Network Security Engineer - Deployment and Support

Sanofi; Hyderabad; On-site; INR 1,200,000 - 2,100,000; Full time

Job summary

Sanofi is seeking a Network Security Engineer - Deployment and Support to build, deploy, and support the enterprise security estate. You will automate infrastructure as code, manage policy lifecycles, and ensure auditable, resilient security posture across cloud and on‑prem environments.

Responsibilities include deploying firewalls, WAFs, VPNs, and DDoS protection, plus aligning with change management, incident response, and automation best practices using Terraform, Ansible, Python, and related

Qualifications

• Experience deploying network security infrastructure in enterprise environments.
• Proficiency with Terraform/Ansible and scripting in Python.
• Knowledge of cloud-networking, firewalls, WAFs, and VPNs, plus policy as code.
• Experience with change management and incident response in security operations.

Responsibilities

• Deploy network security infrastructure as code across cloud and on‑prem.
• Maintain firewall/WAF configurations with version control and audit trails.
• Automate provisioning and operational tasks via Python and APIs.
• Operate change pipelines with pre/post validation and rollback plans.
• Integrate security policy lifecycle with ticketing and CMDB.

Skills

Policy as Code

Automation

Incident Response

Change Management

Version control

Tools

Terraform

Ansible

Python

Junos Space

Cisco APIC

FortiOS

Juniper SRX

Zscaler

ServiceNow

AlgoSec

Git

Job description

About the Job

As 'Network Security Engineer - Deployment and Support' within our Digital Technology Service Quality team, you will build, deploy, and support the network security estate that protects Sanofi's enterprise - firewalls across Cisco ASA and FTD, Fortinet FortiGate, and Juniper SRX, Web Application Firewalls, DDoS protection, VPNs, and the Zscaler cloud security platform. You will deploy security infrastructure and policy as code using Terraform, Ansible, and Python wherever the platform allows, and apply the same engineering rigour where it does not. You will own what you deploy - from policy definition and automated pre-change validation through to day-two operations, rule lifecycle hygiene, and incident response - ensuring our network security posture remains accurate, auditable, and resilient. Ready to get started?

Our Team

Digital Technology - Service Quality is at the heart of Sanofi's digital transformation. We deliver secure, resilient, and scalable infrastructure services that power business-critical applications and enable thousands of users across the enterprise. Our network security engineering team sits at the boundary of every service we run - enforcing segmentation, controlling access, and giving our security operations colleagues the visibility they need. Our team combines modern cloud platforms, automation-first engineering, and service excellence to support Sanofi's mission of chasing the miracles of science.

About Sanofi

We’re an R&D-driven, AI-powered biopharma company committed to improving people's lives and delivering compelling growth. Our deep understanding of the immune system - and innovative pipeline - enables us to invent medicines and vaccines that treat and protect millions of people around the world. Together, we chase the miracles of science to improve people's lives.

Main Responsibilities

Network Security Deployment - Infrastructure and Policy as Code

• Deploy cloud network security infrastructure as code using Terraform, provisioning security groups and network security groups, cloud-native firewall and WAF policy, route tables, private connectivity, and inspection architectures across AWS and Azure, with reusable modules, remote state management, and plan review built into the change process
• Deploy and maintain firewall and network security configuration as code using Ansible, building reusable roles and templates for Cisco ASA and FTD, Fortinet FortiOS, and Juniper SRX so that every change is repeatable, version-controlled, and auditable
• Automate security provisioning and operational tasks in Python, consuming platform APIs - Junos Space for SRX estate management, Cisco APIC for ACI contract and microsegmentation policy, FortiGate and FortiAnalyzer APIs, Zscaler APIs, and F5, Array, and AVI load balancer and WAF APIs
• Automate vendor web consoles and portals that expose no usable API using Selenium, so that licensing, reporting, and legacy management interfaces do not force manual work
• Use Gemini CLI as an AI agent within the engineering workflow to accelerate policy review, triage large firewall log and packet-capture data sets, summarise rule-base findings, draft runbooks and knowledge articles, and scaffold Ansible and Python automation
• Maintain Git as the source of truth for network security configuration, with golden configuration templates, peer-reviewed changes, and a full version-controlled audit trail of every policy change
• Operate deployment pipelines for network security change, including automated pre-change validation, policy risk and compliance checks using AlgoSec, and automated post-deployment verification of traffic flow and policy hit behaviour
• Implement configuration drift detection and automated remediation, so deployed security policy provably matches its declared intent
• Codify security baselines and standards - hardening, zoning, naming, and device software targets - and gate deployments against them
• Integrate the firewall rule request lifecycle with ServiceNow, so approved requests flow into validated, automated deployment rather than manual console work

Network Security Deployment - Engineering Delivery

• Build and deploy network security configuration items (CIs) - firewalls, VPN concentrators, WAF and load balancer platforms, and DDoS protection services - from initial requirement through to validated production handover
• Deliver deployments to enterprise sites, manufacturing sites, and on-premises data centres, including physical installation, cabling, high-availability pairing, licensing, and firmware qualification where automation is not available
• Deliver hardware refresh, end-of-life replacement, and software upgrade campaigns across Cisco ASA/FTD, FortiOS, and Junos SRX platforms
• Execute controlled environment promotion (Dev to Pre-Prod to Production) with documented rollback and recovery plans for every change
• Register all deployed network security CIs in the CMDB with correct class, attributes,