Manager, Network Engineering (L2/L3)

Location: Denver, CO; Seattle, WA

Job Type: Full-Time

Department: Tract Capital Management — Site Communications & Network Infrastructure

Reports To: VP, Site Communications & Network Infrastructure

Company Overview

Tract Capital adopts a unique approach to digital infrastructure investment. Leveraging experience and strategic insights honed over three decades of creating successful companies in the space, we excel in nurturing and advancing leading-edge digital infrastructure enterprises. Our team of specialized experts are united by a singular purpose: to support the growth of digital infrastructure. Tract Capital goes beyond simple investment by acting as a strategic partner and catalyst for innovation within the sector. We ensure our engagements not only generate strong financial results but also develop essential digital infrastructure to meet growing demands.

Position Overview

The Manager, Network Engineering leads the active network engineering discipline within Tract Capital’s Site Communications & Network Infrastructure organization, owning the pre-construction design and construction-phase delivery of all Layer 2 / Layer 3 network infrastructure across the company’s data center campuses.

It is accountable for the design and build of campus LAN and EVPN/VXLAN fabric, IP routing and addressing, segmentation, SD-WAN and WAN edge, firewall policy, metro and carrier connectivity, site-to-site VPN, mesh Wi-Fi and Private 5G, and the OT network layer carrying BMS, SCADA/EPMS, DCIM, and physical security systems — along with the network standards, policy set, performance-monitoring definition, and as-built record for every campus.

Reporting to the VP, Site Communications & Network Infrastructure, this leader manages a team that includes the Senior Network Engineer, the Wireless & Private 5G Engineer, and the Network Commissioning Technician, and works shoulder-to-shoulder with the peer Managers of Inside Plant (ISP) and Outside Plant (OSP) Engineering — Network Engineering delivers the active L2/L3 layer riding on the physical plant those teams build, so the three disciplines are planned, sequenced, and commissioned as one campus package.

The Manager translates design intent into buildable, secure, schedule-certain network packages and works with the Network Operations Center and Operations leadership to turn commissioned environments over cleanly. This is a Design & Build role — 24×7 monitoring, incident response, and moves/adds/changes are owned by the separate Daily Operations organization.

This is a player-coach leadership role anchored in hands-on IP networking: the Manager sets direction and standards, holds genuine routing, switching, and network security depth, and holds vendors accountable for quality and schedule — while leaning on the team’s specialists in wireless/Private 5G and commissioning.

Job Responsibilities

The successful candidate will have practical experience across many of the following:

• Directly lead, manage, and develop a small team of three specialists — the Senior Network Engineer, the Wireless & Private 5G Engineer, and the Network Commissioning Technician — owning hiring, goal-setting, and performance management, allocating work against the campus build schedule, and building cross-coverage so the team can support multiple concurrent campuses without single points of failure.
• Own the Network Engineering function end-to-end — campus LAN and leaf-spine EVPN/VXLAN fabric, IP routing and addressing, VLAN and VRF segmentation, SD-WAN and WAN edge, firewalls, and network services (DNS/DHCP/IPAM, AAA/802.1X) — from pre-construction design through commissioning and as-built turnover.
• Design and validate site-to-site VPN and encrypted interconnect architecture across campuses, remote facilities, vendor support paths, and OT remote access — IPsec/IKEv2 tunnel design, crypto and key management, redundancy and failover, and MTU/performance tuning.
• Own the network standards and policy set for Design & Build — reference architectures, configuration and device-hardening standards, IP addressing and naming conventions, segmentation and security policy, and acceptance criteria — governing design reviews, exceptions, and revision control.
• Design the OT/ICS network layer with Facilities, Controls, and OT Cybersecurity — zoned, segmented architecture (e.g., Purdue-model / IEC 62443 zones and conduits) carrying industrial protocols such as Modbus TCP, BACnet/IP, DNP3, and OPC UA — embedding security through micro-segmentation, out-of-band management, and device hardening.
• Oversee wireless and Private 5G design — mesh Wi-Fi architecture, coverage and capacity, Private 5G core integration, and spectrum planning — relying on the Wireless & Private 5G Engineer for depth while owning integration into the core L2/L3 and security architecture.
• Review and validate integrator deliverables (network diagrams, IP and VLAN schedules, BOMs, configurations, as-builts) for accuracy and standards compliance; drive integrators and vendors to deliver on time and to quality; and ensure site acceptance testing — configuration validation, resiliency testing, and security policy verification — meets standards.
• Define the network performance monitoring standard for each campus — what is instrumented, which metrics and thresholds matter, and how telemetry is collected — and collaborate with the Network Operations Center and Operations leadership to set turnover requirements early and hand over commissioned environments cleanly, including configuration baselines, monitoring onboarding, escalation paths, runbooks, and readiness reviews.
• Partner continuously with the peer Managers of Inside Plant (ISP) and Outside Plant (OSP) Engineering — aligning active network design to structured cabling, MDF/IDF and rack layouts, port and pathway capacity, and campus fiber routes, and jointly sequencing design packages so physical and active layers commission together.
• Evaluate and specify metro connectivity and carrier direct internet access (DIA) — assessing carrier proposals, route and path diversity, capacity, and hand-off architecture; defining availability, latency, loss, and SLA requirements; and validating performance at turn-up — partnering with Carrier & Vendor Relations, Delivery Management, Construction, and Design & Engineering.

