Senior Network Security Engineer (Network+Information Security)

Atidiv; Kalyani Nagar; On-site; INR 1,800,000 - 3,200,000; Full time

Job summary

Atidiv is seeking an experienced security engineer to lead DLP strategy across endpoints, email, web, and storage. You will manage Sophos DLP policies, configure Google Workspace DLP, and drive incident workflows with a focus on minimizing false positives while maintaining secure blocking.

You will own firewall and switching security, including VPNs, segmentation, and NAC evaluation, while ensuring compliant data handling and protection across Google Workspace, AWS, and on‑premise assets.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, cybersecurity or related field (or equivalent).
• 7–9 years of hands-on experience in network security or security engineering.
• Experience with DLP, data classification, and privacy compliance (GDPR/CCPA).
• Strong knowledge of firewall administration and network segmentation.
• Experience with centralised asset security management platforms.

Responsibilities

• Own end-to-end DLP strategy across endpoints, email, web, cloud storage, and removable media.
• Manage Sophos DLP policies with blocking mode and define content rules and data patterns.
• Administer Google Workspace DLP rules to detect and block exfiltration of data.
• Configure and maintain USB/removable media blocking policies via Sophos Endpoint Protection.
• Establish DLP incident workflows including alert triage, investigation, and reporting.
• Lead firewall configuration lifecycle, security zones, VPNs, HA, and firmware updates.
• Audit firewall rules periodically and document cleanup actions.
• Enforce switch port security and 802.1X in a corporate network environment.
• Maintain network topology diagrams, change logs, and backups for devices.

Skills

DLP

Firewall

Network security

Compliance

IAM

Cloud security

Endpoint security

Education

Bachelor's degree in Computer Science / IT / Cybersecurity

Tools

Sophos

Google Workspace

AWS IAM

Sophos Central

Freshservice

Job description

Role & responsibilities

1. Data Loss Prevention (DLP)

• Own the end-to-end DLP strategy across all channels endpoint, email, web, cloud storage, and removable media
• Manage Sophos DLP policies in blocking mode define content rules, sensitive data patterns (PII, PCI, PHI, IP), and policy exceptions
• Administer Google Workspace DLP rules: Gmail, Drive, Meet, and Chat detect and block exfiltration of classified data
• Configure and maintain USB and removable media blocking policies via Sophos Endpoint Protection
• Establish DLP incident workflows: alert triage, investigation, user notification, and management reporting
• Tune DLP policies to minimise false positives while maintaining blocking effectiveness document tuning rationale
• Conduct quarterly DLP policy reviews aligned with data classification updates and audit findings
• Produce monthly DLP incident summary reports for the DPO and IT Lead

2. Firewall & Switch Security

• Own Sophos XGS Firewall configuration lifecycle security zones, NAT rules, VPN tunnels (IPSec/SSL), HA failover, and firmware updates
• Administer managed network switches: VLAN configuration, port security, 802.1X authentication, storm control, and spanning tree hardening
• Implement and enforce network segmentation: DMZ, inter-VLAN routing controls, Guest VLAN isolation, and zero-trust perimeter principles
• Manage IDS/IPS rules within Sophos NGFW tune signatures, review alerts, and document suppression decisions
• Conduct periodic firewall rule audits — identify stale, overly permissive, or shadow rules and produce a cleanup remediation log
• Enforce switch port security: disable unused ports, restrict MAC address counts, and apply BPDU guard on access ports
• Manage dual internet links (Airtel + Teleglobal) — failover logic, bandwidth policy, and traffic prioritisation
• Evaluate and implement Network Access Control (NAC) to control which devices can join the corporate network — currently an identified gap
• Maintain documented network topology diagrams, change logs, and baseline configuration backups for all firewall and switch devices

3. Data Security & Data Management

• Own the information classification scheme — define and maintain data tiers (Public, Internal, Confidential, Restricted) aligned to ISO 27001
• Ensure all data stores (Google Drive, email, AWS S3, Freshservice, endpoint local storage) are classified, labelled, and handled per policy
• Enforce data retention and disposal policies — define retention periods per data type (PII, financial, operational) and verify secure disposal of media and devices
• Manage encryption posture: ensure data at rest and in transit is encrypted; review Google Workspace TLS/SMIME settings, AWS S3 bucket encryption, and endpoint storage encryption
• Govern backup security — enforce authentication, encryption, and integrity verification for all backup media (email and Drive backups currently in scope)
• Assess and remediate data exposure risks: public-facing servers, shared drives with over-permissioned access, and API data flows
• Maintain a data flow map documenting where PII, PCI, and PHI is collected, stored, processed, and transmitted — refresh annually and on material changes
• Support the DPO in responding to data subject requests, breach investigations, and regulatory notifications under GDPR and CCPA

