference architectures. The successful candidate can defend a design decision under questioning, explain the failure behavior of their own cluster design, and has personally recovered something important under time pressure.

The Director owns budget, vendor contracts, policy, and executive reporting. The Lead Systems Engineer owns day-to-day operational execution and the team queue. This role owns the architecture being right, the recovery actually working, and the estate not accumulating debt faster than it retires it.

Key Responsibilities

Directory & Identity Infrastructure

• Own Active Directory and Entra ID architecture: forest and domain design, trust model, sites and replication, DNS, and hybrid identity synchronization.

• Own the tiered administration model — administrative tiering, privileged access workstations, clean-source principle, and the roadmap to eliminate standing domain-level privilege.

• Own Group Policy and configuration architecture, and the migration path toward modern management where it makes sense.

• Own certificate services (ADCS) design: hierarchy, templates, autoenrollment, lifecycle, and the plan for what breaks when a CA expires.

• Design service account and machine identity architecture — gMSAs, credential rotation, and integration with the privileged access management platform tools.

• Partner with the identity function on Okta integration, authoritative source of truth, and authentication flow design across on-premises and SaaS.

Virtualization, Compute & Storage

• Own VMware vSphere/vCenter architecture: cluster and failure-domain design, HA and DRS policy, admission control sizing, host lifecycle, and storage presentation.

• Own the hypervisor platform strategy, including the Broadcom licensing trajectory. Evaluate alternatives on cost, risk, and migration effort, and give the Director a defensible recommendation — including the option to stay.

• Design storage architecture for the platform estate — capacity, performance tiering, replication, and the interaction with media storage where they meet.

• Own capacity planning and hardware refresh cycles; make the buy case with data rather than vendor projections.

• Design the hybrid and cloud IaaS footprint (GCP, AWS, Azure) — landing zone, connectivity, workload placement criteria, and migration path.

Data Protection & Recovery

• Own backup and recovery architecture end to end: coverage, immutability, air-gapped or logically isolated copies, retention, and replication topology.

• Define recovery tiers with real RTO and RPO commitments per workload, agreed with the business rather than assumed by IT.

• Design and prove the ransomware recovery capability — isolated recovery environment, clean-room restore procedure, and AD forest recovery. Own the runbook and lead the exercise.

• Establish restore testing as an architectural requirement with published results. A backup platform that has never been restored at scale is an unvalidated assumption.

• Own disaster recovery design for critical platform services, including dependency mapping so recovery order is known before it is needed.

Operating Environment (Windows & Linux)

• Own standards, hardening baselines, and golden images across Windows Server, Windows endpoints, and Linux (Ubuntu) distributions (CIS Benchmarks / DISA STIG as the reference).

• Own patch architecture across both OS platforms — tooling, ring strategy, maintenance window design, exception handling, and emergency patch capability.

• Own configuration management and infrastructure-as-code direction (Terraform, Ansible, DSC or equivalent) and drive the estate toward declarative, repeatable builds.

• Own OS lifecycle and end-of-support planning so migrations are scheduled work rather than compliance emergencies.

• Design provisioning and decommissioning so systems enter and leave the estate with their monitoring, backup, patching, and inventory records correct.

Technical Leadership

• Set the engineering standards the systems team builds to; review designs and significant changes before they ship.

• Serve as top technical escalation for platform incidents alongside the Lead Systems Engineer, and lead recovery on the hard ones.

• Own the postmortem for system architecture-related failures and drive corrective actions to closure.

• Mentor engineers and grow the bench so the team is not single-threaded — including this role.

• Coordinate matrixed engineers and application owners on shared work: agree on outcomes, publish expectations, follow up until closed.

• Act as the Director's technical delegate in vendor and architecture review sessions.

• Support audits, assessments, and cyber insurance questionnaires with accurate architectural detail and evidence.

Communication

• Write clearly. Designs, standards, runbooks, and recovery procedures are deliverables of this role, held to the same standard as the engineering.

