We are hiring a Lead Security System Engineer - Network Cloud to build and run compliant network segmentation across regions and Global networks using a standardized security stack. You will combine architecture, hands-on engineering, automation, and L3/L4 operations across Check Point, Palo Alto Networks, ZIA, ZPA, and Cloudflare. Apply to help deliver policy-driven connectivity under strict regulatory constraints.

Responsibilities

- Define trust zones, routing boundaries, and inter-zone controls for regional and Global Network, including north-south and east-west paths, micro-segmentation for sensitive tiers, and explicit cross-border allow-lists
- Create HLD/LLD, threat models, and control mappings aligned to internal standards and regional regulation to enable secure communication
- Design and operate dual-vendor firewall perimeters with clear control allocation, HA/cluster design, deterministic failover, NAT domain strategy, and SSL/TLS inspection governance tuned for jurisdiction
- Configure ZIA for identity-aware egress controls, SSL inspection with jurisdiction-aware bypasses, inline CASB/DLP, and sanctioned SaaS governance
- Implement ZPA for per-application zero-trust access, including connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasible
- Deliver Site-to-Site VPN, Cloud Interconnect/Partner Interconnect equivalents, and dual-tunnel HA per site with BGP for failover between on-prem and hub VPC
- Deploy Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet-facing services, integrating layered defence with on-prem perimeters
- Engineer SD-WAN/MPLS/SASE paths with policy-based routing, strong encryption, and defined key custody/rotation by jurisdiction
- Translate regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations
- Normalize telemetry from security platforms into SIEM with regional data handling rules, and build detections for cross-border anomalies, DDoS events, and policy drift
- Lead L3/L4 incidents, coordinate issue containment, and drive RCAs with corrective actions codified
- Manage firewall, Zscaler, and Cloudflare policy through automation tools and vendor APIs, implementing CI/CD including policy linting, unit tests, and path simulation

Requirements

- Extensive IT experience (5+ years)



with a strong focus on network security architecture and engineering
- Expert-level knowledge of Check Point Security Gateways, Palo Alto Networks next-generation firewalls, and firewall cluster/HA design
- Hands-on proficiency with Zscaler Internet Access and Zscaler Private Access for zero-trust and identity-aware access control
- Solid knowledge of Cloudflare Magic Transit, Magic WAN, and WAF for DDoS mitigation and application protection
- Practical familiarity with cloud hybrid connectivity, including Site-to-Site VPN, Cloud Interconnect, and BGP routing
- Deep understanding of SD-WAN, MPLS, and SASE architectures with policy-based routing and strong encryption protocols
- Strong capability with Microsoft Sentinel and SIEM platforms for telemetry normalisation, detection engineering, and incident response
- Proven ability to automate and manage policy-as-code using Terraform, Ansible, and vendor REST APIs
- Working knowledge of regulatory compliance and audit readiness, including control matrices and CIS Benchmarks

We are hiring a Lead Security System Engineer - Network Cloud to build and run compliant network segmentation across regions and Global networks using a standardized security stack. You will combine architecture, hands-on engineering, automation, and L3/L4 operations across Check Point, Palo Alto Networks, ZIA, ZPA, and Cloudflare. Apply to help deliver policy-driven connectivity under strict regulatory constraints.

Responsibilities

- Define trust zones, routing boundaries, and inter-zone controls for regional and Global Network, including north-south and east-west paths, micro-segmentation for sensitive tiers, and explicit cross-border allow-lists
- Create HLD/LLD, threat models, and control mappings aligned to internal standards and regional regulation to enable secure communication
- Design and operate dual-vendor firewall perimeters with clear control allocation, HA/cluster design, deterministic failover, NAT domain strategy, and SSL/TLS inspection governance tuned for jurisdiction
- Configure ZIA for identity-aware egress controls,



SSL inspection with jurisdiction-aware bypasses, inline CASB/DLP, and sanctioned SaaS governance
- Implement ZPA for per-application zero-trust access, including connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasible
- Deliver Site-to-Site VPN, Cloud Interconnect/Partner Interconnect equivalents, and dual-tunnel HA per site with BGP for failover between on-prem and hub VPC
- Deploy Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet-facing services, integrating layered defence with on-prem perimeters
- Engineer SD-WAN/MPLS/SASE paths with policy-based routing, strong encryption, and defined key custody/rotation by jurisdiction
- Translate regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations
- Normalize telemetry from security platforms into SIEM with regional data handling rules, and build detections for cross-border anomalies, DDoS events, and policy drift
- Lead L3/L4 incidents, coordinate issue containment, and drive RCAs with corrective actions codified
- Manage firewall, Zscaler, and Cloudflare policy through automation tools and vendor APIs, implementing CI/CD including policy linting, unit tests, and path simulation

Requirements

- Extensive IT experience (5+ years) with a strong focus on network security architecture and engineering
- Expert-level knowledge of Check Point Security Gateways, Palo Alto Networks next-generation firewalls, and firewall cluster/HA design
- Hands-on proficiency with Zscaler Internet Access and Zscaler Private Access for zero-trust and identity-aware access control
- Solid knowledge of Cloudflare Magic Transit, Magic WAN, and WAF for DDoS mitigation and application protection
- Practical familiarity with cloud hybrid connectivity, including Site-to-Site VPN, Cloud Interconnect, and BGP routing
- Deep understanding of SD-WAN, MPLS, and SASE architectures with policy-based routing and solid encryption protocols
- Strong capability with Microsoft Sentinel and SIEM platforms for telemetry normalisation, detection engineering, and incident response
- Proven ability to automate and manage policy-as-code using Terraform, Ansible, and vendor REST APIs
- Working knowledge of regulatory compliance and audit readiness, including control matrices and CIS Benchmarks

📌 Lead Security System Engineer - Network Cloud (Coimbatore)
🏢 EPAM Systems
📍 Coimbatore