Systems Operations Architect

Reports to:

Director, Systems Operations & Cybersecurity

Direct reports:
None. Design authority for the systems estate; works alongside the Lead Systems Engineer and through matrixed engineers in the business units.

Location:

Atlanta / Hybrid

This is the deepest technical seat on the systems team. It owns how the platform estate is designed — directory and identity infrastructure, virtualization and compute, storage and data protection, and the Windows and Linux operating environments — and it owns whether that design holds up when something fails.

The role has no direct reports and no authority over matrixed engineers or application owners. It leads through design authority, technical credibility, and follow-through. On a lean team it is also a working role: the architect builds the proof of concept, writes the automation, joins the maintenance window, and takes the escalation when a recovery is not going as documented.

Depth is the point of this position. It is not a role for a generalist who reviews vendor reference architectures. The successful candidate can defend a design decision under questioning, explain the failure behavior of their own cluster design, and has personally recovered something important under time pressure.

The Director owns budget, vendor contracts, policy, and executive reporting. The Lead Systems Engineer owns day-to-day operational execution and the team queue. This role owns the architecture being right, the recovery actually working, and the estate not accumulating debt faster than it retires it.

Own Active Directory and Entra : forest and domain design, trust model, sites and replication, DNS, and hybrid identity synchronization.

Own the tiered administration model — administrative tiering, privileged access workstations, clean-source principle, and the roadmap to eliminate standing domain-level privilege.

Own Group Policy and configuration architecture, and the migration path toward modern management where it makes sense.

Own certificate services (ADCS) design: hierarchy, templates, autoenrollment, lifecycle, and the plan for what breaks when a CA expires.

Design service account and machine identity architecture — gMSAs, credential rotation, and integration with the privileged access management platform tools.

Partner with the identity function on Okta integration, authoritative source of truth, and authentication flow design across on-premises and SaaS.

Own VMware vSphere/vCenter architecture: cluster and failure-domain design, HA and DRS policy, admission control sizing, host lifecycle, and storage presentation.

Own the hypervisor platform strategy, including the Broadcom licensing trajectory. Evaluate alternatives on cost, risk, and migration effort, and give the Director a defensible recommendation — including the option to stay.

Design storage architecture for the platform estate — capacity, performance tiering, replication, and the interaction with media storage where they meet.

Own capacity planning and hardware refresh cycles; make the buy case with data rather than vendor projections.

Design the hybrid and cloud IaaS footprint (GCP, AWS, Azure) — landing zone, connectivity, workload placement criteria, and migration path.

Own backup and recovery architecture end to end: coverage, immutability, air-gapped or logically isolated copies, retention, and replication topology.

Define recovery tiers with real RTO and RPO commitments per workload, agreed with the business rather than assumed by IT.

Design and prove the ransomware recovery capability — isolated recovery environment, clean-room restore procedure, and AD forest recovery. Own the…