We are hiring a Lead Security System Engineer - Network Cloud to build and run compliant network segmentation across regions and Global networks using a standardized security stack. You will combine architecture, hands-on engineering, automation, and L3/L4 operations across Check Point, Palo Alto Networks, ZIA, ZPA, and Cloudflare. Apply to help deliver policy-driven connectivity under strict regulatory constraints.

Responsibilities

Define trust zones, routing boundaries, and inter-zone controls for regional and Global Network, including north-south and east-west paths, micro-segmentation for sensitive tiers, and explicit cross-border allow-lists
Create HLD/LLD, threat models, and control mappings aligned to internal standards and regional regulation to enable secure communication
Design and operate dual-vendor firewall perimeters with clear control allocation, HA/cluster design, deterministic failover, NAT domain strategy, and SSL/TLS inspection governance tuned for jurisdiction
Configure ZIA for identity-aware egress controls, SSL inspection with jurisdiction-aware bypasses, inline CASB/DLP, and sanctioned SaaS governance
Implement ZPA for per-application zero-trust access, including connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasible
Deliver Site-to-Site VPN, Cloud Interconnect/Partner Interconnect equivalents, and dual-tunnel HA per site with BGP for failover between on-prem and hub VPC
Deploy Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet-facing services, integrating layered defence with on-prem perimeters
Engineer SD-WAN/MPLS/SASE paths with policy-based routing, strong encryption, and defined key custody/rotation by jurisdiction
Translate regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations
Normalize telemetry from security platforms into SIEM with regional data handling rules, and build detections for cross-border anomalies, DDoS events, and policy drift
Lead L3/L4 incidents, coordinate issue containment, and drive RCAs with corrective actions codified
Manage firewall, Zscaler, and Cloudflare policy through automation tools and vendor APIs, implementing CI/CD including policy linting, unit tests, and path simulation

Requirements

Extensive IT experience (5+ years) with a strong focus on network security architecture and engineering
Expert-level knowledge of Check Point Security Gateways, Palo Alto Networks next-generation firewalls, and firewall cluster/HA design
Hands-on proficiency with Zscaler Internet Access and Zscaler Private Access for zero-trust and identity-aware access control
Solid knowledge of Cloudflare Magic Transit, Magic WAN, and WAF for DDoS mitigation and application protection
Practical familiarity with cloud hybrid connectivity, including Site-to-Site VPN, Cloud Interconnect, and BGP routing
Deep understanding of SD-WAN, MPLS, and SASE architectures with policy-based routing and strong encryption protocols
Strong capability with Microsoft Sentinel and SIEM platforms for telemetry normalisation, detection engineering, and incident response
Proven ability to automate and manage policy-as-code using Terraform, Ansible, and vendor REST APIs
Working knowledge of regulatory compliance and audit readiness, including control matrices and CIS Benchmarks