BRIAN OH
Temple City
Summary
Principal Network Engineer and Cloud Network Architect with 15+ years defining enterprise network architecture, driving cloud transformation, and establishing technical standards across hybrid multi-cloud environments. At Green Dot Corporation — a federally chartered bank — served as technical authority for all network infrastructure across 133 Azure subscriptions and 20,988+ cloud resources: architected Azure Virtual WAN from the ground up, owned sole Network Engineering accountability for a 3-year core banking platform migration (Project Wolfsburg), and governed a 16-workstream partner migration program with zero production outages. Engineered Python automation that cut firewall change implementation by ~80% and established AI-integrated NetDevOps workflows that were among the first in the organization. Passed 3 consecutive annual PCI penetration tests with zero network-layer findings across 400+ change management tickets.
Overview
15
15
years of professional experience
1
1
Certification
Work History
Principal Network Engineer
Green Dot Corporation
Pasadena
05.2019 - Current
- Architected Green Dot's Azure Virtual WAN (vWAN) backbone from the ground up — defined the enterprise reference architecture: 4 VWAN hubs (Corp/Prod × East US 2 / West US 3), ExpressRoute gateways, Palo Alto Cloud NGFW, and 8 Cisco C8000V NVAs alongside Megaport MCR and PacketFabric cloud routers, all codified in Terraform IaC (5 reusable modules).
- Designed BGP routing policy with custom route table isolation preventing partner-to-partner traffic leakage across 300+ VNets and 133 Azure subscriptions — serving as the organization's technical authority for all cloud network architecture decisions.
- Established Green Dot's dual-carrier hybrid cloud backbone by deploying Megaport MCR and PacketFabric cloud routers (Aug 2021) as the foundation for all Azure ExpressRoute circuits connecting on-premises data centers, partners, and cloud workloads — governing the architecture through 2026 across production and corporate environments.
- Executed CORP Azure VPN-to-ExpressRoute migration by replacing site-to-site VPN connectivity with ExpressRoute via Megaport/PacketFabric.
- Consolidated AWS architecture from fragmented VPC peering to centralized Transit Gateway (TGW) across 150+ VPCs; designed hosted Direct Connect VIFs with redundant BGP. Governs 133 Azure subscriptions and 20,988 cloud resources across Azure and AWS — the largest cloud network footprint in the organization.
- Led Azure Firewall-to-Palo Alto Cloud NGFW migration (2023): defined the platform strategy, validated through a POC series across 8 consecutive change windows in 2021, and drove the full CORP production deployment — establishing Palo Alto as the enterprise firewall standard.
- Sole Network Engineering owner and technical authority for Project Wolfsburg — Green Dot's 3-year migration from legacy Fiserv/CBS to the Temenos T24 core banking platform (Apr 2021–Feb 2024). Defined Azure VNet architecture across East US and West US for production and non-production CBS environments; established site-to-site VPN tunnels from DC1 and DC2; designed NAT translation framework for all data center-to-Temenos traffic flows.
- Governed Temenos VPN-to-ExpressRoute migration (Nov 2022) via Megaport/PacketFabric across 6 failover test windows; managed Temenos DR site connectivity and whitelisted APIM/GiftCard connectivity across prod and non-prod. Drove complete decommission of all Temenos network connectivity (Feb 2024) — 25+ formally approved change windows over 3 years, zero production outages as sole NE owner throughout the entire program.
- Governed VMware VeloCloud SD-WAN platform across 100+ retail partner and corporate sites (Walgreens, Kroger, CVS, RiteAid, InComm, BMA); owned Verizon and Lumen carrier relationships; authored Verizon escalation runbook and per-partner network diagrams for the full partner portfolio — establishing documentation standards adopted org-wide.
- Resolved Apple Cash production traffic incident (2022): identified BGP routing misconfiguration causing drop in Apple Cash transactions through payment API, confirmed next-hop path, and restored production traffic — acted as on-call technical authority for P1 payment network incidents.
- Driving 16-workstream DC exit partner migration program as technical lead: completed Walgreens, FISERV, I2C, BlackHawks, and Certigy migrations to Azure VWAN VPN gateways; actively governing CVS, Cardworks, Berkshire, I2C Prod, and Walmart managed circuit migrations (Walmart, Walmart-EPAY, Walmart Settlement NDM, Walmart-Axciom).
