Network Security Engineer

About the role

We are looking for a seasoned Network Security Engineer to join our team and ensure the integrity, availability, and performance of our firewall, routing, and switching infrastructure. The role involves designing, implementing, and maintaining security policies across complex network environments.

Key responsibilities

• Audit, optimise, and clean up firewall security policies, removing shadow and expired rules.
• Configure and troubleshoot Source NAT, Destination NAT, and Static NAT for internal and DMZ services.
• Establish, monitor, and resolve issues with Site‑to‑Site IPsec VPNs and Remote Access SSL VPNs.
• Manage HA firewall clusters (Active/Passive or Active/Active) and perform hitless firmware upgrades.
• Maintain and tune core routing protocols (BGP, OSPF, IS‑IS) and implement traffic‑engineering attributes.
• Develop and enforce prefix‑lists, route‑maps, and policy‑based routing to control traffic flow.
• Conduct regular failover testing of VRRP/HSRP and monitor STP/RSTP/MSTP to prevent loops.
• Configure EtherChannel/LACP, switch stacks, VLANs, and 802.1Q trunking with strict pruning.
• Plan and execute OS/firmware upgrades, backup configurations, and maintain a disaster‑recovery playbook.
• Lead root‑cause analysis for major incidents using Wireshark packet captures and Syslog logs.

Required profile

• Minimum 5 years of progressive experience in firewall configuration, IP routing, and switching maintenance.
• Strong analytical skills with a proven ability to troubleshoot complex network and security issues.
• Hands‑on experience with high‑availability firewall clusters and VPN technologies.
• Ability to work independently and lead technical investigations.

Required skills

• Firewall configuration
• IP routing troubleshooting
• Switching maintenance
• NAT and PAT
• Site‑to‑Site IPsec VPN
• Remote Access SSL VPN
• HA firewall clustering
• BGP
• OSPF
• IS‑IS
• Prefix‑lists
• Route‑maps
• Policy‑based routing
• VRRP
• HSRP
• Spanning Tree Protocol (STP/RSTP/MSTP)
• EtherChannel
• LACP
• VLAN
• 802.1Q
• OS/firmware upgrades
• Configuration backup
• Disaster Recovery
• Wireshark
• Syslog