Lead/Senior Security System Engineer - Network Cloud

Responsibilities

• Define trust zones, routing boundaries, and inter-zone controls for regional and Global Network, covering north-south and east-west paths, micro-segmentation for sensitive tiers, and explicit cross-border allow-lists
• Produce HLD/LLD, threat models, and control mappings aligned to internal standards and regional regulation to enable secure communication
• Design and operate dual-vendor firewall perimeters, with clear control allocation, HA/cluster design, deterministic failover, NAT domain strategy, and SSL/TLS inspection governance tuned for jurisdiction
• Engineer ZIA for identity-aware egress controls, SSL inspection with jurisdiction-aware bypasses, inline CASB/DLP, and sanctioned SaaS governance
• Implement ZPA for per-application zero-trust access, with connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasible
• Design and deliver Site-to-Site VPN, Cloud Interconnect/Partner Interconnect equivalents, and dual-tunnel HA per site with BGP for failover between on-prem and hub VPC
• Deploy Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet-facing services, with layered defence integration with on-prem perimeters
• Engineer SD-WAN/MPLS/SASE paths with policy-based routing, strong encryption, and defined key custody/rotation by jurisdiction
• Translate regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations
• Normalise telemetry from security platforms into SIEM with regional data handling rules, and build detections for cross-border anomalies, DDoS events, and policy drift

Languages