Network Engineer

The Thomas Jefferson Foundation has a twofold mission of preservation and education, and was incorporated in 1923 to preserve Monticello, the home of Thomas Jefferson, in Charlottesville, Virginia. Today, the Foundation seeks to bring history forward into national and global dialogues by engaging audiences with Jefferson's world and ideas and sharing the history of everyone who lived and labored ticello is recognized as a National Historic Landmark, a United Nations World Heritage Site and a Site of Conscience.

The Network Engineer designs, secures, and maintains the wired, wireless, and wide-area networks that connect every Foundation property, from administrative offices to point-of-sale systems, guest Wi-Fi, and building systems across a mountaintop historic site. Reporting to the Director of Information Technology, you will also serve as a primary technical resource for cybersecurity monitoring and incident response, working alongside the Systems Administrator to keep Monticello's operations and visitor experience running 363 days a year.

$68,500 - $82,000

• Design, configure, and maintain routers, switches, firewalls, wireless controllers and access points, and the cabling and fiber that connect them across Foundation properties.
• Architect and administer network segmentation that keeps administrative, point-of-sale, guest, and building-system traffic separate and secure.
• Manage firewall policy, VPN, and remote access, including periodic rule reviews to remove stale or overly permissive rules.
• Plan and deliver upgrades, patches, and hardware lifecycle replacements through change control, communicating outages clearly to stakeholders.
• Monitor network availability, performance, and capacity, and turn that data into reports that support planning and budgeting.
• Plan and support wireless coverage for staff, guests, and events, including installations in historic structures and outdoor terrain.
• Manage relationships with ISPs, circuit providers, and network-related MSPs, and hold them to contracted service levels.
• Keep network documentation current: topology diagrams, IP address plans, VLAN and subnet assignments, circuit inventory, and configuration backups.
• Serve as the Service Desk's escalation point for network issues and lead root cause analysis on complex, multi-vendor problems.
• Administer and tune security tools (endpoint detection and response, DNS filtering, SIEM, vulnerability scanning), triage alerts, and drive risk-based remediation.
• Participate in incident response from detection and containment through post-incident review, support audits, and cyber insurance evidence.
• Advise colleagues on the network needs of their projects, including VoIP, audio/visual, physical security, and building systems, and help plan future network direction.
• Provide backup coverage for server, virtualization, and Microsoft 365 administration, with reciprocal support from the Systems Administrator.
• Respond promptly to emergencies, both during and outside normal business hours.

• Three or more years of hands-on network engineering or administration in a multi-site production environment, including firewall and wireless administration.
• Strong working knowledge of Layer 2/3 routing and switching, VLANs, trunking, spanning tree, and routing protocols (static, OSPF, BGP).
• Experience administering next-generation firewalls, VPN and secure remote access, and enterprise wireless, including RF planning and current 802.11 standards.
• Solid grasp of DNS, DHCP, IP address management, and network monitoring tools (SNMP, syslog, flow analysis).
• Familiarity with security tooling such as SIEM and log aggregation, EDR, DNS-layer filtering, and vulnerability…