Principal Network Engineer

Fidelity Investments; Roanoke (TX); On-site; USD 110,000 - 140,000; Full time

Job summary

Fidelity Investments is seeking a Principal Network Engineer to support a critical data center network segmentation initiative in Roanoke, Texas. This role involves designing and optimizing micro-segmentation policies across various environments, ensuring enhanced security through innovative architectural strategies.

The ideal candidate will have extensive network engineering experience, proficiency with segmentation tools, and a solid understanding of Zero Trust principles. Join Fidelity in transitioning to a full-time onsite working model to strengthen our security initiatives.

Qualifications

• 7–10+ years of experience in network engineering and data center networking.
• Hands-on experience with segmentation platforms like Illumio and Guardicore.
• Strong understanding of networking protocols and principles.

Responsibilities

• Design and implement segmentation strategies across data center environments.
• Deploy and configure segmentation platforms.
• Monitor segmentation effectiveness and troubleshoot issues.

Skills

Network engineering experience

Experience with segmentation platforms

Networking knowledge

Understanding of Zero-Trust principles

Cloud platform experience

Scripting/automation skills

Tools

Illumio

Guardicore

Cisco Secure Workload/Tetration

ServiceNow

Linux

Windows Server

Job description

Job Title: Principal Network Engineer – Network Segmentation

Note: Fidelity is not providing immigration sponsorship for this position.

Role Summary

We are seeking an experienced Network Engineer to support a data center network segmentation initiative focused on implementing micro segmentation and Zero Trust architecture. The role involves designing, deploying, and optimizing segmentation policies using Segmentation platforms. You will be part of the team that leads the strategic shift from traditional flat networks to highly secure, micro‑segmented environments across on‑premises data centers, global offices, and multi‑cloud infrastructure.

You will work closely with security, infrastructure, and application teams to improve east‑west traffic visibility, reduce attack surface, and enforce least‑privilege communication.

Location

Westlake, Texas (Onsite)

Key Responsibilities

Design and Architecture

• Design and implement network segmentation and micro segmentation strategies across data center environments
• Develop Zero Trust network architectures aligned with enterprise security policies
• Define segmentation models (application-centric, environment-based, etc.)

Implementation

• Deploy and configure segmentation platforms across on‑prem and cloud data centers
• Create and enforce security policies for east‑west traffic
• Integrate segmentation tooling with firewalls, SIEM/SOAR platforms, and CMDB / asset inventory systems

Traffic Analysis and Policy Creation

• Analyze application dependencies and traffic flows
• Build and validate allow/deny rules and segmentation policies
• Support policy simulation, testing, and enforcement phases

Operations and Optimization

• Monitor segmentation effectiveness and tune policies
• Troubleshoot connectivity issues related to segmentation enforcement
• Ensure high availability and scalability of segmentation deployments

Collaboration

• Partner with application owners, security teams, infrastructure/cloud teams
• Drive workshops and onboarding sessions for segmentation adoption

Qualifications and Skills

• 7–10+ years of experience in network engineering, data center networking, and prior segmentation or migration projects
• Hands‑on experience with segmentation platforms (Illumio, Guardicore (Akamai), Cisco Secure Workload/Tetration)
• Strong understanding of networking (Cisco, HP, Arista, Palo Alto, Check Point, Juniper), TCP/IP, routing, switching, firewalls and ACLs, network security principles
• Experience with application dependency mapping, east‑west traffic inspection
• Strong understanding of Zero‑Trust Network Access (ZTNA), Secure Access Service Edge (SASE), and stateful firewalling
• Experience with cloud platforms (AWS, Azure, GCP), Kubernetes/container networking, scripting/automation (Python, PowerShell, or APIs), CMDB tools (ServiceNow), Linux and Windows server environments
• Experience working in financial services or highly regulated environments

Certifications

Category: Information Technology

Onsite Working Model

Fidelity is transitioning to a full‑time onsite working model through a phased rollout across regions and roles. Currently, some roles and locations require 100% onsite presence, while others require less. Onsite expectations are likely to evolve as the rollout continues. This transition does not apply to fully remote roles.

Please be advised that Fidelity’s business is governed by the provisions of the Securities Exchange Act of 1934, the Investment Advisers Act of 1940, the Investment Company Act of 1940, ERISA, numerous state laws governing securities, investment and retirement‑related financial activities and the rules and regulations of numerous self‑regulatory organizations, including FINRA, among others. Those laws and regulations may restrict Fidelity from hiring and/or associating with individuals with certain criminal histories.