4. Data Protection & Privacy Compliance

• Act as the technical arm of the Data Protection function — translate DPO requirements into enforceable technical controls
• Maintain and improve compliance with GDPR, CCPA, and ISO 27001 data protection obligations — document control mappings and evidence
• Conduct Data Protection Impact Assessments (DPIAs) for new systems, integrations, or data processing activities
• Oversee access control hygiene: enforce least-privilege across Google Workspace, AWS IAM, and Sophos Central — conduct quarterly access reviews
• Manage identity lifecycle for data access: provisioning, periodic recertification, and timely revocation on offboarding
• Enforce MFA across all data-access surfaces: Google Workspace, AWS console, VPN, remote admin tools — document exceptions
• Manage third-party data processor agreements (DPAs) from a technical controls perspective — verify vendor security posture annually
• Support cyber insurance questionnaire submissions — provide accurate technical responses for data protection sections
• Monitor and respond to data protection-related security alerts — coordinate with the DPO on breach determination and notification timelines

5. Security Best Practices & Standards

• Define, document, and enforce Atidiv's security baseline standards — covering endpoints, network devices, cloud accounts, SaaS apps, and user accounts
• Own the patch management lifecycle: define patching cadence (critical: 72 hours, high: 7 days, medium: 30 days), track SLA compliance, and report on remediation status — currently an identified gap
• Implement CIS Benchmark hardening for endpoints (Windows/macOS), Sophos, AWS, and Google Workspace — document deviations with risk acceptance
• Enforce password and authentication standards: minimum complexity, no shared credentials, MFA everywhere, and periodic credential rotation for privileged accounts
• Govern software installation controls: enforce admin-only installation via Sophos and Google Workspace policies; maintain approved software list
• Conduct quarterly internal vulnerability scans; coordinate annual VAPT with third-party vendor — scope to include firewall, endpoints, web-facing systems, and AWS workloads
• Lead phishing simulation campaigns (GoPhish, quarterly) — design scenarios, run campaigns, analyse click rates, and drive targeted remediation training
• Maintain the Information Security Policy suite — review annually and update following audit findings, incidents, or regulatory changes
• Perform security risk assessments for new tools, SaaS onboarding, third-party integrations, and infrastructure changes before go-live
• Develop and maintain the Incident Response Plan — including ransomware playbook, escalation paths, and post-incident review process

6. Centralised Asset Security Management

• Own the security dimension of the CMDB in Freshservice — ensure all IT assets (laptops, servers, network devices, cloud instances, SaaS apps) are inventoried with ownership, classification, patch status, and security configuration state
• Implement and manage Sophos Central as the unified security console: endpoint protection, EDR, DLP, firewall, and MDM — enforce consistent policy across all managed devices
• Define and track security health metrics per asset: patch compliance %, EDR coverage %, DLP policy coverage, MFA adoption — produce weekly dashboard for IT Lead
• Enforce Google MDM for all corporate mobile devices and BYOD enrolled devices — ensure remote wipe, screen lock, and compliance policies are active
• Manage device lifecycle from a security standpoint: imaging standards, baseline configuration at provisioning, security sign-off before decommission, and secure data wipe before hardware return or disposal
• Identify and track unmanaged or shadow IT assets — establish a rogue device detection process using Sophos network scanning and firewall DHCP logs
• Maintain asset age and risk register — flag assets approaching end-of-support (OS, firmware) and elevate for upgrade or compensating control
• Evaluate and pilot a centralised IAM/UEM platform to consolidate device security management, patch deployment, and identity governance — aligns to the org's Zero Trust roadmap
• Produce quarterly asset security posture reports — coverage gaps, non-compliant devices, decommission backlog, and risk exposure summary

Preferred candidate profile

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent practical experience)
• 7–9 years of hands-on experience in network security, information security, or a combined infrastructure + security role
• Minimum 4 years of firewall administration experience — Sophos, Fortinet, Palo Alto, or Cisco ASA.
• Demonstrated hands-on experience with DLP tools in a production environment (Sophos, Symantec, Forcepoint, or equivalent)
• Proven experience with data classification, data protection frameworks, and privacy compliance (GDPR / CCPA)
• Experience managing network switches in a corporate environment — VLAN design, port security, 802.1X
• Demonstrated experience with centralised endpoint/asset security management platforms (Sophos Central, Intune, Jamf, or equivalent)
• Experience in audit preparation and supporting at least two compliance cycles — ISO 27001 / SOC / VAPT
• Experience working in a managed services or multi-client IT environment is a strong plus
• Familiarity with ITSM and CMDB platforms (Freshservice, ServiceNow, or similar) for asset and change management