Lead Security System Engineer - Network Cloud

EPAM Systems Inc; Chennai, Coimbatore District, Gurugram District; On-site; INR 2,500,000 - 4,500,000; Full time

Job summary

EPAM Systems Inc. seeks a Lead Security System Engineer - Network Cloud to own secure segmentation across regional and global networks, leveraging Check Point, Palo Alto, Zscaler, and Cloudflare. The role emphasizes architecture, automation, and cross‑vendor collaboration to support L3/L4 operations.

You will design high‑level and detailed controls, implement identity‑aware access, and guide perimeters, VPNs, and DLP in line with regional regulations.

Qualifications

• Broad IT background with 5+ years in network security architecture and engineering.
• Strong hands‑on experience with Check Point, Palo Alto, Zscaler and Cloudflare.
• Experience in designing secure segmentation across regional and global networks.

Responsibilities

• Establish trusted zones, inter‑zone controls, and cross‑border allow‑lists.
• Develop high level and low level designs, threat models, and control mappings.
• Architect dual‑vendor firewall perimeters with HA/cluster design and failover.
• Configure ZIA for identity‑aware egress, SSL inspection, and CASB/DLP.
• Roll out ZPA for per‑application zero‑trust access and agentless connectors.
• Implement Site‑to‑Site VPN, Cloud Interconnect, and dual tunnel HA per site.
• Deliver Cloudflare Magic Transit/WAN, WAF management, and rate limiting.
• Optimize SD‑WAN/MPLS/SASE paths with policy‑based routing and encryption.
• Translate regulatory controls into enforceable security measures and logging.
• Ingest telemetry into SIEM and develop detections for cross‑border events.
• Lead L3/L4 incident response, containment, and RCAs with corrective actions.

Skills

Network security architecture

Vendor firewall expertise

Zero trust / identity aware access

Cloud and hybrid connectivity

Tools

Check Point

Palo Alto Networks

Zscaler (ZIA/ZPA)

Cloudflare

Terraform

Ansible

Job description

We are looking for a Lead Security System Engineer - Network Cloud to ensure secure, compliant segmentation between regional environments and Global networks using an agreed control stack. You will own architecture and implementation across Check Point, Palo Alto Networks, Zscaler ZIA/ZPA, and Cloudflare while driving automation and L3/L4 operational leadership.

Responsibilities

• Establish trust zones, routing boundaries, and inter-zone controls for regional and Global Network, covering north-south and east-west paths, micro-segmentation for sensitive tiers, and explicit cross-border allow-lists
• Develop HLD/LLD, threat models, and control mappings aligned with internal standards and regional regulation to enable secure communication
• Architect and run dual-vendor firewall perimeters with clear control allocation, HA/cluster design, deterministic failover, NAT domain strategy, and SSL/TLS inspection governance tuned for jurisdiction
• Design ZIA configurations for identity-aware egress controls, SSL inspection with jurisdiction-aware bypasses, inline CASB/DLP, and sanctioned SaaS governance
• Roll out ZPA for per-application zero-trust access by planning connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasible
• Implement Site-to-Site VPN, Cloud Interconnect/Partner Interconnect equivalents, and dual-tunnel HA per site with BGP for failover between on-prem and hub VPC
• Deliver Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet-facing services, integrating layered defence with on-prem perimeters
• Optimize SD-WAN/MPLS/SASE paths using policy-based routing, strong encryption, and defined key custody/rotation by jurisdiction
• Convert regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations
• Ingest and normalize telemetry from security platforms into SIEM with regional data handling rules, and build detections for cross-border anomalies, DDoS events, and policy drift
• Direct L3/L4 incidents, coordinate containment, and drive RCAs with corrective actions codified
• Automate firewall, Zscaler, and Cloudflare policy management through automation tools and vendor APIs, including CI/CD implementation with policy linting, unit tests, and path simulation

Requirements

• Broad IT background (5+ years) with demonstrated strength in network security architecture and engineering
• Advanced expertise in Check Point Security Gateways, Palo Alto Networks next-generation firewalls, and firewall cluster/HA design
• Hands-on experience with Zscaler Internet Access and Zscaler Private Access to deliver zero-trust and identity-aware access control
• Strong understanding of Cloudflare Magic Transit, Magic WAN, and WAF for DDoS mitigation and application protection
• Working knowledge of hybrid cloud connectivity patterns, including Site-to-Site VPN, Cloud Interconnect, and BGP routing
• Solid grasp of SD-WAN, MPLS, and SASE architectures with policy-based routing and strong encryption protocols
• Proficiency with Microsoft Sentinel and SIEM platforms for telemetry normalisation, detection engineering, and incident response
• Practical automation skills for policy-as-code using Terraform, Ansible, and vendor REST APIs
• Familiarity with regulatory compliance and audit readiness activities, including control matrices and CIS Benchmarks