• Produce architecture-grade documentation: requirements, constraints, alternatives considered, failure modes, and migration path. Not diagrams alone.

• Present and defend architecture to technical peers, and translate the same decision into cost, risk, and business impact for executives.

• Communicate during incidents and recoveries on a defined cadence: what is known, what is not, what is being done, when the next update comes.

• Give the Director an accurate picture without prompting — what is on track, what is slipping, what needs a decision.

Ownership & Accountability

This is stated explicitly because it is the primary filter for this role. The successful candidate:

• Owns the design and its consequences. A failure caused by an architecture decision is an architecture problem, not an operations problem.

• Verifies rather than assumes. Recovery is proven by restoring, redundancy by failing over, and hardening by testing — not by reading the documentation.

• Surfaces bad news early, with a recommendation attached.

• Does not defer to a vendor SE for a decision this role should be making.

• Retires technical debt deliberately rather than documenting it and moving on.

• Does not let something fall because it sat outside the job description.

Architecture-Grade Depth

Candidates should be prepared to whiteboard, without notes:

• An AD tiered administration model, and specifically how it interrupts credential theft and lateral movement.

• A vSphere cluster design with stated failure domains and the admission control math behind the host count.

• An AD forest recovery from backup — order of operations, what goes wrong, and how long it actually takes.

• A ransomware recovery design: where the immutable copy lives, how the clean room is built, and how you know the restored data is trustworthy.

• A patch architecture spanning Windows and Linux with rings, SLAs, and a credible exception process.

• A hybrid identity design across AD, Okta, Google Workspace and Entra ID — where authority lives and what breaks when the sync stops.

• A certificate hierarchy and the blast radius when a CA or a widely deployed certificate expires unnoticed.

Depth in several of these with genuine working competence in the rest is acceptable. Surface familiarity across all of them is not.

Required Qualifications

• 10+ years in enterprise systems engineering, with 3+ years in an architect or principal-level role.

• Expert-level Active Directory: design, hardening, tiering, and remediation at enterprise scale — not administration alone.

• Deep design and operational experience with VMware vSphere/vCenter, including storage and failure-domain design.

• Demonstrated ownership of backup, recovery, and DR architecture, with real recovery experience under pressure. Candidates should expect to be asked about a restore that went badly.

• Genuine competence in both Windows Server and Linux at the architecture level. This role cannot be filled by a Windows-only or Linux-only engineer.

• Patch and configuration management design across a mixed estate, with automation and infrastructure-as-code (PowerShell, Python, Terraform, Ansible or equivalent).

• Experience operating in a 24x7 environment where downtime is externally visible.

• Working understanding of identity and privileged access platforms (Okta, BeyondTrust or comparable PAM) as an integration partner.

• Track record of leading technical work through people who do not report to you.

• Bachelor's degree or equivalent practical experience.

Preferred

• VCP/VCAP, Microsoft (Windows Server, Entra ID), RHCE, or equivalent depth demonstrated by work history; CISSP a plus.

• Experience executing a directory, hypervisor, or backup platform migration.

• Experience with a data center or facility build, migration, or consolidation.

• Experience supporting broadcast, playout, or media asset management infrastructure.

• Familiarity with hardening frameworks (CIS, STIG) applied in production rather than studied.

• Media, broadcast, or another 24x7 operational background.

First-Year Success Measures

Working Conditions

• Participates in an on-call rotation; serves as senior escalation for major platform incidents and recoveries.

• Maintenance windows, migrations, and recovery exercises regularly fall outside business hours.

• Occasional travel to sites/facilities.

• Hybrid/onsite expectations.

Allen Media Group is an equal opportunity employer and is committed to creating an inclusive environment for all employees. We do not discriminate on the basis of race, color, national origin, gender, gender identity, sexual orientation, age, disability, religion, veteran status, or any other protected characteristic. All qualified applicants will receive consideration for employment without regard to these characteristics. We are dedicated to providing a workplace free from harassment and discrimination.