Network Operations Engineer (NetOps)

Teciem; Hinoba-an; On-site; PHP 1,200,000 - 1,900,000; Full time

Job summary

Teciem seeks a Network Operations Engineer to design, deliver, and run the Kondor UP network layer in a production financial services environment. This hands-on role combines cloud networking, hybrid connectivity, and platform security to support a multi-tenant SaaS platform.

You will collaborate with InfraOps, SRE, and SecOps, manage VPC architectures, Direct Connect, VPNs, Istio, Terraform, and DNS, and uphold security-focused network controls.

Qualifications

• Strong AWS networking knowledge focusing on VPCs, routing, and multi-account patterns.
• Experience with Direct Connect and VPNs for hybrid connectivity.
• Familiarity with Istio service mesh and Kubernetes network policies.
• Proficiency with Terraform to manage network resources and IaC quality.

Responsibilities

• Design and maintain per-tenant VPCs with proper isolation.
• Operate AWS Direct Connect connections and Site-to-Site VPNs, including failover testing.
• Configure AWS Network Firewall, WAF, SGs, and NACLs with least-privilege.
• Manage Istio for mTLS, traffic routing, and observability within EKS clusters.

Skills

AWS networking

Kubernetes networking

Istio service mesh

Terraform

GitOps

Network security

DNS management

Tools

Direct Connect

Kyverno/OPA

Job description

The Work We Do Teciem designs, builds, and delivers treasury and capital markets software solutions for financial institutions worldwide. We serve banks of every size and geography, offering the right setup for the right need. Our solutions are designed to replace multiple disconnected systems with one complete, front-to-back platform, helping customers to capture trading and business opportunities quickly, clearly and with control. We cover the entire trading lifecycle, ensuring that everything -- from execution to position keeping, to risk management - runs smoothly. With decades of experience and one of the largest, most diverse client bases in the industry, we turn deep industry knowledge into software that covers most asset classes, meets complex real-world treasury and capital market's needs, and adapts as markets evolve.

About Kondor UP Kondor UP is the SaaS edition of Kondor, Teciem's flagship treasury management platform. Operated by TCM (TeCIEM) on AWS, Kondor UP delivers treasury capabilities as a fully managed, multi-tenant service - enabling banks to go live in weeks rather than months, with continuous evergreen upgrades and contractual SLAs. The platform relies on a sophisticated network fabric: per-tenant 3-tier VPCs, Istio service mesh (mTLS), AWS Network Firewall, AWS WAF (F5/WAAP), PrivateLink, and a multi-account AWS Organization managed through Control Tower and Terraform (AFT).

Role Summary

The Network Operations Engineer (NetOps) is responsible for the design, delivery, and day-2 operations of the network layer underpinning Kondor UP. This is a hands-on, infrastructure-focused role at the intersection of cloud networking, hybrid connectivity, and platform security - operating within a production-grade financial services environment. The NetOps Engineer works closely with the InfraOps, SRE, and SecOps teams, and is a key contributor to the Network & IAM workstream.