Basic Qualifications

• 10+ years in network engineering — L2/L3 design, routing and switching, network security, and build delivery — or an equivalent combination of education and experience. Substantial data center experience is required; exclusively enterprise/corporate IT backgrounds will not be a fit. You have delivered networks inside data center, colocation, or mission-critical facilities and understand their redundancy and change-control realities.
• 3+ years directly managing and developing a small technical team, in addition to leading integrators, vendors, and projects delivering network infrastructure. You do not need to have personally run routing/switching, wireless, and commissioning at once — the ability to coordinate specialists is what matters.
• Deep, hands-on IP routing and switching expertise — the role’s anchor discipline — including VLANs and trunking, link aggregation, first-hop redundancy, VRFs and route policy, IP address plan design, and dynamic routing protocols (e.g., OSPF, BGP, IS-IS) including redistribution and convergence.
• Hands-on VXLAN experience is required — designing, deploying, and troubleshooting leaf-spine EVPN/VXLAN fabrics, including underlay and overlay design, VNI and tenant segmentation, and multi-tenancy in a production data center environment.
• Deep, hands-on experience with secure connectivity and network security enforcement — site-to-site VPNs (IPsec/IKEv2, route- and policy-based tunnels, crypto and key management, tunnel redundancy and failover, MTU/performance tuning) across campuses, remote sites, and third-party endpoints, plus next-generation firewalls, micro-segmentation, policy design, and out-of-band management.
• Operational technology (OT) networking experience — designing segmented networks carrying BMS, SCADA/EPMS, DCIM, access control, and industrial control systems — with working knowledge of the protocols they run on (e.g., Modbus TCP/RTU, BACnet/IP, DNP3, OPC UA) and how these shape segmentation and QoS.
• Experience evaluating metro connectivity and carrier DIA — comparing transport options (Ethernet, EPL/EVPL, dark fiber, DIA), assessing route and path diversity, and defining availability, latency, capacity, and SLA requirements — plus SD-WAN, carrier hand-off, and enough enterprise wireless familiarity (Wi-Fi 6/6E, mesh) to set acceptance criteria.
• Experience authoring and enforcing network standards, policies, and configuration baselines, and defining network performance monitoring — metrics, thresholds, alerting logic, and telemetry (SNMP, streaming telemetry, flow, syslog, synthetic testing) — so environments turn over to operations with actionable visibility.
• Working fluency with the physical layer — structured cabling, MDF/IDF and rack elevations, fiber pathways, entrance facilities — sufficient to collaborate credibly with inside-plant and outside-plant peers.
• Strong vendor/integrator management, clear communication with internal stakeholders, and proficiency with common design and documentation tools (e.g., Visio, AutoCAD, IPAM/DDI, configuration management tooling).

Education, Professional Certification, and Licenses

• Bachelor’s degree in Engineering, Computer Science, Telecommunications, Information Technology, or a related technical discipline, or equivalent practical experience.
• CCNP Enterprise (or an equivalent professional-level routing/switching certification), or progress toward it, is a plus — not required. This role is pitched at the professional/practitioner level; expert-track certification is neither expected nor necessary.
• Network security certifications (e.g., Palo Alto PCNSE, Fortinet NSE, CCNP Security) and OT/ICS credentials (e.g., ISA/IEC 62443, GICSP) are a plus.
• PMP or wireless certifications (e.g., CWNA/CWDP) are also a plus.
• Valid driver’s license (role requires periodic field/site work and commissioning support).

Preferred Qualifications

• Hands-on experience with Arista switching and Arista CloudVision for provisioning, configuration compliance, change control, and network telemetry.
• Experience delivering network infrastructure for hyperscale or cloud campuses or large capital projects, across multiple concurrent sites including greenfield and live/retrofit environments.
• Experience designing OT network segmentation to a recognized framework (e.g., Purdue model, ISA/IEC 62443, NIST SP 800-82).
• Experience with network automation and infrastructure-as-code approaches (e.g., Ansible, Python, Git-based configuration management) and monitoring/observability platforms.
• Experience establishing network standards, SOPs, and QA/QC programs in a fast-growth organization, and driving commissioning turnover into a 24×7 NOC.

Required Traits and Skills

• Leadership and Team Management: Inspire, guide, and develop a small team of specialists, enhancing performance, managing disputes, and fostering a collaborative environment across routing/switching, wireless and Private 5G, and commissioning sub-specialties.
• Standards and Governance Mindset: Codify what works into reusable standards, policies, and acceptance criteria, and hold designs and vendors to them consistently across campuses.
• Technical Depth and Judgment: Hold genuine hands-on credibility in IP routing, switching, and network security — able to review a configuration, challenge a fabric or carrier design, and make the call when vendors disagree.
• Effective Communication: Clearly convey expectations to integrators, vendors, and operations partners, and comfortably deliver written and verbal updates to internal leadership.
• Critical Thinking Skills: Find innovative, buildable solutions and remain flexible in addressing unexpected design, integration, and field-commissioning challenges across converged IT and OT environments.
• Cross-Discipline Collaboration: Work as one team with inside-plant and outside-plant engineering peers and the Operations organization, resolving interdependencies early and sharing ownership of an integrated campus outcome rather than optimizing a single discipline.
• Proactive Risk Management: Anticipate risks, identify vulnerabilities in network design, segmentation, and field execution, and proactively implement mechanisms to safeguard availability, security, and schedule certainty.

Expected Salary Range

$175,000 - $200,000 annual  + Discretionary Bonus

Tract Capital Employment

Tract Capital employees enjoy competitive compensation and comprehensive benefits, including 100% employer-covered medical, dental, and vision insurance, a 401K program, standard paid holidays, and unlimited PTO.

NOTE: This job description is not intended to be all-inclusive. Employees may perform other related duties to meet the organization’s ongoing needs.

Tract Capital is proud to be an Equal Opportunity Employer. Qualified applicants are considered for employment regardless of age, race, color, religion, sex, national origin, sexual orientation, gender identity, disability, or veteran status. If you need assistance applying for any of our open positions, please contact us at info@tractcapital.com.