Key responsibilities • Produce high level and low level designs for switching, routing, firewalling and segmentation across campus, data centre and branch environments. • Design and implement WAN architectures including BGP and static routing, dual ISP failover, HA pairs and SD-WAN or SASE overlays. • Deploy and operate SASE platforms: physical Sockets and virtual Sockets, IPsec site to site connections, remote access clients, ZTNA application access and the cloud security stack. • Build cloud connectivity into Azure using ExpressRoute, VNet peering, hub and spoke topologies and virtual network appliances, and integrate it with on-premises routing. • Define and enforce firewall and secure web gateway policy: application control, URL filtering, IPS, TLS inspection strategy and exception governance. • Design network segmentation for user, server and OT traffic, including NAC based access control and micro segmentation where required. • Lead the move from network based access to identity based Zero Trust access: application discovery, policy mapping to identity groups and device posture, pilot, migration and decommissioning of legacy VPN. • Own core network services design: DHCP, DNS, IP address management and CIDR planning across sites and cloud. • Plan and execute migrations from MPLS, legacy VPN and on-premises proxies with tested rollback. • Lead major incident bridges as the final technical escalation and drive root cause analysis to permanent fixes. • Govern change: review all normal and emergency changes for technical risk and represent the team at CAB. • Manage vendor relationships for firewalls, SASE, switching and carriers: support cases, roadmap, licensing and capacity planning. • Produce capacity, performance and security posture reports and present them to customer leadership.



• Support pre-sales with effort estimates, solution design and proof of concept delivery for new engagements. Required experience and skills All of the following with hands-on implementation experience, not only design or oversight. • 8 to 10 years in enterprise networking with at least 3 years in a lead or architect role. • On-premises switching and routing: Layer 2 and Layer 3 campus design, VLANs, spanning tree, VRFs, OSPF, BGP and static routing, first hop redundancy. • Enterprise WAN and BGP design: multi site topologies, route policy, path selection, HA and dual ISP failover. • Firewalls: next generation firewall design and administration on at least one of Palo Alto, Fortinet, Check Point or Cisco, including HA, zones, NAT and policy lifecycle. • Network segmentation of user, server and OT environments, including NAC (Cisco ISE, Aruba ClearPass or equivalent) and 802.1X. • IPsec site to site VPN and remote access clients, including split tunnelling, client coexistence and certificate based authentication. • SASE or SSE platform implementation: Sockets and vSockets, IPsec sites, endpoint client, ZTNA application access and the cloud security stack. Cato, Zscaler, Prisma Access or Netskope. • Secure web gateway and TLS inspection at scale: certificate distribution, bypass and exception governance, privacy and performance considerations.



• Zero Trust access models and identity based policy using Microsoft Entra ID groups, Conditional Access and device compliance signals. • Data centre edge and cloud connectivity: Azure ExpressRoute, VNet peering, hub and spoke, virtual firewalls or virtual appliances, and hybrid routing. • Core services: DHCP, DNS, IPAM and CIDR planning at enterprise scale. • Deep TCP/IP troubleshooting with packet captures and log correlation across client, edge, firewall and identity. • Migration leadership: MPLS to SD-WAN or SASE, legacy VPN to ZTNA, proxy consolidation, with tested rollback plans. • Documentation: HLDs, LLDs, network diagrams, runbooks and standards written in explicit English. Leadership and ways of working • Able to run the team independently: plan work, review designs, make decisions and escalate only when needed. • Comfortable owning a customer relationship at technical lead level and presenting to CIO or CISO level stakeholders. • Calm under pressure in major incidents; structured in root cause analysis. • Mentors engineers and raises the bar on quality and documentation. • Clear written and spoken English. Willing to travel for site surveys, cutovers and customer workshops. Preferred • CCNP Enterprise or Security, CCIE, PCNSE, NSE7, Cato CCE, Zscaler ZCCP or ZDTA, Microsoft AZ-700 or SC-300. • Experience with OT or manufacturing networks and IEC 62443 style segmentation. • Automation with Python, Ansible or Terraform and vendor REST APIs. • SIEM integration and log design for network security monitoring. • Experience in a managed service provider or consulting environment with multiple customers. Education • Bachelor degree in engineering, computer science or a related field, or equivalent experience.

📌 Network Architect / Senior Lead Network Engineer (Chennai)
🏢 Happiest Resume
📍 Chennai