Technical Architect, Segmentation Orchestration Services

Job Description

About Asimily \n

Asimily is the Proactive Cyber Asset Defense Platform empowering your teams to reduce risk as fast as possible across your entire cyber asset attack surface – IoT, OT, IoMT and IT. 

\n

Most security programs stall between knowing what’s at risk and doing something about it: policies are written but never deployed, segmentation is a priority but never fully implemented, and manual workflows can’t keep pace with dynamic networks. Asimily eliminates every one of those gaps. 

\n

Headquartered in Sunnyvale, California, Asimily is trusted globally by leading organizations across industries including healthcare, manufacturing, utilities, government, critical infrastructure, and enterprise organizations.

About You \n

Asimily is seeking a Technical Architect, Segmentation Services to provide hands-on technical leadership and operationalization support across multiple enterprise customer segmentation implementations. This role unifies deep enterprise routing, switching, and Network Access Control (NAC) design with Asimily’s proprietary device intelligence.

\n

As the primary architectural authority, you will own the end-to-end technical lifecycle: discovery, network capability assessments, policy design, pre-production validation, deployment planning, and deep-dive troubleshooting for network based segmentation projects. You will collaborate closely with customer network and security architects, internal Services teams, and Engineering to translate complex IoT, IoMT, and OT intelligence into resilient, least-privilege segmentation policies that align with customer infrastructure, operational feasibility, and service scope.

\n

Success is measured by the ability to independently evaluate complex enterprise networks, architect robust segmentation policies that avoid operational disruption, proactively identify hardware and policy constraints prior to production rollouts, and drive successful project milestones across concurrent customer engagements while cementing trusted technical partnerships.

Essential Responsibilities \n

Network Assessment & Technical Discovery

\n

\n
• Lead architectural discovery sessions with customer network and security teams to map routing topologies, switching fabrics, firewalls, and existing access controls.
\n
• Audit switch platforms, OS/firmware versions, TCAM/memory capacity, and hardware-level ACL limits to identify enforcement bottlenecks and define feasible deployment options.
\n
• Author comprehensive assessment deliverables outlining topology findings, technical constraints, deployment prerequisites, and recommended segmentation architectures.
\n

\n

NAC Architecture & Segmentation Policy Implementation

\n

\n
• Serve as the technical Subject Matter Expert (SME) across enterprise NAC solutions, including Cisco ISE, Extreme Site Engine, Forescout, and Aruba ClearPass.
\n
• Ingest Asimily asset intelligence and packet-level flow data to profile legitimate communications and build context-aware, least-privilege policies using the Asimily Segmentation Orchestration. 
\n
• Design and refine downloadable ACLs (dACLs), dynamic VLAN assignment, and role-based access controls (e.g., Cisco TrustSec / SGTs) matched to client hardware capabilities.
\n
• Partner with Asimily Engineering to address platform integration nuances and optimize policy-generation mechanisms.
\n

\n

Deployment Architecture, Governance & Remediation

\n

\n
• Lead technical sequencing, change-control reviews, pre-flight staging, and rollback strategies across parallel customer deployments.
\n
• Coordinate scheduled deployment windows, oversee pre-/post-change validation, and support configuration changes on customer environments within contracted scope boundaries.
\n
• Spearhead escalation-level root-cause analysis (RCA) for policy enforcement anomalies, dynamic authorization failures, and transient connectivity drops.
\n
• Mentor Services engineers, driving knowledge transfer and establishing standardized implementation playbooks.
\n

\n

Traffic Analysis, Documentation & Cross-Functional Leadership

\n

\n
• Lead technical presentations with customer enterprise architects and security directors, clearly conveying technical findings, risks, and architectural trade-offs.
\n
• Maintain accurate technical records, policy specifications, validation runs, exception registries, and runbooks.
\n
• Collaborate across distributed customer engineering teams and internal cross-functional groups.
  
\n

Required Qualifications \n

\n
• 5–8+ years of hands-on enterprise networking, network security, or infrastructure engineering experience with a primary focus on access enforcement and segmentation.
\n
• Production NAC Expertise: Substantial hands-on experience designing, deploying, and troubleshooting at least one enterprise NAC platform: Cisco ISE, Extreme Site Engine, Forescout, or Aruba ClearPass.
\n
• Advanced Protocol Knowledge: Deep understanding of TCP/IP, switching, dynamic routing, VLAN architectures, subnetting, 802.1X, RADIUS, MAB, and CoA mechanics.
\n
• Hardware Enforcement Literacy: Demonstrated capability to evaluate switch platform limitations, memory/TCAM capacity, and hardware ACL scalability.
\n
• Packet-Level Diagnostics: Experience analyzing flow telemetry (NetFlow/sFlow), SPAN/mirror sessions, OR packet captures to isolate complex connectivity or enforcement issues.
\n
• Implementation Ownership: Proven track record leading technical change windows, risk assessments, and rollback planning across complex enterprise environments.
\n
• Communication & Documentation: Excellent stakeholder-facing communication, technical documentation, and cross-functional problem-solving skills.
\n

Preferred Qualifications \n

\n
• Certifications: CCNP, CCIE, or equivalent advanced enterprise networking/security credentials.
\n
• Multi-Vendor Environments: Practical experience managing heterogeneous networks (e.g., mixed Cisco, Extreme, or Aruba environments).
\n
• Identity-Based Segmentation: Experience deploying large-scale micro-segmentation, Cisco TrustSec (SGTs), or Zero Trust network architectures.
\n
• Automation & Scripting: Hands-on exposure to Python, Ansible, or REST APIs for switch configuration validation and workflow automation.
\n