Lead/Senior Security System Engineer - Network Cloud

EPAM Systems; India; On-site; INR 350,000 - 600,000; Full time

Job summary

EPAM Systems seeks a Lead/Senior Security System Engineer to design, implement, and operate secure network segmentation across regional and Global environments. You will work with Check Point and Palo Alto gateways, Zscaler I&A/P&A for zero-trust access, and Cloudflare for DDoS protection and WAF, aligning with regulatory and operational requirements.

You will produce high-level and low-level designs, threat models, and control mappings, while driving incidents, RCAs, and policy automation

Qualifications

• 6–15 years of IT experience with a strong background in network security architecture and engineering.
• Excellence with Check Point and Palo Alto firewalls and firewall cluster/HA design.
• Proficiency in Zscaler Internet Access and Zscaler Private Access for zero-trust access control.
• Knowledge of Cloudflare Magic Transit/Magic WAN and WAF for DDoS protection.
• Experience with SD‑WAN, MPLS, and SASE architectures and policy-based routing.
• Familiarity with Microsoft Sentinel and SIEM platforms for telemetry and incident response.
• Automation and policy-as-code using Terraform, Ansible, and REST APIs.

Responsibilities

• Define trust zones, routing boundaries, and inter-zone controls for regional and Global Network.
• Produce HLD/LLD, threat models, and control mappings per standards and regulations.
• Design dual-vendor firewall perimeters with HA/cluster designs and SSL/TLS inspection governance.
• Engineer ZIA for identity-aware egress controls and SSL inspection with jurisdiction bypasses.
• Implement ZPA for per-application zero-trust access and app segmentation.
• Design Site-to-Site VPN and Cloud Interconnect equivalents with dual tunnels for failover.
• Deploy Cloudflare Magic Transit/Magic WAN and WAF management with rate limiting.
• Lead L3/L4 incidents and drive RCAs with corrective actions.
• Manage firewall, Zscaler, and Cloudflare policy via automation and CI/CD.

Skills

Network security architecture

Firewall design

Zero-trust security

SIEM response

Tools

Check Point Gateways

Palo Alto Firewalls

Zscaler I&A

Zscaler P&A

Cloudflare WAF

Terraform

Ansible

REST APIs

Job description

We are seeking a Lead/Senior Security System Engineer to design, implement, and operate secure, compliant network segmentation between regional environments and Global networks, using a standardised control stack of Check Point Security Gateways, Palo Alto Networks next-generation firewalls, Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Cloudflare for DDoS mitigation, WAF, and application protection. This role blends architecture, hands‑on engineering, automation, and L3/L4 operational leadership to deliver policy‑driven connectivity under strict regulatory and operational requirements.

Responsibilities

• Define trust zones, routing boundaries, and inter‑zone controls for regional and Global Network, covering north‑south and east‑west paths, micro‑segmentation for sensitive tiers, and explicit cross‑border allow‑lists.
• Produce HLD/LLD, threat models, and control mappings aligned to internal standards and regional regulation to enable secure communication.
• Design and operate dual‑vendor firewall perimeters, with clear control allocation, HA/cluster design, deterministic failover, NAT domain strategy, and SSL/TLS inspection governance tuned for jurisdiction.
• Engineer ZIA for identity‑aware egress controls, SSL inspection with jurisdiction‑aware bypasses, inline CASB/DLP, and sanctioned SaaS governance.
• Implement ZPA for per‑application zero‑trust access, with connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasible.
• Design and deliver Site‑to‑Site VPN, Cloud Interconnect/Partner Interconnect equivalents, and dual‑tunnel HA per site with BGP for failover between on‑prem and hub VPC.
• Deploy Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet‑facing services, with layered defence integration with on‑prem perimeters.
• Engineer SD‑WAN/MPLS/SASE paths with policy‑based routing, strong encryption, and defined key custody/rotation by jurisdiction.
• Translate regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations.
• Normalise telemetry from security platforms into SIEM with regional data handling rules, and build detections for cross‑border anomalies, DDoS events, and policy drift.
• Lead L3/L4 incidents, coordinate issue containment, and drive RCAs with corrective actions codified.
• Manage firewall, Zscaler, and Cloudflare policy through automation tools and vendor APIs, with CI/CD implementation including policy linting, unit tests, and path simulation.

Requirements

• 6‑15 years of overall IT experience, with a strong background in network security architecture and engineering.
• Expertise in Check Point Security Gateways, Palo Alto Networks next‑generation firewalls, and firewall cluster/HA design.
• Proficiency in Zscaler Internet Access and Zscaler Private Access for zero‑trust and identity‑aware access control.
• Knowledge of Cloudflare Magic Transit, Magic WAN, and WAF for DDoS mitigation and application protection.
• Familiarity with cloud hybrid connectivity, including Site‑to‑Site VPN, Cloud Interconnect, and BGP routing.
• Understanding of SD‑WAN, MPLS, and SASE architectures with policy‑based routing and strong encryption protocols.
• Skills in Microsoft Sentinel and SIEM platforms for telemetry normalisation, detection engineering, and incident response.
• Competency in automation and policy‑as‑code using Terraform, Ansible, and vendor REST APIs.
• Qualifications in regulatory compliance and audit readiness, including control matrices and CIS Benchmarks.