Senior Network Engineer

Zymr Systems; Bengaluru; Hybrid; INR 2,800,000 - 4,800,000; Full time

Job summary

Zymr Systems is seeking an experienced Senior Network Engineer to support a Cisco-based network spanning routing, switching, and firewalls. You will own escalated incidents, monitor health and capacity, and manage maintenance windows with robust change strategies and security controls.

The role requires 7+ years of experience, strong Cisco IOS XE/NX-OS/IOS XR skills, and proficiency in Python, CLI, and VPN technologies. Hybrid work in Bengaluru is offered with 24/7 on-call rotation.

Qualifications

• Seven or more years of network engineering experience with hands-on Cisco IOS XE, NX-OS, and IOS XR across routing, switching, and firewalls.
• Strong working knowledge of TCP/IP, the OSI model, BGP, OSPF, MPLS, VXLAN/EVPN, spanning tree variants, wireless, and WAN optimization, including how each typically fails.
• Hands-on experience with firewalls, IPsec VPNs, SSL or remote-access VPNs, and network security. Experience designing and troubleshooting F5 BIG-IP LTM and GTM/DNS, renewing certificates, maintaining profiles and pools, and tuning health monitors.
• Fluency with the CLI, Bash, awk, sed, and regular expressions for log analysis, command output parsing, and triage. Use Python for API integration, structured parsing, and automation across devices.
• Maintain network documentation in Confluence and diagrams in Visio or a comparable tool. Update both as the network changes.
• Familiarity with AWS VPC, Transit Gateway, and Direct Connect, plus Azure VNet and ExpressRoute, SD‑WAN, and data center fabrics such as Nexus VXLAN/EVPN and ACI.
• Strong spoken and written English.

Responsibilities

• Troubleshooting and support. Take ownership of escalated Cisco routing and switching incidents. Investigate data-path utilization, punt-path saturation, ring overruns and backpressure, BGP path selection and convergence, BFD scaling and timer tuning, and the choice of uRPF mode on asymmetric paths. Use data-path analysis, embedded packet capture, SPAN, ERSPAN, or Wireshark to test hypotheses and establish the root cause. Record fixes in the runbook.
• Monitoring and maintenance. Establish baselines that help you spot abnormal behavior before an alert fires. Track interface utilization, BGP prefix counts, control-plane CPU and memory, and ASIC TCAM and FIB capacity. Use SNMP, NetFlow, and syslog data to forecast when capacity will run out and allow for upgrade lead times.
• Maintenance windows. Prepare approved, written methods of procedure with prechecks, configuration snapshots, rollback steps, and post-change verification. Manage software lifecycles and hardware spares. Use RANCID, Oxidized, or comparable tools for configuration backups and compliance checks. Rehearse the procedure in a lab or simulator, including failing a link to observe BGP reconvergence and confirm route policy behavior.
• Security and compliance. Maintain infrastructure ACLs, select the right uRPF mode for each edge interface, and apply maximum prefix limits, prefix lists, and AS-path filters to customer and peer sessions. Enforce segmentation through VRFs, VLANs, and security zones. Manage AAA with TACACS+ or RADIUS, including command authorization and review of accounting logs.
• Security maintenance. Review ACLs regularly and remove obsolete or shadowed rules. Compare vendor PSIRT advisories with the deployed fleet and prioritize upgrades by actual exposure. Maintain DDoS controls such as remotely triggered blackholing (RTBH) and scrubbing-service integration where applicable. Keep the environment ready for PCI DSS and SOC 2 audits.

Skills

Cisco IOS XE

NX-OS

IOS XR

Routing

Switching

Firewalls

TCP/IP

BGP

OSPF

MPLS

VXLAN/EVPN

Spanning Tree

Wireless

WAN Optimization

IPsec VPNs

SSL VPNs

F5 BIG-IP LTM

GTM/DNS

CLI

Bash

Python

Confluence

Visio

AWS VPC

Transit Gateway

Direct Connect

Azure VNet

ExpressRoute

SD-WAN

Nexus VXLAN/EVPN

ACI

English

Education

B.E IT or computer degree

Tools

F5 BIG-IP LTM

GTM/DNS

Confluence

Visio

Job description

Support a Cisco-based network spanning routing, switching, and firewalls. The role combines incident escalation, network health and capacity planning, planned maintenance, and security operations.

Total Experience: 7 + years

Location: Bangalore

Education: B.E IT or computer degree

How You Will Help

• Troubleshooting and support. Take ownership of escalated Cisco routing and switching incidents. Investigate data-path utilization, punt-path saturation, ring overruns and backpressure, BGP path selection and convergence, BFD scaling and timer tuning, and the choice of uRPF mode on asymmetric paths. Use data-path analysis, embedded packet capture, SPAN, ERSPAN, or Wireshark to test hypotheses and establish the root cause. Record fixes in the runbook.
• Monitoring and maintenance. Establish baselines that help you spot abnormal behavior before an alert fires. Track interface utilization, BGP prefix counts, control-plane CPU and memory, and ASIC TCAM and FIB capacity. Use SNMP, NetFlow, and syslog data to forecast when capacity will run out and allow for upgrade lead times.
• Maintenance windows. Prepare approved, written methods of procedure with prechecks, configuration snapshots, rollback steps, and post-change verification. Manage software lifecycles and hardware spares. Use RANCID, Oxidized, or comparable tools for configuration backups and compliance checks. Rehearse the procedure in a lab or simulator, including failing a link to observe BGP reconvergence and confirm route policy behavior.
• Security and compliance. Maintain infrastructure ACLs, select the right uRPF mode for each edge interface, and apply maximum prefix limits, prefix lists, and AS-path filters to customer and peer sessions. Enforce segmentation through VRFs, VLANs, and security zones. Manage AAA with TACACS+ or RADIUS, including command authorization and review of accounting logs.
• Security maintenance. Review ACLs regularly and remove obsolete or shadowed rules. Compare vendor PSIRT advisories with the deployed fleet and prioritize upgrades by actual exposure. Maintain DDoS controls such as remotely triggered blackholing (RTBH) and scrubbing-service integration where applicable. Keep the environment ready for PCI DSS and SOC 2 audits.Who We Have in Mind

Technical Experience

• Seven or more years of network engineering experience with hands‑on Cisco IOS XE, NX-OS, and IOS XR across routing, switching, and firewalls.
• Strong working knowledge of TCP/IP, the OSI model, BGP, OSPF, MPLS, VXLAN/EVPN, spanning tree variants, wireless, and WAN optimization, including how each typically fails.
• Hands‑on experience with firewalls, IPsec VPNs, SSL or remote‑access VPNs, and network security. Experience designing and troubleshooting F5 BIG‑IP LTM and GTM/DNS, renewing certificates, maintaining profiles and pools, and tuning health monitors.
• Fluency with the CLI, Bash, awk, sed, and regular expressions for log analysis, command output parsing, and triage. Use Python for API integration, structured parsing, and automation across devices.
• Maintain network documentation in Confluence and diagrams in Visio or a comparable tool. Update both as the network changes.
• Familiarity with AWS VPC, Transit Gateway, and Direct Connect, plus Azure VNet and ExpressRoute, SD‑WAN, and data center fabrics such as Nexus VXLAN/EVPN and ACI.
• Strong spoken and written English.

Working Conditions

• Hybrid work arrangement with time in the Bengaluru office.
• Participation in a 24/7 on‑call rotation for critical incidents.

It Would Be Great If You Had

• Vendor certifications such as CCNP or F5.
• An advanced degree in computer science or a related discipline.
• Hands‑on work with major cloud platforms such as AWS, OCI, or GCP.