Note: The job is a remote job and is open to candidates in USA. AceMQ is sourcing a Senior VMware Cloud Foundation Architect to support a large financial institution's NSX and vDefend infrastructure modernization. The role involves hands-on architecture, deployment, validation, security policy design, troubleshooting, and documentation for VMware NSX, vDefend, VCF, and related networking components in a regulated enterprise environment.
Responsibilities
- Architect and implement NSX-T / NSX 4.x overlays including segment design, Tier-0/Tier-1 gateway topology, and BGP uplink peering
- Design and configure vDefend Distributed Firewall (DFW) and Gateway Firewall policies for micro-segmentation in a regulated financial environment
- Build and validate stretched NSX deployments across multiple failure domains, including edge cluster design and uplink configuration with physical firewall integration (Palo Alto)
- Ensure correct DR (Distributed Router) and SR (Service Router) behavior for east-west and north-south traffic flows, including packet-path validation and troubleshooting
- Configure and validate BGP peering between NSX T0 Edge Nodes and upstream physical routers/firewalls; address asymmetric routing risks in multi-site designs
- Work with AVI Load Balancer (NSX Advanced LB) — including production deployments, not just PoC
- Enforce and document security posture using SSP (System Security Plan) frameworks aligned to financial compliance requirements (e.g., NIST, SOC 2, PCI-DSS)
- Participate in design reviews, runbooks, and architecture documentation deliverables
- Can walk through a full packet trace (VM → DFW → DR → SR → T0 → BGP peer → physical) without hesitation
- Has real opinions on asymmetric routing risks in stretched NSX designs and knows how to design around them
- Has deployed AVI in production, not just spun it up in a lab
- Understands SSP not as a checkbox but as an operational process in regulated environments
- Communicates clearly with both infrastructure engineers and compliance/security stakeholders
Skills
- • 5+ years hands-on VMware NSX-T / NSX 4.x architecture and deployment experience
- • Deep, first-principles knowledge of Geneve encapsulation, overlay networking, and how NSX logical constructs map to physical transport
- • Proven experience with DFW policy design in production regulated environments (financial services, healthcare, or government)
- • Strong command of DR/SR architecture — able to articulate packet flow from VM through DFW → DR → SR → Edge → physical without prompting
- • BGP configuration experience between NSX T0 gateways and physical upstream equipment
- • Production experience with stretched NSX / multi-site VCF deployments including edge cluster sizing, uplink design, and failure domain isolation
- • Experience integrating NSX with Palo Alto (or equivalent NGFW) in active/standby or active/active topologies — with attention to asymmetric routing mitigation
- • Familiarity with VMware VCF (Cloud Foundation) lifecycle management, SDDC Manager, and workload domain design
- • Strong understanding of SSP and compliance-driven infrastructure design (NIST, FedRAMP, or financial equivalents)
- • Kubernetes / Tanzu networking experience (NSX-T as CNI)
- • Experience with Fireflies, Jira, or similar project tooling for delivery documentation
- • Familiarity with Broadcom/VMware licensing transitions (VVF/VCF model)
- • Can walk through a full packet trace (VM → DFW → DR → SR → T0 → BGP peer → physical) without hesitation
- • Has real opinions on asymmetric routing risks in stretched NSX designs and knows how to design around them
- • Has deployed AVI in production, not just spun it up in a lab
- • Understands SSP not as a checkbox but as an operational process in regulated environments
- • Communicates clearly with both infrastructure engineers and compliance/security stakeholders
- Must have reliable EST overlap (core hours 9am–3pm ET)
- US-based strongly preferred for this financial institution engagement
- A brief summary of your most relevant NSX/VCF production deployments (specifically stretched multi-site and/or DFW at scale)
- Your AVI Load Balancer experience — number of production deployments and use cases
- Your experience in regulated industries — what compliance frameworks you've worked within
- Your hourly rate/availability for an FTE contract
- • AVI Load Balancer (NSX Advanced LB) — 2+ production deployments (not just PoC/dev)
- • VCF 9.x familiarity, including new networking and security capabilities
- • VMware certifications: VCP-NV, VCAP-NV Deploy/Design, or VCF Master Specialist
- • Experience in financial services or banking infrastructure environments
- • Prior work on vDefend specifically as a distinct product/capability
Benefits
- Long-term contract engagement
- Remote work arrangement
- Full-time hours (40 hrs/week)
- Long-term duration of 6–12 months, with strong likelihood of extension
- Reliable EST overlap with core hours 9am–3pm ET
Company Overview