Role Summary

- The L3 Security Engineer leads advanced-level troubleshooting, designs secure architectures, optimizes firewall/SD-WAN deployments, and handles critical security incidents. They provide leadership to L2 teams, develop automation, drive improvements in policies, and collaborate with SOC and architecture teams to maintain a robust security posture.

Key Responsibilities

FortiGate Firewall – Advanced Architecture & Troubleshooting

- Architect enterprise FortiGate deployments:
- Active/Active & Active/Passive HA
- Advanced Routing (OSPF, BGP, ECMP)
- Segmentation & Zero Trust Policy Models

Perform deep-dive troubleshooting on:

- Asymmetric routing, session drops
- Application control/IPS/AV issues
- Performance degradation, CPU spikes
- Design and optimize firewall policies using best practices: least privilege, object reuse, rule cleanup.
- Conduct advanced traffic analysis using packet captures and flow tracing.
- Lead firewall migration and large-scale rule redesign projects.

Fortinet SD-WAN – Design & Optimization

- Architect SD-WAN infrastructure and application SLA strategies.
- Optimize steering rules, performance SLAs, and WAN failover logic.
- Troubleshoot complex SD-WAN issues:
- Agile path selection failures
- Link quality fluctuations
- Overlay tunnel instability
- Integrate SD-WAN with MPLS, DIA, 4G/5G circuits.

FortiClient SSL VPN – Advanced Support

- Design SSL VPN architectures with dual-factor authentication, SAML/LDAP, AD integration.
- Troubleshoot complex VPN issues:
- Routing conflicts
- Packet fragmentation
- Split tunneling vs. full tunnel problems
- EMS/Zero Trust posture integration
- Conduct forensic analysis of compromised or suspicious VPN sessions.

FortiAnalyzer + FortiManager – Enterprise-Level Management





- Architect centralized configuration management (ADOMs, workflows).
- Automate deployments via scripts / APIs using FortiManager.
- Design custom log and reporting dashboards for compliance and threat analytics.
- Perform log forensics for incidents and threat investigations.

F5 SSL VPN (F5 APM) – Advanced Design

- Architect APM solutions including:
- Advanced access policies
- SSO, identity federation, OAuth, SAML
- Endpoint posture detection
- Troubleshoot APM authentication loops, profile conflicts, certificate trust issues.
- Integrate APM with external IDP/LDAP/Radius systems.

NIPS (Network Intrusion Prevention System)

- Architect and tune IPS/IDS signatures for optimal detection with minimal false positives.
- Perform deep forensic analysis of intrusion attempts.
- Design IPS bypass, inline deployments, and fail-open strategies.
- Integrate NIPS with SIEM & SOC workflows.

Additional Responsibilities

- Act as SME for major incidents and escalations.
- Conduct root cause analysis (RCA) for chronic and recurring issues.
- Produce HLD/LLD, SOPs, security standards, and hardening guides.
- Lead patching/upgrades, version strategy, and high-risk changes.
- Support compliance audits and security risk assessments.
- Mentor and train L1/L2 engineers.

Skills Required

- Mastery of firewall, IPS, VPN, routing, and SD-WAN technologies.
- Deep knowledge of PKI, certificates, and encryption standards.
- Expertise in packet analysis (Wireshark, tcpdump, FortiGate debug).
- Understanding of cloud integration (Azure/AWS firewalls, SD-WAN).
- Good scripting skills (Python, API, Ansible).

Experience

- Upto 14 years relevant experience of enterprise security engineering.

Preferred Certifications:

- Fortinet NSE6 / NSE7
- CCNP Security / CCIE Security.

📌 Security Engineer (Gurugram)
🏢 Velocis Systems Private
📍 Gurugram