Senior Secure Access Engineer – Network Products

Bupa; Leeds; Hybrid; GBP 54,000 - 66,000; Full time

Benefits offered by this job

25 days holiday

Health insurance

Enhanced pension

Onsite gym

Employee discounts

Job summary

Bupa is seeking an experienced Senior Secure Access Engineer to design, implement and operate its Cisco ISE and NAC services across multiple locations. The role focuses on authentication, authorisation, profiling, posture and network segmentation to enable secure access for wired, wireless and remote users.

The candidate will lead policy development, drive continuous service improvements, and maintain documentation while collaborating with IT, security and infrastructure teams.

Qualifications

• Proven experience designing, implementing and supporting Cisco ISE in a large enterprise.
• Strong NAC, Zero Trust and identity-based access management understanding.
• Hands-on Cisco ISE Administration, 802.1X, RADIUS and TACACS+ experience.
• Device profiling, posture assessment and guest access capabilities.
• Experience with AD/Entra ID, PKI, SIEM and MDM/UEM integrations.

Responsibilities

• Design, implement, configure and support Cisco ISE infrastructure and NAC services.
• Develop AAA services using RADIUS and TACACS+.
• Design and manage 802.1X across wired, wireless, and remote access.
• Create and optimise ISE policy sets, profiling and posture policies.
• Implement device profiling, posture validation and compliance enforcement.
• Manage network segmentation via VLANs, SGTs, and TrustSec.
• Support guest access, self-registration, and onboarding workflows.
• Monitor health, performance and lifecycle of ISE; patching and upgrades.
• Lead testing, validation and deployment of ISE enhancements and integrations.
• Collaborate with stakeholders to translate access requirements into policy models.

Skills

Cisco ISE

NAC

Zero Trust

AAA (RADIUS/TACACS+)

802.1X

Device Profiling

Policy Management

Scripting (PowerShell, Python)

