Chief Site Reliability Engineer

EPAM Systems; Mountain View (CA); Remote; USD 210,000 - 280,000; Full time

Benefits offered by this job

Healthcare benefits

LinkedIn Learning access

Global career opportunities

Upskilling and certification courses

Volunteer opportunities

Job summary

EPAM Systems Inc. seeks a Chief Site Reliability Engineer to lead cloud network engineering across Google Cloud, AWS, and Azure. You will design, implement, and secure interconnect fabrics, private service access, and BGP-based failover while guiding a development-focused team.

You will champion Python tooling, IaC practices, and incident response documentation, collaborating with global teams. Strong English, hands-on networking, and security expertise are required for this senior role.

Qualifications

• 7+ years of relevant network engineering background, including production-grade networks in public clouds (GCP/AWS/Azure).
• At least 2 years directing development teams.
• Strong routing principles: BGP, AS-path, MED, local preference, and missing routes.
• Hands-on with Terraform or IaC in Git-based review processes.
• Experience with firewall rules, security groups, NAT, and segmentation strategies.
• Python proficiency to automate recurring tasks and extract data via cloud APIs.
• disciplined, data-driven troubleshooting with hypotheses, evidence, and documented results.
• Excellent writing ability for change plans, incident docs, and reference materials.
• Upper-Intermediate English (B2).

Responsibilities

• Build and adjust cloud network configurations via Terraform for VPCs/VNets and interconnect hubs.
• Administer private interconnects (Equinix Fabric, Cloud Interconnect, Direct Connect, ExpressRoute) and manage BGP sessions.
• Govern firewall policies across cloud-native firewalls and Palo Alto NGFWs via Panorama.
• Maintain secure access tech suite (Zscaler, Menlo Security, Tailscale) and PAC files.
• Address connectivity and performance via flow logs, firewall logs, BGP state, and ThousandEyes; participate in on-call duties.
• Improve and expand Python-based tooling to compare live network state with desired configuration.
• Review merge requests and keep runbooks and design docs current and accurate.

Skills

Network engineering

BGP routing

Python scripting

Cloud networking

Incident documentation

Written communication

Documentation (runbooks)

Git-based review workflow

Tools

Terraform

Palo Alto Panorama

Zscaler ZIA/ZPA

Menlo Security

Tailscale

ThousandEyes

Job description

We're seeking an accomplished Chief Site Reliability Engineer to join our organization. Our team drives the network engineering efforts that enable connectivity across Google Cloud, AWS, Azure, and the networks belonging to our external partners. We link the different cloud environments through a private interconnect fabric, position next-generation firewalls directly within the traffic flow, and manage nearly the entirety of this setup programmatically. We also own the secure access layer that connects our employees to the internet and to internal systems, relying on Zscaler, Menlo Security, and Tailscale.Currently, we're in the process of building a new hub-and-spoke network inside Google Cloud and linking it with the broader environment. In parallel, we're creating internal tooling that transforms live network data into clear, actionable insight during incident response.ResponsibilitiesBuild and adjust cloud network configurations through Terraform, encompassing VPCs and VNets, transit hubs such as GCP Network Connectivity Center, AWS Transit Gateway, and Azure Virtual WAN, private service access using Private Service Connect, PrivateLink, or Private Endpoints, plus the routing linking all these pieces togetherAdminister private interconnects such as Equinix Fabric, Cloud Interconnect, Direct Connect, and ExpressRoute, together with the BGP sessions running across them, handling circuit provisioning, routing policy tuning, and failover validationGovern firewall policy spanning cloud-native firewalls as well as Palo Alto NGFWs operated via Panorama, managing every change from initial review through final deploymentMaintain the secure access technology suite, including Zscaler, Menlo Security browser isolation, Tailscale, and the PAC files that route traffic among them, while implementing policy changes and troubleshooting connectivity concerns for usersAddress connectivity and performance problems by examining flow logs, firewall logs, BGP state information, and synthetic monitoring output from platforms such as ThousandEyes, participating in on-call duties and documenting discoveriesImprove and expand Python-based tooling used to compare live network state against the desired configurationAssess merge requests submitted by team members and keep runbooks and design documentation current and accurateRequirementsA minimum of 7 years of relevant network engineering background, including direct experience building production-grade networks within a public cloud platform such as GCP, AWS, or Azure, with strong depth in one platform and a willingness to expand into others considered sufficientAt least 2 years spent managing or directing development teamsFirm grasp of routing principles, including explaining how BGP arrives at a best path, how elements like AS-path, MED, and local preference shape that decision, and how to pinpoint why an anticipated route is missingHands-on familiarity with Terraform or equivalent infrastructure-as-code tools used within a Git-based review processDemonstrated experience with network security mechanisms, including firewall rules, security groups, NAT, and segmentation strategiesAdequate Python competency to automate recurring tasks or extract data via a cloud APIA disciplined, data-driven troubleshooting methodology, involving forming hypotheses, validating them against evidence, and logging resultsExcellent writing ability, producing change plans, incident documentation, and reference materials that fellow engineers can trustUpper-Intermediate English language competency (B2)Nice to haveKnowledge of Google Cloud networking features such as Network Connectivity Center, Cloud Router, Cloud Interconnect, VPC Service Controls, hierarchical firewall policies, and Organization Policy / IAM DenyBackground with Equinix Fabric or another similar interconnect or network-as-a-service offeringExperience working with Palo Alto NGFW and Panorama, particularly VM-Series instances deployed in cloud environmentsFamiliarity with Zscaler (ZIA/ZPA) or a comparable secure web gateway or zero-trust access platform, Menlo Security or a similar browser isolation solution, and Tailscale or other WireGuard-based access toolsAwareness of BFD and BGP graceful restart concepts, along with experience architecting and confirming failover designsExperience leveraging network monitoring solutions such as ThousandEyesPossessing relevant certifications, such as Google Professional Cloud Network Engineer or comparable AWS credentials, which would be regarded as a strong advantageWe offerInternational projects with top brandsWork with global teams of highly skilled, diverse peersHealthcare benefitsEmployee financial programsPaid time off and sick leaveUpskilling, reskilling and certification coursesUnlimited access to the LinkedIn Learning library and 22,000+ coursesGlobal career opportunitiesVolunteer and community involvement opportunitiesEPAM Employee GroupsAward-winning culture recognized by Glassdoor, Newsweek and LinkedInEPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.