Lead/Senior Security System Engineer - Network Cloud

EPAM Systems; Pune District; On-site; INR 1,400,000 - 2,400,000; Full time

Benefits offered by this job

Health benefits

Retirement benefits

Paid time off

Flexible benefits

CSR initiatives

Job summary

EPAM Systems is seeking a Lead/Senior Security System Engineer to design, implement, and operate secure network segmentation across regional and global environments. You will work with Check Point gateways, Palo Alto firewalls, Zscaler platforms, and Cloudflare for DDoS protection and WAF.

The role blends architecture, hands-on engineering, and L3/L4 leadership to deliver policy-driven connectivity under regulatory constraints. Expect CI/CD automation, threat modeling, and incident leadership.

Qualifications

• Expertise in enterprise-grade firewall and security gateways.
• Experience with multi-vendor perimeter design and high-availability clustering.
• Proficiency in cloud hybrid connectivity and zero-trust architectures.

Responsibilities

• Design trust zones, routing boundaries and inter-zone controls for regional and Global Network.
• Produce architecture deliverables and threat models aligned to standards and regulations.
• Engineer dual-vendor perimeters with HA/cluster design and SSL/TLS inspection governance.
• Implement ZIA for identity-aware egress controls with inline CASB/DLP and sanctioned SaaS governance.
• Deploy ZPA for per-application zero-trust access and replace legacy VPN where feasible.
• Design Site-to-Site VPNs and Cloud Interconnect equivalents with redundancy.
• Deploy Cloudflare services (Magic Transit/WAN/WAF) and rate limiting with defence-in-depth.
• Operate SD-WAN/MPLS/SASE paths with policy-based routing and encryption.
• Translate regulatory controls into enforceable security logging, data residency, and intercept considerations.
• Lead major incidents, coordinate RCAs and drive corrective actions.

Skills

Check Point gateways

Palo Alto firewalls

Zscaler (ZIA/ZPA)

Cloudflare WAF/Magic Transit

ZIA/ZPA identity-aware access

Zscaler integration

Terraform

Ansible

REST APIs

SIEM (Microsoft Sentinel)

CI/CD automation

SASE/MPLS/SD-WAN

BGP/site-to-site VPN

Tools

Kubernetes

Cloud Interconnect

NAT domain strategy

Job description

EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture. Here you will collaborate with multi-national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting-edge solutions, and have an opportunity to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.We are seeking a Lead/Senior Security System Engineer to design, implement, and operate secure, compliant network segmentation between regional environments and Global networks, using a standardised control stack of Check Point Security Gateways, Palo Alto Networks next-generation firewalls, Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Cloudflare for DDoS mitigation, WAF, and application protection. This role blends architecture, hands-on engineering, automation, and L3/L4 operational leadership to deliver policy-driven connectivity under strict regulatory and operational requirements.ResponsibilitiesDefine trust zones, routing boundaries, and inter-zone controls for regional and Global Network, covering north-south and east-west paths, micro-segmentation for sensitive tiers, and explicit cross-border allow-listsProduce HLD/LLD, threat models, and control mappings aligned to internal standards and regional regulation to enable secure communicationDesign and operate dual-vendor firewall perimeters, with clear control allocation, HA/cluster design, deterministic failover, NAT domain strategy, and SSL/TLS inspection governance tuned for jurisdictionEngineer ZIA for identity-aware egress controls, SSL inspection with jurisdiction-aware bypasses, inline CASB/DLP, and sanctioned SaaS governanceImplement ZPA for per-application zero-trust access, with connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasibleDesign and deliver Site-to-Site VPN, Cloud Interconnect/Partner Interconnect equivalents, and dual-tunnel HA per site with BGP for failover between on-prem and hub VPCDeploy Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet-facing services, with layered defence integration with on-prem perimetersEngineer SD-WAN/MPLS/SASE paths with policy-based routing, strong encryption, and defined key custody/rotation by jurisdictionTranslate regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerationsNormalise telemetry from security platforms into SIEM with regional data handling rules, and build detections for cross-border anomalies, DDoS events, and policy driftLead L3/L4 incidents, coordinate issue containment, and drive RCAs with corrective actions codifiedManage firewall, Zscaler, and Cloudflare policy through automation tools and vendor APIs, with CI/CD implementation including policy linting, unit tests, and path simulationRequirements6-15 years of overall IT experience, with a strong background in network security architecture and engineeringExpertise in Check Point Security Gateways, Palo Alto Networks next-generation firewalls, and firewall cluster/HA designProficiency in Zscaler Internet Access and Zscaler Private Access for zero-trust and identity-aware access controlKnowledge of Cloudflare Magic Transit, Magic WAN, and WAF for DDoS mitigation and application protectionFamiliarity with cloud hybrid connectivity, including Site-to-Site VPN, Cloud Interconnect, and BGP routingUnderstanding of SD-WAN, MPLS, and SASE architectures with policy-based routing and strong encryption protocolsSkills in Microsoft Sentinel and SIEM platforms for telemetry normalisation, detection engineering, and incident responseCompetency in automation and policy-as-code using Terraform, Ansible, and vendor REST APIsQualifications in regulatory compliance and audit readiness, including control matrices and CIS BenchmarksWe offerOpportunity to work on technical challenges that may impact across geographiesVast opportunities for self-development: online university, knowledge sharing opportunities globally, learning opportunities through external certificationsOpportunity to share your ideas on international platformsSponsored Tech Talks & HackathonsUnlimited access to LinkedIn learning solutionsPossibility to relocate to any EPAM office for short and long-term projectsFocused individual developmentBenefit package:Health benefitsRetirement benefitsPaid time offFlexible benefitsForums to explore beyond work passion (CSR, photography, painting, sports, etc.)