- Engineered ticket-to-Panorama automation pipeline (Python/XML API): reads Jira NE tickets, generates Palo Alto Panorama API calls, executes pre-flight validation, deploys policy, and verifies commit — complete audit trail for PCI DSS compliance. Reduced firewall change implementation from 4+ hours to under 45 minutes (~80% reduction), handling hundreds of changes per year with zero transcription errors. Established this pipeline as the team's standard change management workflow.
- Architected nops — Python automation library for parallel operations across 180+ network devices (Netmiko/Paramiko): parallel command execution, before/after config diffs, automated rollback. Drove adoption as the team's standard tool for every change window; contributed 76+ pull requests and 178 commits to techops-ne-scripts GitHub — defining the NetDevOps standard for the network engineering team.
- Built and iterated Datadog GD Network Traffic Dashboard (v1–v10): real-time WAN circuit utilization, partner VPN tunnel health, SD-WAN performance, and anomaly detection. Authored 171 Confluence pages in TNE space: Azure VWAN knowledge base (9 pages), ACI migration runbooks, VeloCloud partner diagrams, PCI firewall inventory, and carrier escalation guides — establishing the network knowledge base for the org.
- Pioneered AI-integrated network operations at Green Dot: authored CLAUDE.md standard for AI-assisted change management ticket peer review; built Whisper AI transcription pipeline for meeting documentation; secured Azure OpenAI GPT-4 access for Python workflow automation; authored 'Vulnerability Management Modernization: Leveraging Claude AI' in InfoSec Confluence — establishing the first AI-integrated NetDevOps workflows in the organization.
- Led and governed 9-month Cisco ACI fabric migration program across DC1 and DC2 (Jan–Oct 2024): migrated FEDLINE (Federal Reserve), Blackhawk payment partner connections, VeloCloud SD-WAN edges, F5 BIG-IP/VIPRION load balancers, PacketFabric cloud routers, and CDE corporate firewalls — 20+ formally approved change windows on a live payment banking network. Zero service disruptions across the entire program. Authored 8-page ACI migration documentation library establishing the migration reference architecture.
- Governed Palo Alto firewall estate protecting millions of Green Dot prepaid cardholders' payment data: 6 physical firewalls, Panorama, and Cloud NGFW across DC1, DC2, and Azure. Established firewall policy standards, segmentation architecture, and PCI DSS compliance evidence processes. Passed 3 consecutive Tevora PCI penetration tests (2024–2026) with zero network-layer compliance failures — remediating Critical findings including MSMQ RCE and OpenNMS deserialization RCE vulnerabilities.
- Architected and deployed 4-node Cisco ISE cluster across DC1, DC2, Azure, and Singapore in under 3 months for 802.1X NAC enforcement and PCI-compliant access control. Proactively migrated RedSeal PCI audit appliance from DC1 to Azure and DC2 before DC1 decommission — maintaining zero compliance gap throughout the data center exit program.
Senior Network Engineer
NBCUniversal
Universal City
03.2016 - 05.2019
- Designed and maintained BGP peering and WAN connectivity across NBCUniversal facilities in Los Angeles and New York — managing carrier-redundant paths across studio, corporate, and broadcast environments.
- Administered Palo Alto firewall estate (PAN-OS/Panorama) across enterprise and broadcast environments, implementing security policies, zone segmentation, NAT, and managing PAN-OS upgrades and policy lifecycle.
- Coordinated WAN circuit activations and migrations, resolving carrier escalations to ensure seamless connectivity.
- Executed high-stakes change windows on production broadcast infrastructure, ensuring uninterrupted service for live national programming.
- Governed VLAN architecture, STP design, and QoS policy enforcement across Cisco campus and data center switching.
- Built Python tooling for network operations — bulk configuration auditing, pre/post change validation, and fleet management across Cisco and Palo Alto environments; introduced automation practices to the network engineering team.
Network Engineer (Contract via Insight Global)
NBCUniversal
Universal City
09.2015 - 03.2016
- Supported NBCUniversal enterprise infrastructure in Los Angeles and New York through Cisco routing/switching, WAN operations, and Palo Alto firewall change management to ensure reliable network performance.
- Designed and implemented network configurations for broadcasting systems.
- Monitored network performance to ensure system reliability and efficiency.
- Collaborated with teams to troubleshoot connectivity issues across media platforms.