Key Responsibilities

• Network Architecture & VPC Design Design, provision, and maintain per-tenant VPCs (3-tier: public / private app / private data subnets) on AWS, ensuring full isolation between tenant accounts. Define and enforce CIDR allocation policies and subnet sizing across the multi-account AWS Organization. Manage VPC Endpoints (Gateway and Interface) to route AWS API traffic off the public internet. Contribute to architecture decisions (ADRs) on network topology, routing, and segmentation.
• Hybrid Connectivity - Bank Client Onboarding Provision and operate AWS Direct Connect connections (primary) and Site-to-Site VPN tunnels (failover) per customer tenant. Coordinate with client bank network teams for BGP configuration, IP addressing, and bandwidth planning. Define and enforce routing policies (BGP, static routes) between client on-prem and AWS tenant environments. Own failover testing and validation for hybrid connectivity paths.
• Network Security Configure and manage AWS Network Firewall (stateful/stateless rules, Suricata-based IDS/IPS). Manage AWS WAF policies (OWASP rule sets, API protection, bot mitigation, rate limiting). Design and maintain Security Groups and Network ACLs following least-privilege principles. Enforce Kubernetes NetworkPolicy rules via Kyverno for pod-to-pod and namespace traffic control. Support the SecOps team during security incidents involving network-layer indicators.
• Service Mesh & Internal Connectivity Operate and troubleshoot Istio (service mesh) for mTLS enforcement, traffic routing, and east-west observability within EKS clusters. Manage AWS PrivateLink endpoints for cross-account service exposure (shared services → tenant accounts). Ensure network-level connectivity for platform services: Amazon MSK (Kafka), Amazon MQ (ActiveMQ), RDS SQL Server (Multi-AZ).
• DNS Management Manage Amazon Route 53 - public hosted zones (customer-facing endpoints), private hosted zones (internal service resolution), and resolver rules for hybrid DNS. Implement and validate DNS failover policies aligned with RTO/RPO targets.
• Infrastructure as Code Own Terraform modules for all network resources: VPCs, subnets, route tables, security groups, Network Firewall policies, WAF rules, Direct Connect/VPN, and DNS zones. Contribute to the AFT (Account Factory for Terraform) customisation templates for network baseline provisioning on new tenant account creation. Enforce IaC quality standards: peer-reviewed PRs, policy-as-code (Kyverno / OPA/Conftest), automated drift detection.
• Observability & Incident Response Instrument network-layer observability: VPC Flow Logs, AWS Network Firewall alerts, Istio traffic metrics (golden signals), and Direct Connect performance dashboards. Define and monitor network SLIs (packet loss, latency, throughput per tenant path) contributing to the SRE error budget framework. Act as network SME during P1/P2 incidents and post-mortem investigations. Maintain network runbooks and escalation procedures in the operational knowledge base.
• Capacity & Cost Management Model bandwidth requirements per tenant and across the shared connectivity backbone; proactively plan capacity headroom. Optimise network costs (NAT Gateway egress, Direct Connect port utilisation, data transfer) in alignment with the FinOps workstream.

Required Skills & Experience

• Cloud Networking - AWS (mandatory) Deep, hands-on experience with AWS VPC (subnets, routing, peering, endpoint services, CIDR management). Proven AWS Direct Connect deployment and operations: Virtual Interfaces (Private VIF / Transit VIF), hosted connections, BGP, failover with VPN. AWS Network Firewall and AWS WAF - rule authoring, policy lifecycle, alert tuning. Amazon Route 53 - advanced DNS management (private zones, resolver endpoints, health checks, failover policies). AWS Control Tower / multi-account organisation networking patterns (hub-and-spoke, landing zone).
• Network Fundamentals Strong foundational knowledge: TCP/IP, BGP, OSPF, VLANs, MPLS concepts, subnetting, routing. Experience with SD-WAN or hybrid WAN architectures is a plus. Familiarity with network security concepts: stateful inspection, IDS/IPS, zero-trust network access (ZTNA).
• Kubernetes & Service Mesh Working knowledge of Kubernetes networking (CNI, kube-proxy, CoreDNS, NetworkPolicy). Practical experience with Istio (VirtualService, DestinationRule, PeerAuthentication, mTLS). Familiarity with Kyverno or OPA for policy-as-code enforcement of network controls.
• Infrastructure as Code Proficiency in Terraform (modules, workspaces, remote state, provider ecosystem for AWS networking). Experience with GitOps workflows (PR-based changes, ArgoCD or equivalent). Version control practices: branching strategies, code review, conventional commits.
• Observability Experience with VPC Flow Logs, CloudWatch, and network-layer telemetry pipelines. Familiarity with Prometheus / Grafana for infrastructure and service mesh dashboards. Ability to write and maintain runbooks and post-mortems.
• Compliance & Security Context (desirable) Awareness of financial services network requirements: SWIFT CSP, PCI-DSS, ISO 27001, DORA (EU). Understanding of data residency constraints and network-level controls for regulated environments.
• Nice to Have Knowledge of FIX protocol or market connectivity (LSEG/Reuters, Bloomberg) network patterns. Familiarity with AWS PrivateLink and multi-account cross-service exposure patterns. Experience with Chaos Engineering for network-layer resilience testing (partition injection, latency simulation). AWS certifications: Advanced Networking Specialty, Solutions Architect Professional.

