We are looking for a Lead Security System Engineer - Network Cloud to ensure secure, compliant segmentation between regional environments and Global networks using an agreed control stack. You will own architecture and implementation across Check Point, Palo Alto Networks, Zscaler ZIA/ZPA, and Cloudflare while driving automation and L3/L4 operational leadership. Apply now to strengthen policy-led connectivity in tightly regulated environments.

Responsibilities

- Establish trust zones, routing boundaries, and inter-zone controls for regional and Global Network, covering north-south and east-west paths, micro-segmentation for sensitive tiers, and explicit cross-border allow-lists
- Develop HLD/LLD, threat models, and control mappings aligned with internal standards and regional regulation to enable secure communication
- Architect and run dual-vendor firewall perimeters with clear control allocation, HA/cluster design, deterministic failover, NAT domain strategy, and SSL/TLS inspection governance tuned for jurisdiction
- Design ZIA configurations for identity-aware egress controls, SSL inspection with jurisdiction-aware bypasses, inline CASB/DLP, and sanctioned SaaS governance
- Roll out ZPA for per-application zero-trust access by planning connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasible
- Implement Site-to-Site VPN, Cloud Interconnect/Partner Interconnect equivalents, and dual-tunnel HA per site with BGP for failover between on-prem and hub VPC
- Deliver Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet-facing services, integrating layered defence with on-prem perimeters
- Optimize SD-WAN/MPLS/SASE paths using policy-based routing, robust encryption,



and defined key custody/rotation by jurisdiction
- Convert regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations
- Ingest and normalize telemetry from security platforms into SIEM with regional data handling rules, and build detections for cross-border anomalies, DDoS events, and policy drift
- Direct L3/L4 incidents, coordinate containment, and drive RCAs with corrective actions codified
- Automate firewall, Zscaler, and Cloudflare policy management through automation tools and vendor APIs, including CI/CD implementation with policy linting, unit tests, and path simulation

Requirements

- Broad IT background (5+ years) with demonstrated strength in network security architecture and engineering
- Advanced expertise in Check Point Security Gateways, Palo Alto Networks next-generation firewalls, and firewall cluster/HA design
- Hands-on experience with Zscaler Internet Access and Zscaler Private Access to deliver zero-trust and identity-aware access control
- Strong understanding of Cloudflare Magic Transit, Magic WAN, and WAF for DDoS mitigation and application protection
- Working knowledge of hybrid cloud connectivity patterns, including Site-to-Site VPN, Cloud Interconnect, and BGP routing
- Solid grasp of SD-WAN, MPLS, and SASE architectures with policy-based routing and strong encryption protocols
- Proficiency with Microsoft Sentinel and SIEM platforms for telemetry normalisation, detection engineering, and incident response
- Practical automation skills for policy-as-code using Terraform, Ansible, and vendor REST APIs
- Familiarity with regulatory compliance and audit readiness activities, including control matrices and CIS Benchmarks

📌 Lead Security System Engineer - Network Cloud (Coimbatore)
🏢 EPAM Systems
📍 Coimbatore