Senior Network Engineer — Pre-Sales
World Wide Technology
Glendale
08.2013 - 09.2015
- Designed and governed multi-vendor enterprise network architectures for financial services, healthcare, and retail customers; delivered BOMs, solution topologies, and statements of work for Cisco Nexus data center fabrics, Palo Alto NGFW, Cisco ISE (802.1X NAC), VeloCloud SD-WAN, and wireless LAN.
- Supported over 300 site network refresh programs; built proof-of-concept labs validating SD-WAN, 802.1X NAC, and Nexus spine-leaf designs; created deployment runbooks and reference architectures for seamless handoff to post-sales teams.
- Cisco Gold VAR
Network Engineer
Viacom CBS
Los Angeles
01.2012 - 05.2013
- Supported Viacom CBS enterprise and studio infrastructure across Los Angeles by managing Cisco routing, switching, and WAN operations on Nexus campus backbone.
- Executed VLAN re-architecture, updated ACLs, implemented routing changes, and reviewed firewall rules; performed root cause analysis on network incidents and authored resolution runbooks to enhance incident response.
- Designed network architecture to support media streaming and production systems.
- Configured routers and switches for optimal performance across broadcast networks.
- Monitored network traffic to ensure stability and reliability during peak usage.
Network Engineer (Contract)
Lanair Technology Group
09.2011 - 01.2012
Education
Bachelor of Science - Information Technology
Western Governors University
Salt Lake City12-2010
Certification
- CCIE Written, Cisco Certified Internetwork Expert — Written Exam Passed
- CCNP, Cisco Certified Network Professional
- CCNA / CCNA Security, Cisco Certified Network Associate
- AZ-700, Microsoft Azure Network Engineer Associate
- AZ-104, Microsoft Azure Administrator Associate
- ITILv3, ITIL Foundation
Technical Skills
Cloud & Hybrid ConnectivityAzure Virtual WAN, ExpressRoute, Cloud NGFW, Private Link/Endpoint, Route Server, VNet Peering, NSGs, Application Gateway, AWS Transit Gateway, Direct Connect, VPC, Multi-cloud hybrid connectivity
Routing & SwitchingBGP (iBGP/eBGP, route reflectors, communities), OSPF, EIGRP, MPLS, VRF, VXLAN/EVPN, HSRP/VRRP, QoS, STP/RSTP, vPC, IPsec/VPN, Cisco Nexus 5K/7K/9K, Cisco ACI, Cisco IOS-XE/NX-OS, Cisco AnyConnect VPN
SD-WAN & Carrier WANCisco Catalyst SD-WAN (vManage/vSmart/vBond/C8000V/BFD/OMP/TLOC), VMware VeloCloud, Megaport MCR, PacketFabric, Zayo, MPLS carrier management
Security & CompliancePalo Alto PAN-OS/Panorama (XML API), Azure Cloud NGFW, Cisco ASA/FTD, Cisco ISE (802.1X/NAC), Zero Trust/ZTNA, Micro-segmentation, PCI DSS, SASE, Azure Front Door WAF, Rapid7, Cloudflare
Automation & IaCPython (Netmiko, Paramiko, Requests, REST API), PowerShell (Az module), Terraform, Ansible, Git/GitHub, GitHub Actions, CI/CD, NETCONF/RESTCONF, gNMI/OpenConfig
ObservabilityDatadog, ScienceLogic SL1, SolarWinds, Azure Monitor, NetBrain, Splunk, Wireshark, ExtraHop, ThousandEyes, Infoblox (DNS/DHCP/IPAM), NetBox, WAN utilization dashboards, Anomaly detection
Platforms & ToolsF5 BIG-IP/VIPRION, Cisco C8000V/ISR/ASR, Palo Alto PA-Series, Jira, Confluence, Azure OpenAI (GPT-4), Whisper AI, Claude (Anthropic
Timeline
Principal Network Engineer
Green Dot Corporation
05.2019 - Current
Senior Network Engineer
NBCUniversal
03.2016 - 05.2019
Network Engineer (Contract via Insight Global)
NBCUniversal
09.2015 - 03.2016
Senior Network Engineer — Pre-Sales
World Wide Technology
08.2013 - 09.2015
Network Engineer
Viacom CBS
01.2012 - 05.2013
Network Engineer (Contract)
Lanair Technology Group
09.2011 - 01.2012
Bachelor of Science - Information Technology
Western Governors University