Cloud Network Security Engineer

Aforeserve; Dadri; Presencial; INR 1.200.000 - 2.400.000; Jornada completa

Descripción de la vacante

Aforeserve in India is seeking a Network Security Engineer to design, configure, and manage multi-cloud networks across AWS, Azure, and GCP. You will implement VPCs, VPNs, routing, and peering, and lead firewall deployment and NAT traversal.

The role covers incident management, change control, monitoring, automation, and compliance with CIS/NIST standards, with on-call duties and tight SLAs.

Formación

• Design, configure, and manage VPCs (AWS), VNets (Azure), and VPCs (GCP) including subnets, route tables, and peering connections.
• Configure and troubleshoot AWS Transit Gateway, Azure Virtual WAN, and GCP Cloud Router for hub-and-spoke and mesh connectivity.
• Manage BGP and static routing across cloud environments and on-premises interconnects (AWS Direct Connect, Azure ExpressRoute, GCP Cloud Interconnect).
• Maintain DNS resolution strategies including AWS Route 53, Azure Private DNS, and GCP Cloud DNS integration with on-prem resolvers.
• Administer load balancers: AWS ALB/NLB, Azure Application Gateway / Load Balancer, and GCP Cloud Load Balancing.

Responsabilidades

• Deploy, configure, and manage cloud-native firewalls: AWS Network Firewall, Azure Firewall (Standard/Premium), and GCP Cloud Armor / Firewall Policies.
• Manage NGFWs in cloud environments including Palo Alto VM-Series, Fortinet FortiGate-VM, and Check Point Cloud Guard where applicable.
• Create and maintain security group (SG) and network ACL (NACL) policies in AWS; NSG and ASG rules in Azure; VPC firewall rules and hierarchical policies in GCP.
• Perform firewall policy reviews, rule optimization, and access path analysis to enforce least-privilege principles.
• Investigate and resolve firewall-related incidents, including blocked traffic, misconfigurations, and policy conflicts.
• Configure and manage WAF policies across AWS WAF, Azure WAF, and GCP Cloud Armor for application-layer protection.

Descripción del empleo

Key Responsibilities

• Design, configure, and manage VPCs (AWS), VNets (Azure), and VPCs (GCP) including subnets, route tables, and peering connections.
• Configure and troubleshoot AWS Transit Gateway, Azure Virtual WAN, and GCP Cloud Router for hub-and-spoke and mesh connectivity.
• Manage BGP and static routing across cloud environments and on-premises interconnects (AWS Direct Connect, Azure ExpressRoute, GCP Cloud Interconnect).
• Maintain DNS resolution strategies including AWS Route 53, Azure Private DNS, and GCP Cloud DNS integration with on-prem resolvers.
• Administer load balancers: AWS ALB/NLB, Azure Application Gateway / Load Balancer, and GCP Cloud Load Balancing.

Firewall & Network Security

• Deploy, configure, and manage cloud-native firewalls: AWS Network Firewall, Azure Firewall (Standard/Premium), and GCP Cloud Armor / Firewall Policies.
• Manage NGFWs in cloud environments including Palo Alto VM-Series, Fortinet FortiGate-VM, and Check Point Cloud Guard where applicable.
• Create and maintain security group (SG) and network ACL (NACL) policies in AWS; NSG and ASG rules in Azure; VPC firewall rules and hierarchical policies in GCP.
• Perform firewall policy reviews, rule optimization, and access path analysis to enforce least-privilege principles.
• Investigate and resolve firewall-related incidents, including blocked traffic, misconfigurations, and policy conflicts.
• Configure and manage WAF policies across AWS WAF, Azure WAF, and GCP Cloud Armor for application-layer protection.

Incident & Change Management

• Act as L2 escalation point for network and firewall incidents triaged by L1 support.
• Diagnose and resolve complex issues including packet loss, asymmetric routing, MTU mismatches, VPN instability, and latency spikes.
• Raise, assess, and implement change requests following ITIL-based change management processes (ServiceNow or equivalent ITSM tools).
• Maintain detailed RCA (Root Cause Analysis) documentation for major incidents.
• Participate in on-call rotations and provide timely resolution within defined SLA windows.

Connectivity & Hybrid Networking

• Manage site-to-site and client VPN solutions: AWS Client VPN / Site-to-Site VPN, Azure VPN Gateway / Point-to-Site, and GCP Cloud VPN (HA VPN).
• Implement and maintain SD-WAN overlays and cloud on-ramps where applicable.
• Manage private connectivity services and ensure redundancy via dual tunnels, BGP failover, and cross-AZ/zone resilience.
• Coordinate with ISPs, colocation providers, and WAN vendors for circuit provisioning and fault resolution.

Monitoring, Alerting & Automation

• Utilize native monitoring tools: AWS CloudWatch / VPC Flow Logs, Azure Monitor / NSG Flow Logs, and GCP Cloud Logging / Network Intelligence Center.
• Configure network-layer alerts and dashboards using tools such as Splunk, Grafana, or Dynatrace.
• Leverage infrastructure-as-code (IaC) for network provisioning using Terraform, AWS CloudFormation, or Azure Bicep.
• Develop automation scripts (Python/Bash/PowerShell) for firewall rule lifecycle management, report generation, and network audit tasks.
• Support AIOps-driven network automation initiatives including anomaly detection, auto-remediation workflows, and proactive health reporting.

Documentation & Compliance

• Maintain accurate and up-to-date network diagrams, IP address management (IPAM) records, and runbooks.
• Ensure cloud network configurations comply with CIS Benchmarks, NIST, ISO 27001, or client-specific security standards.
• Participate in internal and external security audits; provide evidence and remediation for network-related findings.
• Contribute to knowledge base articles and post-implementation reviews.

Required Skills & Qualifications

Experience

• 36 years of hands-on experience in network and/or network security engineering.
• Minimum 2+ years of demonstrated experience in at least two of the three major cloud platforms: AWS, Azure, or GCP.
• Proven experience managing firewalls in cloud environments (native and/or NGFW).