Lead Site Reliability Engineer

EPAM Systems Inc; México; Hybride; MXN 900 000 - 1 500 000; Plein temps

Avantages offerts par ce poste

Healthcare benefits

Paid time off

Upskilling and certifications

LinkedIn Learning access

Global career opportunities

Résumé du poste

EPAM Systems Inc in Mexico seeks a Lead Site Reliability Engineer to advance our cloud networking and secure access platforms across Google Cloud, AWS, and Azure. You will design and modify Terraform-based network topologies, manage private interconnects, firewall policies, and on-call incident response, while developing Python tools to automate state comparisons.

This role requires 5+ years in network engineering, strong BGP routing knowledge, and experience with cloud-native networking,

Qualifications

• At least 5 years of network engineering experience, including production networks in public clouds (GCP, AWS, or Azure).
• Experience guiding development teams (1+ year).
• Strong routing knowledge: BGP policies, AS-path, MED, local preference, and troubleshooting.
• Practical IaC experience with Terraform or similar in Git workflows.
• Hands-on network security: firewall rules, security groups, NAT, segmentation.
• Proficient Python to automate tasks and API data retrieval.
• Structured troubleshooting with data-driven tests and documentation.
• Strong writing skills for change plans and incident summaries.
• Upper-Intermediate English (B2) proficiency.

Responsabilités

• Construct and modify cloud networking setups using Terraform across VPCs, VNets, and transit hubs (GCP Network Connectivity Center, AWS Transit Gateway, Azure Virtual WAN).
• Manage private interconnects with providers like Equinix Fabric, Cloud Interconnect, Direct Connect, and ExpressRoute; adjust BGP sessions and perform failover tests.
• Oversee firewall policy across cloud-native firewalls and Palo Alto NGFWs via Panorama; manage end-to-end change processes.
• Run the secure access stack (Zscaler, Menlo Security browser isolation, Tailscale, PAC files) and implement policy updates for connectivity.
• Resolve connectivity and performance issues by analyzing flow logs, firewall logs, BGP state, and synthetic monitoring data (ThousandEyes); participate in on-call duties.
• Enhance Python tools to compare live network state with intended configuration; update runbooks and design docs.

Connaissances

Terraform

Python

BGP

Firewalling

Zscaler

Menlo Security

Tailscale

Cloud networking

GCP/AWS/Azure

Outils

Terraform

Description du poste

We're looking to add a capable Lead Site Reliability Engineer to our team. Our group handles the network engineering work that powers connectivity spanning Google Cloud, AWS, Azure, and the networks of our external partners. We connect the various clouds through a private interconnect fabric, deploy next-generation firewalls directly in the traffic path, and manage almost the entire setup through code. We're also responsible for the secure access layer linking our workforce to the internet and internal systems, using Zscaler, Menlo Security, and TailscaleAt the moment, we're constructing a new hub-and-spoke network within Google Cloud and integrating it with the rest of our environment. Alongside that, we're developing internal tools that convert real-time network data into actionable answers when incidents occurResponsibilitiesConstruct and modify cloud networking setups using Terraform, covering VPCs and VNets, transit hubs like GCP Network Connectivity Center, AWS Transit Gateway, and Azure Virtual WAN, private service access via Private Service Connect, PrivateLink, or Private Endpoints, and the routing connecting these componentsManage private interconnects including Equinix Fabric, Cloud Interconnect, Direct Connect, and ExpressRoute, along with their associated BGP sessions, covering circuit additions, routing policy adjustments, and failover testingOversee firewall policy across both cloud-native firewalls and Palo Alto NGFWs managed through Panorama, handling the full change process from review to deploymentRun the secure access technology stack, including Zscaler, Menlo Security browser isolation, Tailscale, and the PAC files guiding traffic between them, while handling policy updates and resolving user connectivity problemsResolve connectivity and performance challenges by analyzing flow logs, firewall logs, BGP state, and synthetic monitoring data from tools like ThousandEyes, taking part in on-call responsibilities and recording findings along the wayEnhance Python-based tools responsible for comparing live network state against the intended configurationEvaluate colleagues' merge requests and ensure runbooks and design documentation stay current and preciseRequirementsAt least 5 years of applicable network engineering experience, including hands-on work building production networks within a public cloud such as GCP, AWS, or Azure, with deep expertise in one platform and openness to learning others considered acceptableA minimum of one year spent managing or guiding development teamsStrong foundational routing knowledge, including the capacity to describe how BGP determines its best path, how factors like AS-path, MED, and local preference affect that outcome, and how to troubleshoot a route that's unexpectedly absentPractical experience with Terraform or similar infrastructure-as-code solutions operating within a Git-based review processHands-on background with network security measures, including firewall rules, security groups, NAT, and network segmentationWorking Python ability sufficient to automate routine tasks or retrieve data through a cloud APIA structured, evidence-based approach to troubleshooting, involving hypothesis formation, data-driven testing, and outcome documentationStrong writing skills, capable of producing change plans, incident summaries, and documentation other engineers can depend onUpper-Intermediate English language competency (B2)Nice to haveFamiliarity with Google Cloud networking components such as Network Connectivity Center, Cloud Router, Cloud Interconnect, VPC Service Controls, hierarchical firewall policies, and Organization Policy / IAM DenyExperience with Equinix Fabric or a comparable interconnect or network-as-a-service providerBackground working with Palo Alto NGFW and Panorama, particularly VM-Series deployments running in the cloudExposure to Zscaler (ZIA/ZPA) or another secure web gateway or zero-trust access solution, Menlo Security or a similar browser isolation tool, and Tailscale or other WireGuard-based access technologiesUnderstanding of BFD and BGP graceful restart, plus experience designing and verifying failover scenariosBackground using network monitoring platforms such as ThousandEyesHolding relevant certifications, such as Google Professional Cloud Network Engineer or equivalent AWS credentials, which would be seen as a strong plusWe offerInternational projects with top brandsWork with global teams of highly skilled, diverse peersHealthcare benefitsEmployee financial programsPaid time off and sick leaveUpskilling, reskilling and certification coursesUnlimited access to the LinkedIn Learning library and 22,000+ coursesGlobal career opportunitiesVolunteer and community involvement opportunitiesEPAM Employee GroupsAward-winning culture recognized by Glassdoor, Newsweek and LinkedInEPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.