The Lead Consultant – Network Security will design, implement, and operate secure, compliant network segmentation between Russian environments and Global networks, using a standardised control stack of Check Point Security Gateways, Palo Alto Networks next generation firewalls, Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA), and Cloudflare for DDoS mitigation, WAF, and application protection. The role blends architecture, hands on engineering, automation, and L3/L4 operational leadership to deliver policy driven connectivity under strict regulatory, operations.

Key responsibilities

- Russia to Global architecture and segmentation:

o Define trust zones, routing boundaries, and inter zone controls for Russia and Global Network, covering north south and east west paths, micro segmentation for sensitive tiers, and explicit cross border allow lists. Produce HLD/LLD, threat models, and control mappings aligned to internal standards and regional regulation to enable secure communication Russia and Global AstraZeneca sites.

- Perimeter and interconnect engineering (Check Point and Palo Alto):

o Design and operate dual vendor firewall perimeters (Check Point R81.x, Palo Alto PAN OS), with explicit control allocation, HA/cluster design (ClusterXL/VSX, Panorama templates/device groups), deterministic failover, NAT domain strategy, SSL/TLS inspection governance, and Threat Prevention/WildFire/URL filtering tuned for jurisdiction with possible geometry option via Eurasia sites for traffic between Russia and Global AstraZeneca sites.

- Internet security and ZIA:

o Engineer ZIA for identity aware egress controls, SSL inspection with jurisdiction aware bypasses, inline CASB/DLP, and sanctioned SaaS governance. Implement ZPA for per application zero trust access, with connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasible.

- Yandex Cloud Hybrid Connectivity:

o Design and deliver Site to Site VPN (IPSec), Cloud Interconnect/Partner Interconnect equivalents (L2/L3 by carriers), BGP where available with Dual tunnel HA per site with BGP for failover; on prem <-> hub VPC; optional backup over the internet.

- DDoS and origin protection (Cloudflare):

o Deploy Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet facing services. Integrate with on prem perimeters for layered defence, use origin allow lists pinned to Cloudflare,



and apply geo steering and surge controls to preserve availability without breaching data handling rules.

- Cross border connectivity governance:

o Engineer SD WAN/MPLS/SASE paths with policy based routing, strong encryption (IPsec/IKEv2, TLS 1.2+/1.3), and defined key custody/rotation by jurisdiction. Maintain a per application/data class allow list with time boxed exceptions and automated attestation.

- Compliance and audit readiness:

o Translate regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations. Maintain control matrices (Network related CIS Benchmarks) and produce audit ready evidence, preferably generated from pipelines and runtime telemetry.

- Monitoring, detection, and incident response:

o Normalise telemetry from Check Point, Palo Alto, ZIA/ZPA, and Cloudflare into SIEM with regional data handling rules; build detections for cross border anomalies, DDoS events, SSL inspection failures, connector degradation, and policy drift. Lead L3/L4 incidents, coordinate issue containment (WAF rules, ZPA segment blocks, dynamic ACLs), and drive RCAs with corrective actions codified.

- Automation and policy as code:

o Manage firewall, Zscaler, and Cloudflare policy through Terraform/Ansible and vendor APIs (Check Point Management API, Palo Alto/Panorama, ZIA/ZPA REST, Cloudflare API). Implement CI/CD with policy linting, unit tests, path simulation, hit count/shadow analysis, change evidence artefacts, canary releases, and automated rollback. Enforce owner/expiry metadata and drift detection.

- ITSM/CMDB and delivery governance:

o Adhere to change/incident/problem processes, maintain accurate CI relationships for gateways, connectors, and WAF/DDoS configurations, and ensure traceability from requirements to deployed controls through design reviews and CAB.

- Stakeholder engagement and leadership:

o Partner with Network Engineering, Security, Regional IT, Legal/Compliance, and Product teams to plan cutovers, negotiate change windows,



communicate risk/benefit trade offs, and mentor engineers; articulate complex design and risk decisions to both technical and non technical audiences.

Essential experience

- Network security architecture and segmentation:

o Proven delivery of hierarchical and micro segmentation across data centres, cloud, and edge, with auditable cross border flows and zero trust patterns.

- Check Point Security Gateways:

o R81.x policy packages, inline layers, Identity Awareness, HTTPS Inspection, Threat Prevention, NAT domains, ClusterXL, VSX/virtual systems, and domain based management (MDS/Smart 1); automation via Management API.

- Palo Alto Networks NGFW/Panorama:

o App ID/User ID, URL Filtering, SSL decryption strategy, DoS/zone protection, WildFire, NAT/HA/ECMP, Panorama based multi tenant management, rulebase rationalisation using hit counts and shadow detection; automation via REST/XML/Terraform provider.

- Zscaler ZIA/ZPA:

o ZIA locations and forwarding (GRE/IPsec/PAC), SSL inspection governance, Cloud App Control/DLP and identity integration; ZPA application segmentation, connector architecture within jurisdictional boundaries, device posture, IdP integration (SAML/OIDC/SCIM), and VPN to ZPA migrations.

- Cloudflare security:

o Magic Transit/Magic WAN/GRE/IPsec, WAF managed/custom rulesets, Bot Management, DDoS mitigation (L3–L7), Rate Limiting, Load Balancing/geo steering, origin allow listing and mutual TLS; automation

- SIEM/SOAR and incident leadership:

o Building detections/use cases that respect data residency, automating containment, and leading complex, multi vendor incidents under tight change controls.

- Communication and documentation:

o High quality HLD/LLD, standards, runbooks, and audit artefacts; clear communication of risk, compliance implications, and exceptions

- Continuous improvement o Continuously improve patterns based on threat intelligence, vendor updates (Check Point, Palo Alto, Zscaler, Cloudflare), and regulatory changes, and convert learnings into standards and training.

Education and certifications

- Bachelor’s degree in computer science, Information Technology, or a related field (or equivalent experience).
- One or more of:

o Check Point CCSA/CCSE o Palo Alto PCNSA/PCNSE o Zscaler ZTCA/ZDX or Zscaler Digital Transformation Administrator Cisco CyberOps Associate/Professional o CCNP/CCIE Security o CISSP o CompTIA Security+

📌 Network Security Consultant (India)
🏢 Cognizant
📍 India