On-Site Network Engineer

On-Site Network Engineer – Facility Build-Out & Secure Hybrid Connectivity 

Contract (through December 2026, extension likely) · On-Site: Denver, CO metro (Centennial / Louisville) 

Overview 

The Select Group is building out the network for a new manufacturing and engineering facility within a space technology and satellite systems company, — a site with a high-bay manufacturing floor, test equipment, purpose-built servers, and specialized devices used to configure and operate satellite systems. This role owns the physical network build: configuring all switching, routing, and firewalls in the facility, establishing the secure transport layer that connects the site to a new AWS environment and to a third-party satellite ground station provider, and operationalizing the network with configuration backup and recovery from day one. The facility network must be operational to support an end-of-October 2026 program milestone. 

What You'll Do 

• Configure and deploy Arista switching across the facility, including two communications rooms on separate floors, connecting manufacturing equipment, test systems, servers, printers, and specialized program devices on a physically switched network. 

• Configure and deploy Palo Alto physical firewalls at the facility boundary, and a Palo Alto virtual firewall (VM-Series) in AWS as the cloud-side transport boundary, with appropriate redundancy. 

• Establish and manage all interconnections between environments: build and maintain the secure tunnel from the physical facility to AWS, and the secure tunnel from AWS to the third-party ground station provider. 

• Configure routing and upstream ISP connectivity for the site. 

• Operationalize every device from the start: automated nightly configuration backups stored in AWS, per-device disaster recovery, and the ability to push a stored configuration to a replacement unit (e.g., after an RMA) and bring it up quickly. 

• Direct port-level connectivity on site (patching devices into assigned switch ports); structured cabling, fiber runs, and inter-room pathways are handled by the client's facilities team and are out of scope for this role. 

• Coordinate closely with the AWS architect and integration engineer to validate end-to-end connectivity between the facility, the cloud environment, and external partners. 

• Align day to day with the client's network lead, with regular progress check-ins against the October milestone. 

Required Qualifications 

• Strong hands-on enterprise network engineering experience: L2/L3 switching, routing, and firewall configuration in production environments. 

• Direct experience configuring Arista switching platforms. 

• Direct experience configuring Palo Alto firewalls, including both physical appliances and VM-Series virtual firewalls in AWS. 

• Experience designing and operating site-to-cloud and site-to-partner secure tunnels (IPsec/VPN) with redundancy. 

• Demonstrated operational discipline: configuration backup/restore workflows, device lifecycle and RMA replacement processes, and disaster recovery for network configurations. 

• Ability to work on site in the Centennial/Louisville area during the physical build-out phase. 

• U.S. Person with the ability to access CUI, ITAR, and Export Controlled data; must be able to pass a background check that includes insider threat screening. 

Preferred Qualifications 

• Active or prior U.S. Government security clearance. 

• Experience supporting manufacturing, lab, or aerospace facility networks with specialized/purpose-built equipment. 

• Familiarity with AWS networking (VPCs, VPN gateways) sufficient to partner effectively with cloud engineers. 

• Network automation experience (e.g., config management, zero-touch provisioning) as the environment matures. 

Logistics 

• On-site presence required for the physical network build-out; some follow-on work may be performed remotely on a client-furnished, authorized device. 

• Engagement runs through the end of 2026 with a hard facility-readiness milestone at the end of October; follow-on work is anticipated. 

• Wireless is present in the building but is not in scope for this phase; the program network is physical switching. No standing on-call, though brief scheduled support windows may occur around major program events (e.g., satellite launches). 
  
  TSG is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran. #LI-KN1