Security Design Engineer

TEKsystems; City Of London; On-site; GBP 101,000 - 166,000; Full time

Job summary

TEKsystems is seeking an experienced Security Design Engineer to bridge traditional network security with modern application architecture in a cloud-native, service-mesh environment. You will design secure network architectures and security controls across on-prem, hybrid-cloud, and cloud platforms, focusing on service mesh maturity, identity-aware access, and micro-segmentation.

The role requires deep knowledge of service mesh (Istio/Envoy), Kubernetes, and security patterns, with a strong

Qualifications

• Strong enterprise network-security background.
• Experience designing secure architectures across on- prem, hybrid, and cloud environments.
• Knowledge of service mesh, Istio, Envoy, and microservices security.

Responsibilities

• Design and review secure enterprise network architectures across on-premise, hybrid-cloud and cloud environments.
• Define security architectures covering network segmentation, micro-segmentation, Zero Trust, secure connectivity and application traffic flows.
• Produce architectural documentation including HLDs, LLDs, security patterns and design standards.
• Assess existing network-security architectures and identify improvements or target-state designs.
• Design security controls for north-south and east-west traffic across environments.
• Work with engineering teams to translate security requirements into practical designs.

Skills

Network Security Architecture

Service Mesh

Kubernetes

Zero Trust

Application Security

CI/CD Security

Tools

Palo Alto

Check Point

Cisco Firepower

Fortinet

IDS/IPS

Job description

Security Design Engineer (ServiceMesh) - 6 Month Contract - INSIDE IR35 - London, Sheffield, Manchester, Birmingham - No Sponsorship Available

Project Overview

We are looking for an experienced Network Security Architect / Security Design Architect to support a major security transformation programme within a complex enterprise environment for a Tier 1 Bank. The programme is focused on evolving network and application security controls to support modern, cloud-native architectures. The environment spans traditional enterprise networking and security alongside Kubernetes, microservices, service mesh, APIs, cloud platforms and modern software-development practices. The successful individual will need to bridge the gap between traditional network security and modern application/platform architecture, working closely with network, security, platform, infrastructure and software-engineering teams.

This is not intended to be a traditional firewall-only position, nor a pure Cloud Security, DevOps or Kubernetes engineering role. The requirement is for someone with a strong network-security foundation who understands how applications are designed, developed, deployed and secured in modern distributed environments.

Key Responsibilities

Network Security Architecture & Design

• Design and review secure enterprise network architectures across on-premise, hybrid-cloud and cloud environments.
• Define security architectures covering network segmentation, micro-segmentation, Zero Trust, secure connectivity and application traffic flows.
• Produce and review architectural documentation including HLDs, LLDs, security patterns and design standards.
• Assess existing network-security architectures and identify appropriate improvements or target-state designs.
• Design security controls covering north-south and east-west traffic across enterprise and cloud-native environments.
• Work with engineering teams to ensure network-security requirements translate into practical technical designs.Firewall & Network Security

Firewall & Network Security

• Next-generation firewalls
• Palo Alto
• Check Point
• Cisco Firepower / ASA
• Fortinet
• IDS/IPS
• VPN/IPsec
• Secure ingress and egress
• Network segmentation
• Micro-segmentation
• Load balancing / application delivery
• Secure proxying
• Network policy and traffic inspection

Zero Trust

Apply Zero Trust principles across network, application and platform architectures.

• Design controls for segmentation and micro-segmentation across traditional infrastructure and cloud-native environments.
• Support identity-aware access and least-privilege security models.
• Understand the relationship between user identity, workload identity, network controls and service-to-service communication.

Service Mesh

A key element of the project is securing modern distributed application environments.

• Containerised workloads
• Microservices
• Service-to-service communication
• Service Mesh
• Istio
• Envoy
• Ingress/egress gateways
• Network policies
• API gateways
• Workload identity
• TLS / mTLS

The key requirement for this role is solid Service Mesh experience

Application Security & SDLC

The role requires someone who can work credibly with software-development and engineering teams.

• Secure-by-design principles
• Application Security
• API security
• Microservices security
• CI/CD pipelines
• Threat modelling
• SAST / DAST / SCA
• Authentication and authorisation
• PKI/certificate management
• Secrets management

The individual does not need to be a career Software Engineer, but must understand how software is developed and how network/security controls interact with modern applications. An earlier development, engineering or application-architecture background would therefore be useful.

Cloud Security

experience securing network and application architectures across one or more major cloud platforms:

• AWS
• Azure
• GCP

Useful experience would include:

• VPC/VNet architecture
• Cloud firewalls
• Transit/network gateways
• Direct Connect / ExpressRoute / Interconnect
• Private connectivity
• Cloud load balancing
• Kubernetes services such as EKS, AKS or GKE
• IAM/workload identity
• Cloud-native network controls

Essential experience

• Strong enterprise Network Security background
• Network Security Architecture / Network Security Engineering
• Enterprise firewall architecture and engineering
• Network segmentation / micro-segmentation
• Zero Trust
• Modern cloud networking/security
• Kubernetes/container understanding
• Microservices
• Service Mesh / Istio or comparable technology
• Understanding of SDLC and application security
• Secure-by-design architecture
• experience working directly with software, platform, infrastructure and security engineers
• HLD/LLD/security-design documentation
• Cloud experience across AWS, Azure and/or GCP

Location

London, UK