Senior Security Consultant

Consult; Greater London; Hybrid; GBP 65,000 - 90,000; Part time

Job summary

Opticore IT is seeking a Senior Security Engineer to lead design, governance and hands-on delivery of a firewall program for a major bank, focusing on Cisco FTD and FortiGate.

This 6-month contract inside IR35 requires two days per week in Central London, with risk-based rule remediation, policy as code, and coordination with Technology Risk and the CISO office.

You will run workshops, map rules to business units, retire unused policies and produce segmented reports across BU owners.

Qualifications

• Cisco FTD/FMC & FortiGate firewall engineering.
• Firewall rule base review and remediation.
• Firewall governance and operating model design.
• Change control in regulated/financial services environments.
• Business and second-line stakeholder engagement.

Responsibilities

• Review the bank's current firewall policies, AlgoSec reports, Ivanti requests and change processes, and CMDB ownership data to establish the current state.
• Design the firewall operating model, covering roles, governance forums, policy hierarchy, exceptions and risk acceptance, and KPIs.
• Produce the ownership model and RACI, the request, change and continuous risk based recertification procedures, and the Ivanti firewall request catalogue item design.
• Tailor the Rule Design Standard to Cisco FTD and FortiGate, and define a vendor neutral rule schema that forms the data model for Policy as Code.
• Deliver BU workshops in London, write the BU onboarding pack, and support second line review with Technology Risk and the CISO office through to sign off.
• Analyse the full rule base in AlgoSec Firewall Analyzer, establish a measured baseline and risk rank the findings.
• Map rules to business units and service owners using the Ivanti CMDB, validate ownership with each BU, and investigate orphaned rules for risk acceptance.
• Remove unused, shadowed, redundant and expired rules through change packs with rollback plans, implemented out of hours under the bank's change control.
• Remediate wide and overly permissive rules in risk order, using Elastic traffic logs to design explicit replacement rules, validate failover paths, then monitor, disable and remove the original rules.
• Record every remediated and new rule in the vendor neutral format, and produce interim and final segmented reports showing each BU its rules and risk.
• Run a pilot recertification cycle with one BU, align DC Refresh firewalls with the framework, and deliver the Policy as Code high level design, close out report and stakeholder handover.

Skills

Cisco FTD/FMC

FortiGate Firewall

Firewall Governance

Rule Base Review

Change Control

Stakeholder Engagement

Tools

AlgoSec

Ivanti

Cisco FTD

FortiGate

Job description

Opticore IT is a specialist Network Engineer and Project Management consultancy offering a wide variety of opportunities to work within fast-paced, challenging environments across our client base spanning multiple sectors including Finance, Broadcast Media, Telecommunications and more.

Opticore IT are currently searching for a Senior Security Engineer who is confident working with Fortigate to join the team for an initial 6 month contract inside IR35 with scope to extend. This opportunity will require 2 days per week in Central London.

Lead the design, business agreement and hands on delivery of a new firewall governance framework for the bank, acting as design authority while reviewing and remediating a Cisco FTD and FortiGate estate of around 4,000 rules so that every rule has a clear owner, purpose and review date, and laying the foundation for Firewall Policy as Code.

What you'll be doing:

• Review the bank's current firewall policies, AlgoSec reports, Ivanti request and change processes, and CMDB ownership data to establish the current state.
• Design the firewall operating model, covering roles, governance forums, policy hierarchy, exceptions and risk acceptance, and KPIs.
• Produce the ownership model and RACI, the request, change and continuous risk based recertification procedures, and the Ivanti firewall request catalogue item design.
• Tailor the Rule Design Standard to Cisco FTD and FortiGate, and define a vendor neutral rule schema that forms the data model for Policy as Code.
• Deliver BU workshops in London, write the BU onboarding pack, and support second line review with Technology Risk and the CISO office through to sign off.
• Analyse the full rule base in AlgoSec Firewall Analyzer, establish a measured baseline and risk rank the findings.
• Map rules to business units and service owners using the Ivanti CMDB, validate ownership with each BU, and investigate orphaned rules for risk acceptance.
• Remove unused, shadowed, redundant and expired rules through change packs with rollback plans, implemented out of hours under the bank's change control.
• Remediate wide and overly permissive rules in risk order, using Elastic traffic logs (including month end and quarter end) to design explicit replacement rules, validate failover paths, then monitor, disable and remove the original rules.
• Record every remediated and new rule in the vendor neutral format, and produce interim and final segmented reports showing each BU its rules and risk.
• Run a pilot recertification cycle with one BU, align DC Refresh firewalls with the framework, and deliver the Policy as Code high level design, close out report and stakeholder handover

What you'll bring:

• Cisco FTD/FMC & FortiGate Firewall Engineering
• Firewall Rule Base Review & Remediation
• Firewall Governance & Operating Model Design
• Change Control in Regulated / Financial Services Environments
• Business & Second Line Stakeholder Engagement

Diversity:

At Opticore IT we embrace diversity and are committed to equal opportunities. We actively recruit for an inclusive and diverse workforce and as such, want to ensure we do everything we can to support your application.

We want you to feel empowered to let us know if you require any adjustments to be made with your application or interview process so please speak to our recruitment team.