Role Summary
- The L3 Security Engineer leads advanced-level troubleshooting, designs secure architectures, optimizes firewall/SD-WAN deployments, and handles critical security incidents. They provide leadership to L2 teams, develop automation, drive improvements in policies, and collaborate with SOC and architecture teams to maintain a robust security posture.
Key Responsibilities
FortiGate Firewall – Advanced Architecture & Troubleshooting
- Architect enterprise FortiGate deployments:
- Active/Active & Active/Passive HA
- Advanced Routing (OSPF, BGP, ECMP)
- Segmentation & Zero Trust Policy Models
Perform deep-dive troubleshooting on:
- Asymmetric routing, session drops
- Application control/IPS/AV issues
- Performance degradation, CPU spikes
- Design and optimize firewall policies using best practices: least privilege, object reuse, rule cleanup.
- Conduct advanced traffic analysis using packet captures and flow tracing.
- Lead firewall migration and large-scale rule redesign projects.
Fortinet SD-WAN – Design & Optimization
- Architect SD-WAN infrastructure and application SLA strategies.
- Optimize steering rules, performance SLAs, and WAN failover logic.
- Troubleshoot complex SD-WAN issues:
- Dynamic path selection failures
- Link quality fluctuations
- Overlay tunnel instability
- Integrate SD-WAN with MPLS, DIA, 4G/5G circuits.
FortiClient SSL VPN – Advanced Support
- Design SSL VPN architectures with dual-factor authentication, SAML/LDAP, AD integration.
- Troubleshoot complex VPN issues:
- Routing conflicts
- Packet fragmentation
- Split tunneling vs. full tunnel problems
- EMS/Zero Trust posture integration
- Conduct forensic analysis of compromised or suspicious VPN sessions.
FortiAnalyzer + FortiManager – Enterprise-Level Management
- Architect centralized configuration management (ADOMs, workflows).
- Automate deployments via scripts / APIs using FortiManager.
- Design custom log and reporting dashboards for compliance and threat analytics.
- Perform log forensics for incidents and threat investigations.
F5 SSL VPN (F5 APM) – Advanced Design
- Architect APM solutions including:
- Advanced access policies
- SSO, identity federation, OAuth, SAML
- Endpoint posture detection
- Troubleshoot APM authentication loops, profile conflicts, certificate trust issues.
- Integrate APM with external IDP/LDAP/Radius systems.
NIPS (Network Intrusion Prevention System)
- Architect and tune IPS/IDS signatures for optimal detection with minimal false positives.
- Perform deep forensic analysis of intrusion attempts.
- Design IPS bypass, inline deployments, and fail-open strategies.
- Integrate NIPS with SIEM & SOC workflows.
Additional Responsibilities
- Act as SME for major incidents and escalations.
- Conduct root cause analysis (RCA) for chronic and recurring issues.
- Produce HLD/LLD, SOPs, security standards, and hardening guides.
- Lead patching/upgrades, version strategy, and high-risk changes.
- Support compliance audits and security risk assessments.
- Mentor and train L1/L2 engineers.
Skills Required
- Mastery of firewall, IPS, VPN, routing, and SD-WAN technologies.
- Deep knowledge of PKI, certificates, and encryption standards.
- Expertise in packet analysis (Wireshark, tcpdump, FortiGate debug).
- Understanding of cloud integration (Azure/AWS firewalls, SD-WAN).
- Good scripting skills (Python, API, Ansible).
Experience
- Upto 14 years relevant experience of enterprise security engineering.
Preferred Certifications:
- Fortinet NSE6 / NSE7
- CCNP Security / CCIE Security.