Team Context & Reporting

The NetOps Engineer reports to the Cloud / Service Delivery Manager and operates within the Network & IAM workstream.

• InfraOps - joint ownership of EKS cluster networking, IaC modules, platform baseline.
• SRE - network SLI/SLO definition, error budget contribution, incident network-layer triage.
• SecOps - co-owns network security posture (WAF, Firewall, NetworkPolicy); feeds into SIEM pipeline.
• DevOps - supports connectivity requirements for CI/CD pipelines, ECR pull-through, VPC Endpoints.
• Client Bank Network Teams - external stakeholder for Direct Connect / VPN onboarding.

Why Join Kondor UP

Impact at scale: You design and operate the network backbone of a production SaaS platform serving tier-1 financial institutions - every routing decision you make has direct SLA consequences.

Modern stack: AWS-native, Terraform-first, GitOps, Istio, Kyverno - no legacy on-prem tooling debt.

Financial domain depth: Rare opportunity to combine advanced cloud networking with exposure to treasury operations, market connectivity (LSEG, Bloomberg, SWIFT), and regulated financial infrastructure.

Engineering culture: Blameless post-mortems, SLO-driven operations, toil-elimination as a first-class concern.

Diverse Minds, Shared Ambition At Teciem, we believe that our strength comes from the diversity of our people. Different perspectives, backgrounds, and experiences fuel our innovation and help us build solutions that truly make a difference in the world of financial technology. We're committed to creating a workplace where everyone feels respected, heard, and empowered to grow. Here, you can bring your whole self to work, contribute your unique ideas, and be part of a team driven by shared ambition. We welcome talent from all walks of life and encourage applications from individuals of all genders, races, ages, abilities, identities, and beliefs. Together, we're shaping a culture where diversity isn't just celebrated - it’s essential to our success.

At Teciem, we design, build, and deliver front-to-back treasury and capital markets software solutions for financial institutions around the world. From regional banks to the world’s largest global institutions, we provide flexible, scalable technology that meets the unique needs of each client - no matter their size or geography. Our award-winning platforms - Kondor, Summit, Opics, Sophis, Fusion Invest, and Fusion Risk - help clients simplify the trading lifecycle, manage risk with confidence, and operate seamlessly across asset classes and global markets. With decades of domain expertise and one of the largest, most diverse client communities in the industry, we transform complex real-world treasury and capital markets needs into powerful, future-ready software. Today, more than 340 financial institutions, including the majority of the world’s top 100 banks, trust our solutions to strengthen their operations and support resilient economies.

Purpose – Why we exist We empower financial institutions to build resilient and future-ready economies, worldwide.

Vision – What the future holds To lead innovation in treasury and capital markets technology, building on the solid foundations of our mission -critical and industry - defining solutions.

Mission – How we get there We place our clients' success and ambitions at our core, continuously evolving and innovating our solutions to deliver outstanding business value and real economic impact.

You help us simplify Treasury and capital markets can be intricate, but you play a key role in making them easier to navigate. Your ideas and expertise help us transform complicated processes into intuitive, streamlined solutions used by financial institutions worldwide. Every improvement you make creates clarity, efficiency, and real-world impact for our clients. You shape the future with AI, every day AI isn't a buzzword here — it’s embedded in how we build, innovate, and deliver. Whether you're working on smarter automation, data-driven insights, or enhanced user experiences, your contribution fuels the next generation of intelligent financial technology. You'll be part of a team that uses AI to make our products faster, sharper, and more meaningful for the industry.

You grow through collaboration We believe the best outcomes happen when great minds come together. You'll work alongside talented colleagues across engineering, product, design, and client-facing teams — sharing knowledge, solving problems, and learning constantly.

Collaboration isn't just how we work; it’s how we grow, innovate, and support each other.