Lead/Senior Security System Engineer - Network Cloud

Epam Systems; Chennai, Coimbatore District, Gurugram District; Vor Ort; INR 4.000.000 - 6.000.000; Vollzeit

Zusammenfassung

Epam Systems in Chennai seeks a Lead/Senior Security System Engineer to design, implement, and operate secure network segmentation across regional and Global networks. You will work with Check Point, Palo Alto, ZIA, ZPA, and Cloudflare to enforce policy-driven connectivity, regulatory compliance, and zero-trust controls.

You will blend architecture with hands-on engineering, automation, and L3/L4 leadership to deliver secure, scalable connectivity while meeting data residency and audit

Qualifikationen

• 6–15 years in IT with network security architecture and engineering.
• Strong expertise in Check Point and Palo Alto firewall designs.
• Proficiency with ZIA, ZPA, and Cloudflare for security and DDoS protection.
• Experience with SD-WAN/SASE, VPN, and BGP routing.
• Fluency with SIEM and incident response tooling (Microsoft Sentinel).
• Automation and policy-as-code using Terraform/Ansible.

Aufgaben

• Define trust zones, routing boundaries, and cross-border controls.
• Produce HLD/LLD, threat models, and control mappings.
• Design dual-vendor perimeters with HA and TLS inspection governance.
• Engineer ZIA/ZPA for identity-aware access and app segmentation.
• Implement VPNs, Cloud Interconnect, and dual-tunnel failover.
• Deploy Cloudflare Magic Transit/WAN and rate limiting.
• Lead L3/L4 incidents and drive RCAs with corrective actions.
• Automate policy via CI/CD and vendor APIs.

Kenntnisse

Network security

Check Point

Palo Alto

ZIA

ZPA

Cloudflare

SD-WAN

SASE

BGP routing

SIEM

Microsoft Sentinel

Terraform

Ansible

APIs automation

Tools

Terraform

Ansible

REST APIs

Jobbeschreibung

We are seeking a Lead/Senior Security System Engineer to design, implement, and operate secure, compliant network segmentation between regional environments and Global networks, using a standardised control stack of Check Point Security Gateways, Palo Alto Networks next-generation firewalls, Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Cloudflare for DDoS mitigation, WAF, and application protection. This role blends architecture, hands-on engineering, automation, and L3/L4 operational leadership to deliver policy-driven connectivity under strict regulatory and operational requirements.

Responsibilities

• Define trust zones, routing boundaries, and inter-zone controls for regional and Global Network, covering north-south and east-west paths, micro-segmentation for sensitive tiers, and explicit cross-border allow-lists
• Produce HLD/LLD, threat models, and control mappings aligned to internal standards and regional regulation to enable secure communication
• Design and operate dual-vendor firewall perimeters, with clear control allocation, HA/cluster design, deterministic failover, NAT domain strategy, and SSL/TLS inspection governance tuned for jurisdiction
• Engineer ZIA for identity-aware egress controls, SSL inspection with jurisdiction-aware bypasses, inline CASB/DLP, and sanctioned SaaS governance
• Implement ZPA for per-application zero-trust access, with connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasible
• Design and deliver Site-to-Site VPN, Cloud Interconnect/Partner Interconnect equivalents, and dual-tunnel HA per site with BGP for failover between on-prem and hub VPC
• Deploy Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet-facing services, with layered defence integration with on-prem perimeters
• Engineer SD-WAN/MPLS/SASE paths with policy-based routing, strong encryption, and defined key custody/rotation by jurisdiction
• Translate regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations
• Normalise telemetry from security platforms into SIEM with regional data handling rules, and build detections for cross-border anomalies, DDoS events, and policy drift
• Lead L3/L4 incidents, coordinate issue containment, and drive RCAs with corrective actions codified
• Manage firewall, Zscaler, and Cloudflare policy through automation tools and vendor APIs, with CI/CD implementation including policy linting, unit tests, and path simulation

Requirements

• 6-15 years of overall IT experience, with a strong background in network security architecture and engineering
• Expertise in Check Point Security Gateways, Palo Alto Networks next-generation firewalls, and firewall cluster/HA design
• Proficiency in Zscaler Internet Access and Zscaler Private Access for zero-trust and identity-aware access control
• Knowledge of Cloudflare Magic Transit, Magic WAN, and WAF for DDoS mitigation and application protection
• Familiarity with cloud hybrid connectivity, including Site-to-Site VPN, Cloud Interconnect, and BGP routing
• Understanding of SD-WAN, MPLS, and SASE architectures with policy-based routing and strong encryption protocols
• Skills in Microsoft Sentinel and SIEM platforms for telemetry normalisation, detection engineering, and incident response
• Competency in automation and policy-as-code using Terraform, Ansible, and vendor REST APIs
• Qualifications in regulatory compliance and audit readiness, including control matrices and CIS Benchmarks