Project Role : Security Architect

Project Role Description : Define the cloud security framework and architecture, ensuring it meets the business requirements and performance goals. Document the implementation of the cloud security controls and transition to cloud security-managed operations.

Must have skills : Network Security Operations

Good to have skills : NA

Minimum 3 Year(s) Of Experience Is Required

Educational Qualification : 15 years full time education

Summary:

We are seeking a Network & Cloud Security Engineer with 5 to 12 years of experience across enterprise network security platforms, cloud security operations, and security automation. The role requires hands-on expertise with Palo Alto NGFW (physical and virtual), Cisco ASA, Cisco ISE, Zscaler ZIA/ZPA/ZDA, Fortinet SASE, and AWS security controls, alongside proven ability to automate operations through scripting, API integration, and infrastructure-as-code. The estate spans both IT and OT (manufacturing and critical production) firewall environments, and several platforms are mid-migration, so the candidate will support current and target technologies in parallel. The candidate will reduce manual toil, accelerate policy deployment, and enforce configuration consistency at scale across hybrid and multi-cloud environments.

Roles & Responsibilities:

Deploy, manage, and tune Palo Alto NGFW (PA-Series / VM-Series) and Panorama -maintain App-ID, User-ID, Security Profiles (Threat Prevention, WildFire, URL Filtering), HA configurations, and PAN-OS lifecycle management.
Operate and support OT firewalls protecting manufacturing and critical production environments - maintain IT/OT segmentation, work within production change windows, and adhere to validated-system change control.
Administer and operate Cisco ASA firewalls in production support the in-flight ASA to Palo Alto migration including rule translation, validation, and cutover support.
Administer and operate Zscaler ZIA and ZPA - manage SSL inspection, URL/content filtering, app connectors, and ZTNA access policies integrate with IdP via SAML/SCIM support Cisco AnyConnect remote access through its phase-out.
Operate Fortinet SASE - support the migration from Zscaler to FortiSASE and subsequent operations covering SSE controls, secure remote access, and unified policy enforcement across branch, mobile, and cloud workloads administer via FortiManager and FortiAnalyzer.
Administer Cisco ISE for NAC - manage 802.1X wired/wireless authentication, MAB, guest access, TrustSec SGT tagging, posture assessment, and RADIUS/TACACS+ policies integrate with Active Directory and MFA providers.
Operate cloud network security in AWS - manage Palo Alto VM-Series firewalls via Panorama, Security Groups, network ACLs, AWS WAF, VPC and Transit Gateway security, and AWS native security controls in line with client baselines.
Administer AWS IAM - manage users, groups, roles, policies, and permission boundaries process access provisioning, modification, and de-provisioning including joiner/mover/leaver activity manage service accounts and access key rotation troubleshoot access-denied and permission issues across identity, resource, and boundary policies support periodic access reviews and stale account clean-up.
Build and maintain automation using Python, Ansible, and Terraform - automate firewall rule deployment, ISE policy provisioning, Zscaler and Fortinet configuration management, AWS security group and IAM policy management, and compliance enforcement via platform REST APIs (PAN-OS API, Zscaler API, Cisco ISE ERS API, FortiOS/FortiManager API, AWS SDK/boto3).
Automate operational tasks including configuration backups, drift detection, policy compliance reporting, and alert-driven remediation using AWS Lambda, Ansible playbooks, or equivalent tooling.
Investigate and resolve escalated L2/L3 incidents - authentication failures, policy mismatches, tunnel failures, IAM permission issues, and traffic anomalies - within agreed SLAs.
Perform root cause analysis for major incidents document findings, coordinate remediation across network, cloud, and application teams, and track corrective actions to closure.
Raise, document, and implement changes through the client's change management process, including emergency changes, maintaining audit-ready evidence appropriate to a regulated environment.
Manage vendor and OEM support cases (Palo Alto, Cisco, Zscaler, Fortinet) through to closure.
Produce operational reports covering incident trends, automation coverage, policy changes, posture metrics, and SLA performance for management and audit

Professional & Technical Skills:

Palo Alto NGFW & Panorama - App-ID, User-ID, Security Profiles, WildFire, HA, PAN-OS upgrades, and VM-Series deployment in AWS.
OT / ICS network security - IT/OT segmentation, IEC 62443 concepts, Purdue model awareness, and firewall operations in manufacturing or plant environments.
Cisco ASA - firewall administration and platform migration experience.
Zscaler ZIA and ZPA - SSL inspection, URL filtering, app connector deployment, ZTNA policy, and IdP integration (Azure AD / Entra ID / Okta).
Fortinet SASE / FortiGate - SSE, secure remote access, unified security policy management, FortiManager and FortiAnalyzer.
Cisco ISE - 802.1X NAC, MAB, TrustSec, posture, RADIUS/TACACS+, and AD integration.
AWS security - Security Groups, network ACLs, AWS WAF, VPC and Transit Gateway security, and AWS native security controls.
AWS IAM - roles, policies, permission boundaries, federation concepts, access lifecycle management, and permission troubleshooting.
Automation & scripting - Python and Ansible for network and cloud security operations REST API integration with PAN-OS, Zscaler, Cisco ISE, Fortinet, and AWS APIs.
Infrastructure-as-Code - Terraform for network and cloud security resource management and policy-as-code enforcement.
Network fundamentals - TCP/IP, DNS, BGP/OSPF, IPsec/SSL VPN, SD-WAN, NAT, TLS, and traffic analysis.
Incident and problem management - ITIL-aligned processes, ITSM tooling (ServiceNow or equivalent), RCA documentation.
Palo Alto PCNSE (Palo Alto Networks Certified Network Security Engineer)
Zscaler ZCCA-IA or ZCCA-PA
Fortinet NSE 4 or above
Cisco CCNP Security
AWS Certified Security – Specialty
HashiCorp Terraform Associate
GIAC GICSP (desirable for OT-focused candidates)
ITIL Foundation v4

Additional Information:

The candidate should have minimum 3 years of experience in Network Security Operations.
This position is based at our BDC11 - SEZ office.
A 15 years full time education is required.