Security Design Engineer

Teksystems; Barking; On-site; GBP 111,000 - 185,000; Full time

Job summary

Teksystems is seeking an experienced Security Design Engineer to bridge traditional network security with modern cloud-native architecture. You will work across on-premises, hybrid and cloud environments to secure traffic flows and enable microservices security.

The role focuses on service mesh security, Kubernetes, Istio/Envoy, and Zero Trust, with collaboration across security, software development and platform teams in a major enterprise program.

Qualifications

• Strong enterprise network-security foundation.
• Experience designing secure architectures for on-premise and cloud environments.
• Knowledge of service mesh security, Istio, Envoy and API gateways.

Responsibilities

• Design and review secure enterprise network architectures across on-prem, hybrid-cloud and cloud environments.
• Define security architectures including segmentation, Zero Trust and secure connectivity.
• Produce architecture documents (HLDs/LLDs) and security patterns for standards.

Skills

Service Mesh

Istio

Envoy

Kubernetes

Zero Trust

Network Security

Cloud Networking

Tools

Palo Alto

Check Point

Cisco Firepower/ASA

Fortinet

VPN/IPsec

Job description

Security Design Engineer (ServiceMesh)

6 Month Contract - INSIDE IR35 - London, Sheffield, Manchester, Birmingham - No Sponsorship Available

Project Overview

We are looking for an experienced Network Security Architect / Security Design Architect to support a major security transformation programme within a complex enterprise environment for a Tier 1 Bank. The programme is focused on evolving network and application security controls to support modern, cloud-native architectures. The environment spans traditional enterprise networking and security alongside Kubernetes, microservices, service mesh, APIs, cloud platforms and modern software-development practices. The successful individual will need to bridge the gap between traditional network security and modern application/platform architecture, working closely with network, security, platform, infrastructure and software-development teams.

This is not intended to be a traditional firewall-only position, nor a pure Cloud Security, DevOps or Kubernetes engineering role. The requirement is for someone with a strong network-security foundation who understands how applications are designed, developed, deployed and secured in modern distributed environments.

Key Responsibilities

Network Security Architecture & Design

• Design and review secure enterprise network architectures across on-premise, hybrid-cloud and cloud environments.
• Define security architectures covering network segmentation, micro-segmentation, Zero Trust, secure connectivity and application traffic flows.
• Produce and review architectural documentation including HLDs, LLDs, security patterns and design standards.
• Assess existing network-security architectures and identify appropriate improvements or target-state designs.
• Design security controls covering north-south and east-west traffic across enterprise and cloud-native environments.
• Work with engineering teams to ensure network-security requirements translate into practical technical designs.

Firewall & Network Security

• Provide architecture and technical expertise across technologies and concepts such as:
• Next-generation firewalls
• Palo Alto
• Check Point
• Cisco Firepower/ASA
• Fortinet
• IDS/IPS
• VPN/IPsec
• Secure ingress and egress
• Network segmentation
• Micro-segmentation
• Load balancing / application delivery
• Secure proxying
• Network policy and traffic inspection

Zero Trust

• Apply Zero Trust principles across network, application and platform architectures.
• Design controls for segmentation and micro-segmentation across traditional infrastructure and cloud-native environments.
• Support identity-aware access and least-privilege security models.
• Understand the relationship between user identity, workload identity, network controls and service-to-service communication.

Service Mesh

A key element of the project is securing modern distributed application environments.

The individual should have experience working around:

• Containerised workloads
• Microservices
• Service-to-service communication
• Service Mesh
• Istio
• Envoy
• Ingress/egress gateways
• Network policies
• API gateways
• Workload identity
• TLS / mTLS

The key requirement for this role is solid Service Mesh experience.

Application Security & SDLC

The role requires someone who can work credibly with software-development and engineering teams.

Candidates should understand:

• The Software Development Lifecycle (SDLC)
• Secure-by-design principles
• Application Security
• API securityMicroservices security
• CI/CD pipelines
• Threat modelling
• SAST / DAST / SCA
• Authentication and authorisation
• PKI/certificate management
• Secrets management

The individual does not need to be a career Software Engineer, but must understand how software is developed and how network/security controls interact with modern applications. An earlier development, engineering or application-architecture background would therefore be useful.

Cloud Security

experience securing network and application architectures across one or more major cloud platforms:

• AWS
• Azure
• GCP

Useful experience would include:

• VPC/VNet architecture
• Cloud firewalls
• Transit/network gateways
• Direct Connect / ExpressRoute / Interconnect
• Private connectivity
• Cloud load balancing
• Kubernetes services such as EKS, AKS or GKE
• IAM/workload identity
• Cloud-native network controls

Essential Experience

The strongest CVs should demonstrate most of the following:

• Strong enterprise Network Security background
• Network Security Architecture / Network Security Engineering
• Enterprise firewall architecture and engineering
• Network segmentation / micro-segmentation
• Zero Trust
• Modern cloud networking/security
• Kubernetes/container understanding
• Microservices
• Service Mesh / Istio or comparable technology
• Understanding of SDLC and application security
• Secure-by-design architecture
• experience working directly with software, platform, infrastructure and security engineers
• HLD/LLD/security-design documentation
• Cloud experience across AWS, Azure and/or GCP

Location

London, UK