Lead Architect - Enterprise Ansible Automation (CIQ Ascender) & Chef Migration

Position - Lead Architect — Enterprise Ansible Automation (CIQ Ascender) & Chef Migration

Location - Raritan, NJ

Duration - Long-term

Job Description

Lead the technical vision for one of the largest infrastructure automation transformations in the life sciences industry. You will design an enterprise Ansible platform on CIQ Ascender, stand up an AI-assisted migration factory, move about 1,600 Chef cookbooks to Ansible, and retire Chef across a global, regulated estate. This is a senior, client-facing role: you will be the technical voice the client's CTO organization trusts.

About the Opportunity

Our client has approved a strategic move from Chef to an enterprise-scale, open-source Ansible platform built on the CIQ Ascender control plane. Funding is approved and the program starts now. It runs from November 2026 to February 2028 across ten milestones: solution design, platform build, CI/CD, an AI-assisted migration factory, discovery, a pilot, large-scale migration across SAP, WebMethods, cloud, and R&D platforms, dual run, and Chef decommissioning.

The scope includes Windows and Linux OS hardening, database automation, security and observability agents, and platform automation for SAP, WebMethods, CLOUDx and IM R&D environments. The delivery model combines a small onshore leadership team with an offshore engineering factory.

Role Summary

As Lead Architect, you are the single technical authority for the program. You own the target-state architecture, the migration approach and the quality of everything the team delivers. You chair the design authority, present to the client's architecture review board, and give the go/no-go recommendation for every production cutover and for Chef's final retirement.

You will spend a large share of your time with client stakeholders: architects, Information Security, infrastructure, operations and platform owners. The right person earns their confidence in the first weeks and keeps it for the life of the program. You combine deep, hands-on Ansible and platform expertise with the presence to lead executive conversations and the judgment to settle hard technical trade-offs.

Key Responsibilities

Client leadership and trusted advisory

• Act as the senior technical point of contact for the client's CTO organization, enterprise architects, Information Security, infrastructure and operations leaders.
• Lead architecture workshops, design reviews and executive briefings; turn complex technical choices into clear options, risks and recommendations.
• Present and defend the target architecture at the client's architecture review board and steering committee.
• Build lasting relationships with platform owners across Core infrastructure, CLOUDx, SAP, WebMethods and IM R&D, and settle cross-team technical conflicts.
• Spot opportunities to add value beyond scope and raise them with the engagement executive.

Architecture and design

• Design the enterprise, platform and security architecture for CIQ Ascender: HA control plane on Kubernetes, external PostgreSQL, execution node mesh with hop nodes for segmented zones, Private Automation Hub, Git integration and SSO.
• Define the automation operating model: organizations, RBAC mapped to directory groups, content ownership and the release lifecycle.
• Design credential management with the enterprise vault so that no secrets live in source control.
• Set Ansible content standards: collection and role structure, variable hierarchy, execution environments, naming and documentation.
• Own architecture decision records and the reference architecture for the life of the program.

Migration strategy and AI-assisted factory

• Design the migration factory end to end: automated discovery, classification, AI-assisted conversion, test gates and release.
• Approve Chef-to-Ansible mapping patterns and the reusable collections each migration wave builds on.
• Make the final call on complex conversions: custom resources and libraries, heavy Ruby logic, search-based patterns, data bags, and SAP or GxP-validated cookbooks.
• Set rationalization rules for retiring, merging or migrating cookbooks, and approve the wave plan from a technical-risk standpoint.
• Work with AI specialists to tune conversion tooling and raise the AI-assisted conversion rate over time.

Security, compliance and risk

• Make sure the platform meets enterprise security standards: CIS hardening, least privilege, segmentation, audit logging and content signing.
• Lead the security review and approval of AI/LLM tooling, including data handling and tenancy.
• Make sure Ansible hardening content maps fully to existing Chef-enforced controls, with nothing lost.
• Support computer system validation (CSV) for GxP-regulated systems in partnership with client QA.
• Own technical risks in the program RAID log and drive mitigations.

Governance and quality

• Chair the Architecture and Design Authority and approve deviations from standards.
• Hold technical sign-off for milestone acceptance and give go/no-go recommendations for production cutovers.
• Set quality gates across ansible-lint, Molecule, idempotency, parity and security scanning; run sampled reviews of complex converted content.
• Assess the technical impact of change requests.

Team leadership

• Provide technical direction to a blended onshore and offshore team of about 15–20 Ansible SMEs, platform, DevOps, automation, AI and QA engineers.
• Mentor engineers, run design clinics, and build reusable patterns that lift the whole team's output.
• Partner closely with the Program Manager on plans, status, risks and client communications.

Operational readiness and handover

• Make sure the platform is supportable: monitoring, backup and DR, upgrade path and runbooks.
• Design the dual-run approach and the drift-acceptance criteria.
• Deliver the architecture portions of knowledge transfer and the final handover to client operations.

Required Qualifications

• 15+ years in infrastructure engineering and automation, including 5+ years in an architect role for enterprise-scale programs.
• Led at least two large configuration-management migrations to Ansible (from Chef, Puppet or SaltStack) of several hundred automation assets or more.
• Hands-on, expert-level Ansible: collections, roles, execution environments, Molecule, ansible-lint and dynamic inventory.
• Architected and run AWX, Red Hat Ansible Automation Platform or CIQ Ascender in production, including HA, execution or receptor mesh and Automation Hub.
• Working knowledge of Chef (cookbooks, recipes, custom resources, attributes, data bags, Chef Server) and Ruby, deep enough to judge complex conversions.
• Strong Kubernetes, PostgreSQL and Infrastructure as Code (Terraform) experience.
• Integrated automation platforms with enterprise identity (SAML/OIDC, Active Directory), secrets vaults (CyberArk or HashiCorp Vault), ServiceNow, SIEM and monitoring.
• Designed CI/CD for infrastructure code, with automated testing and security scanning (GitHub Actions, GitLab CI or Jenkins).
• Solid Windows and Linux server hardening background, including CIS benchmarks.
• Proven client-facing consulting experience: led workshops, presented to architecture review boards and briefed senior executives.
• Excellent written and verbal communication; able to write clear architecture documents and decision records.
• Experience directing blended onshore and offshore engineering teams.
• Authorized to work in the United States and able to be on site in Central New Jersey 2–3 days a week.

Preferred Qualifications

• Experience in pharmaceutical, medical device or other regulated industries (GxP, CSV, 21 CFR Part 11, SOX).
• Practical experience applying AI/LLM tools to code conversion or modernization, including governance and security controls.
• Automation experience for SAP Basis, Software AG WebMethods, or research and lab platforms.
• Experience with public cloud automation (AWS, Azure or GCP).
• Prior experience as a technical lead at a consulting firm or systems integrator.