Senior Firewall Architect – Policy as Code & Governance

Consult; Greater London; Hybrid; GBP 65,000 - 90,000; Part time

Job summary

Opticore IT is seeking a Senior Security Engineer to lead design, governance and hands-on delivery of a firewall program for a major bank, focusing on Cisco FTD and FortiGate.

This 6-month contract inside IR35 requires two days per week in Central London, with risk-based rule remediation, policy as code, and coordination with Technology Risk and the CISO office.

You will run workshops, map rules to business units, retire unused policies and produce segmented reports across BU owners.

Qualifications

• Cisco FTD/FMC & FortiGate firewall engineering.
• Firewall rule base review and remediation.
• Firewall governance and operating model design.
• Change control in regulated/financial services environments.
• Business and second-line stakeholder engagement.

Responsibilities

• Review the bank's current firewall policies, AlgoSec reports, Ivanti requests and change processes, and CMDB ownership data to establish the current state.
• Design the firewall operating model, covering roles, governance forums, policy hierarchy, exceptions and risk acceptance, and KPIs.
• Produce the ownership model and RACI, the request, change and continuous risk based recertification procedures, and the Ivanti firewall request catalogue item design.
• Tailor the Rule Design Standard to Cisco FTD and FortiGate, and define a vendor neutral rule schema that forms the data model for Policy as Code.
• Deliver BU workshops in London, write the BU onboarding pack, and support second line review with Technology Risk and the CISO office through to sign off.
• Analyse the full rule base in AlgoSec Firewall Analyzer, establish a measured baseline and risk rank the findings.
• Map rules to business units and service owners using the Ivanti CMDB, validate ownership with each BU, and investigate orphaned rules for risk acceptance.
• Remove unused, shadowed, redundant and expired rules through change packs with rollback plans, implemented out of hours under the bank's change control.
• Remediate wide and overly permissive rules in risk order, using Elastic traffic logs to design explicit replacement rules, validate failover paths, then monitor, disable and remove the original rules.
• Record every remediated and new rule in the vendor neutral format, and produce interim and final segmented reports showing each BU its rules and risk.
• Run a pilot recertification cycle with one BU, align DC Refresh firewalls with the framework, and deliver the Policy as Code high level design, close out report and stakeholder handover.

Skills

Cisco FTD/FMC

FortiGate Firewall

Firewall Governance

Rule Base Review

Change Control

Stakeholder Engagement

Tools

AlgoSec

Ivanti

Cisco FTD

FortiGate

Job description

Opticore IT is seeking a Senior Security Engineer to lead design, governance and hands-on delivery of a firewall program for a major bank, focusing on Cisco FTD and FortiGate.

This 6-month contract inside IR35 requires two days per week in Central London, with risk-based rule remediation, policy as code, and coordination with Technology Risk and the CISO office.

You will run workshops, map rules to business units, retire unused policies and produce segmented reports across BU owners.