REST APIs

SIEM integration

Entra ID / AD integration

Duo / MFA integrations

Tools

Active Directory

Entra ID

PKI / Certificate Services

Cisco Duo

Job description

Job Description:Senior Secure Access Engineer - Network ProductsSalary: From £60,000+ (depending on exp.) Plus 10% yearly bonus and benefitsContract type: PermanentShift pattern: Full-time - 37.5 hours per weekLocation : Salford (M50 3SP), Staines (TW18 3DZ), Leeds (LS5 3BF), London (EC2R 7HJ), Brighton (BN1 4FY)Hybrid Working: 2 Days in officeWe make health happenAt Bupa, we're passionate about technology. With colleagues, customers, patients and residents in mind you'll have the opportunity to work on innovative projects and make a real impact on their lives.Right from the start you'll become part of our digital strategy, joining us on our journey and developing yourself along the way.Role OverviewThe Senior Secure Access Engineer role will be responsible for the design, implementation, administration, and continuous improvement of Bupa's Cisco Identity Services Engine (ISE) platform and associated Network Access Control (NAC) services.The role will ensure the availability, performance, security, and ongoing enhancement of the Cisco ISE estate, supporting secure access to wired, wireless, and remote network services across the organisation. Working within the IP&P Product stack, the engineer will be responsible for developing and maintaining authentication, authorisation, profiling, posture assessment, and network segmentation policies while ensuring alignment with Bupa's security standards and Zero Trust principles.The successful candidate will act as a subject matter expert for Cisco ISE, providing technical leadership, operational support, service improvement, and project delivery capabilities, whilst maintaining comprehensive documentation and demonstrating measurable service enhancements.How you'll help us make health happenDesign, implement, configure, and support Cisco ISE infrastructure and associated Network Access Control (NAC) services.Develop and maintain authentication, authorisation and accounting (AAA) services using RADIUS and TACACS+.Design, implement and manage 802.1X authentication solutions across wired, wireless and remote access environments.Create, maintain and optimise Cisco ISE policy sets, authorisation rules, endpoint groups, profiling policies and posture policies.Implement and manage device profiling, posture assessment and compliance validation to ensure only authorised and compliant devices gain network access.Design and maintain network segmentation policies using VLAN assignments, downloadable ACLs, Security Group Tags (SGTs) and TrustSec capabilities.Support guest access services, self-registration portals and third-party onboarding workflows within Cisco ISE.Monitor and maintain the health, performance, resilience and capacity of the Cisco ISE platform, ensuring timely patching, upgrades and lifecycle management.Troubleshoot complex authentication, authorisation and network access issues, working closely with Network, EUC, Security and Infrastructure teams to restore service.Maintain technical documentation, operational procedures, support runbooks and service introduction artefacts for Cisco ISE services.Lead testing, validation and deployment activities for Cisco ISE enhancements, upgrades and new network integrations.Collaborate with product managers, architects and engineering teams to deliver Cisco ISE roadmap initiatives and continuous service improvements.Work with business stakeholders to understand network access requirements and translate them into scalable and secure policy models.Continuously review emerging capabilities and industry best practices to enhance security, operational efficiency and user experience.Key Skills / Qualifications Needed For This RoleProven experience designing, implementing and supporting Cisco Identity Services Engine (ISE) within a large enterprise environment.Strong understanding of Network Access Control (NAC), Zero Trust principles and identity-based access management.Hands-on experience with: Cisco ISE Administration 802.1X Authentication RADIUS and TACACS+ Device Profiling Posture Assessment Guest Access Services Certificate-based Authentication Endpoint Compliance EnforcementStrong networking background with experience across: Routing and Switching LAN/WAN technologies Wireless Networking VLANs Network Segmentation DNS, DHCP and Active Directory integrationExperience integrating Cisco ISE with technologies such as: Microsoft Active Directory Entra ID PKI / Certificate Services Cisco Catalyst Centre SIEM Platforms MDM/UEM Platforms Cisco DuoExperience supporting both BAU operations and project-based delivery within complex enterprise environments.Strong troubleshooting and root-cause analysis skills across authentication, network connectivity and endpoint access issues.Experience working within Agile product teams and contributing to sprint-based delivery models.Ability to produce and maintain high-quality technical documentation, standards, operational procedures and support models.Excellent stakeholder management and communication skills, with the ability to engage effectively with technical and non-technical audiences.Experience with scripting and automation technologies (PowerShell, Python, REST APIs) would be advantageous.The following would be considered beneficial:Cisco Certified Network Professional (CCNP)Cisco Certified Specialist Security CertificationsCisco ISE Administration ExperienceCisco SDAccessMicrosoft Entra IDPKI InfrastructureZero Trust ArchitectureNetwork Segmentation TechnologiesCloud Platforms (Azure, AWS, GCP)BenefitsOur benefits are designed to make health happen for our people. Viva is our global wellbeing programme and includes all aspects of our health - from mental and physical, to financial, social and environmental wellbeing. We support flexible working and have a range of family friendly benefits.Joining Bupa in this role you will receive the following benefits and more:25 days holiday, increasing through length of service, with option to buy or sellBupa health insurance as a benefit in kindAn enhanced pension plan and life insuranceOnsite gyms or local discounts where no onsite gym availableVarious other benefits and online discountsWhy Bupa?We're a health insurer and provider. With no shareholders, our customers are our focus. Our people are all driven by the same purpose - helping people live longer, healthier, happier lives and making a better world. We make health happen by being brave, caring and responsible in everything we do.We encourage all of our people to ”Be you at Bupa”, we champion diversity, and we understand the importance of our people representing the communities and customers we serve. That's why we especially encourage applications from people with diverse backgrounds and experiences.Bupa is a Level 2 Disability Confident Employer. This means we aim to offer an interview/assessment to every disabled applicant who meets the minimum criteria for the role. We'll make sure you are treated fairly and offer reasonable adjustments as part of our recruitment process to anyone that needs them.Time Type:Full timeJob Area:ITLocations:Angel Court, London, Bupa Place, Kirkstall Forge, Staines - Willow House, Victory House, BrightonCycle to work scheme, Gym membership, Financial planning services, Free flu jabs, Employee mentoring programme, Referral programme, Company pension, Additional leave, Health & wellbeing programme, Paid volunteer time, Private dental insurance, Private medical insurance