Job Overview

We are looking for an experienced Senior Network Security Engineer to design, implement, operate, and continuously improve enterprise network security infrastructure. The role focuses on protecting business-critical systems while ensuring security, availability, performance, and scalability.

The ideal candidate combines strong networking fundamentals, hands-on security expertise, advanced troubleshooting skills, and production engineering experience. You will collaborate with Network, Infrastructure, SRE, SOC, DevOps, and application teams, take ownership of complex technical tasks, contribute to architecture decisions, and mentor other engineers.

Key Responsibilities

1. Network Security Engineering & Operations

• Design, implement, operate, and optimize secure, scalable, and highly available network security infrastructure.
• Configure and maintain NGFW, IDS/IPS, WAF, VPN, web filtering, DNS security, DDoS protection, NAC, and security monitoring solutions.
• Manage firewall policies, NAT, routing, access controls, security profiles, SSL/TLS inspection, and certificate configurations.
• Implement network segmentation, secure traffic flows, and least-privilege access controls.
• Evaluate existing infrastructure and technologies to identify security risks, architectural weaknesses, and opportunities for improvement.

2. Network Infrastructure & Troubleshooting

• Troubleshoot complex Layer 2–7 networking and security issues, including routing, switching, connectivity, latency, packet loss, MTU/MSS, and application communication.
• Analyze packet captures, network flows, firewall sessions, routing tables, logs, and protocol behavior to identify root causes.
• Support enterprise routing and switching, datacenter networking, network segmentation, and integration between network and security platforms.
• Resolve complex firewall issues involving NAT, policy matching, asymmetric routing, session handling, and application connectivity.

3. High Availability & Production Operations

• Design, maintain, and troubleshoot redundant network security architectures, including active-active and active-passive deployments, failover, and session synchronization.
• Plan and execute production changes, migrations, upgrades, and disaster-recovery tests with appropriate risk assessments, validation, and rollback procedures.
• Troubleshoot routing convergence and failure scenarios while minimizing service disruption and maintaining operational reliability.

4. Security Hardening & Incident Response

• Identify vulnerabilities, configuration weaknesses, attack vectors, and unauthorized access risks across network infrastructure.
• Conduct security reviews, implement hardening measures, and coordinate patching, firmware upgrades, and vulnerability remediation.
• Analyze security events, suspicious traffic, and infrastructure logs; collaborate with SOC and security teams on threat detection, containment, remediation, and recovery.
• Integrate network security platforms with centralized logging, monitoring, and SIEM solutions.
• Conduct root-cause analysis and implement preventive measures following security incidents.

5. Automation, Monitoring & Continuous Improvement

• Develop scripts and automation workflows for configuration validation, monitoring, reporting, and troubleshooting using Python, Bash, Ansible, APIs, or equivalent tools.
• Improve operational consistency, reduce manual errors, and enhance infrastructure reliability through automation and standardization.
• Evaluate emerging technologies, security threats, vulnerabilities, and infrastructure improvement opportunities.

6. Documentation, Collaboration & Technical Leadership

• Maintain network diagrams, configurations, technical documentation, implementation procedures, and incident records.
• Collaborate with cross-functional engineering teams, vendors, service providers, and external partners to resolve technical issues and deliver infrastructure projects.
• Contribute to architecture reviews, technical standards, engineering decisions, and security improvement roadmaps.
• Provide technical guidance and mentorship to junior and mid-level engineers and participate in knowledge-sharing activities.

Required Qualifications

Professional Experience

• Typically 5+ years of hands-on experience in enterprise networking and network security, or equivalent demonstrated expertise.
• Proven experience operating and troubleshooting enterprise network security solutions in production environments.
• Ability to independently manage complex technical tasks, resolve critical incidents, and implement infrastructure improvements.

Networking Fundamentals

• Strong knowledge of TCP/IP, enterprise routing and switching, and Layer 2–7 troubleshooting.
• Hands-on knowledge of OSPF, BGP, static routing, Policy-Based Routing (PBR), VLANs, 802.1Q, LACP, STP, NAT, DNS, DHCP, and network segmentation.
• Ability to analyze network traffic and protocol behavior using Wireshark, tcpdump, or equivalent tools.

Network Security Technologies

• Strong hands-on experience with at least one major enterprise NGFW platform, such as Fortinet FortiGate or Cisco Secure Firewall (FTD).
• Advanced knowledge of firewall policies, NAT, security profiles, routing integration, and troubleshooting.
• Understanding of IDS/IPS, WAF, web filtering, DNS security, DDoS mitigation, NAC, RADIUS, and 802.1X.
• Familiarity with centralized logging, monitoring, and SIEM integration.

VPN, Encryption & High Availability

• Strong knowledge of IPsec, IKE/IKEv2, SSL VPN, and site-to-site and remote-access VPN architectures.
• Understanding of TLS, PKI, digital certificates, authentication, and SSL/TLS inspection.
• Practical experience with firewall redundancy, failover, active-active/active-passive architectures, and session synchronization.
• Experience implementing production changes using risk assessment, validation, and rollback procedures.

Automation, Monitoring & Security Principles

• Basic proficiency in Python, Bash, Ansible, or equivalent scripting and automation tools, with familiarity with REST APIs.
• Experience using monitoring, logging, and troubleshooting tools to investigate performance and connectivity issues.
• Strong understanding of network security principles, least privilege, defense in depth, vulnerability remediation, and security hardening.
• Familiarity with security frameworks and best practices, including ISO 27001, NIST, and CIS Controls.

Preferred Qualifications

• Experience with multiple enterprise firewall platforms, particularly Fortinet FortiGate and Cisco Secure Firewall.
• Hands-on experience with F5 BIG-IP, including LTM, Advanced WAF/ASM, APM, or AFM.
• Experience with Cisco ISE, 802.1X, RADIUS, device profiling, and network access policies.
• Familiarity with datacenter networking technologies, including Cisco Nexus, VXLAN EVPN, vPC, and leaf-spine architectures.
• Experience with DDoS mitigation, CDN security, application delivery, or cloud and hybrid-network security.
• Experience with infrastructure automation and version control tools, including Python, Ansible, Git, and REST APIs.
• Familiarity with Zabbix, Grafana, Prometheus, Splunk, or equivalent monitoring and logging platforms.
• Experience with security audits, technical compliance assessments, and infrastructure hardening initiatives.
• Relevant certifications, such as Cisco CCNP/CCIE Security or Enterprise, Fortinet professional/expert-level certifications, F5 BIG-IP certifications, or Cisco ISE-related certifications.

Certifications are an advantage; practical experience and demonstrated technical competence are the primary evaluation criteria.

Required Skills & Competencies

• Technical ownership: Independently manage complex engineering tasks and take responsibility for implementation quality and operational outcomes.
• Advanced troubleshooting: Systematically investigate complex issues and identify root causes.
• Security mindset: Proactively identify vulnerabilities, reduce attack surfaces, and strengthen security controls.
• Analytical thinking: Evaluate technical alternatives and make informed engineering decisions.
• Production awareness: Understand operational risk, business impact, service availability, and change management.
• Communication & collaboration: Clearly communicate technical findings and recommendations and work effectively across teams.
• Documentation & mentorship: Maintain clear technical documentation, share knowledge, and support other engineers' development.
• Continuous improvement: Enhance infrastructure security, reliability, performance, and operational efficiency.