Network & Security Engineer

The Network& Firewall Engineer (L3) - Shared is an advanced engineering role responsible for ensuring that AWS networking and firewall services remain secure, available and performant.

The primary objective of this role is to provide L3 design and support, resolve complex escalated incidents and problems, and deliver controlled network and security changes within agreed service requirements.

The Network& Firewall Engineer (L3) focuses on VPC, subnets, routing, Transit Gateway(TGW), VPN, Security Groups, NACLs, AWS Network Firewall, WAF, ALB, NLB, GWLB, Route 53, Palo Alto and Squid, including L3 troubleshooting, security policy/rule review and network optimization.

This is a shared service role and may also contribute to or support project work as and when required.

Key Responsibilities:

. Designs, administers and supports AWS VPCs, subnets, routing and Transit Gateway connectivity.

. Configures and troubleshoots VPN connectivity and related network-routing issues.

. Reviews and supports Security Groups and NACLs in accordance with approved security and connectivity requirements.

. Administers and troubleshoots AWS Network Firewall, WAF and Palo Alto firewall technologies.

. Supports ALB, NLB and GWLB services and investigates availability, routing and traffic-flow issues.

. Administers and troubleshoots Route 53 services and associated name-resolution issues.

. Supports and troubleshoots Squid services within the supported network environment.

. Performs L3 troubleshooting across network, firewall, load-balancing and name-resolution layers.

. Reviews security policies and firewall rules for correctness, risk and operational impact and implements approved changes.

. Analyses network behavior and recommends or implements approved optimization actions.

. Leads root-cause analysis for recurring or high-impact network and firewall incidents.

. Plans and executes complex changes with clear risk analysis, validation and backout plans.

. Provides technical guidance and escalation support to L1 and L2 engineers and coordinates with vendors or other resolver groups.

. Maintains network diagrams, operating procedures, rule documentation and troubleshooting knowledge.

. Performs any other related task as required.

Knowledge and Attributes:

. Deep technical skills in AWS networking, firewall technologies and network security.

. Strong analytical and packet-flow troubleshooting capability across cloud network paths.

. Ability to work independently and provide technical leadership during critical incidents and changes.

. Strong understanding of policy/rule review, controlled change and network optimization.

. Ability to communicate network risks, dependencies and technical recommendations clearly.

. Ability to coach other engineers and transfer operational knowledge.

. Ability to work well in a pressurized managed-services environment.

. Excellent client service orientation and focus on secure, stable connectivity.

Academic Qualifications and Certifications:

. Bachelor's degree or equivalent qualification in IT/Computing (or demonstrated equivalent work experience).

. Certifications relevant to the services provided carry additional weightage on a candidate's qualification for the role.

. Required certification(s):

. AWS Certified Advanced Networking - Specialty.

. Good-to-have certification(s):

. Palo Alto PCNSE.

. CCNP Enterprise or CCNP Security.

. AWS Certified Security -Specialty.

. Relevant Squid experience or certification, where available.

Required Experience:

. 6+ years of overall relevant experience.

. 5+ years of experience in Network & Security, including AWS networking/firewall technologies.

. Hands-on design and support experience with VPC, subnets, routing, TGW, VPN, Security Groups, NACLs, AWS Network Firewall, WAF, ALB/NLB/GWLB, Route 53 and Palo Alto.

. Experience in L3 troubleshooting, security policy/rule review, network optimization and Squid.

Required scope

AWS network foundation: VPC subnets routing TGW VPN

Network controls: Security Groups NACLs AWS Network Firewall WAF

Traffic services: ALB NLB GWLB Route 53

Firewall and proxy: Palo Alto Squid

Advanced operations: L3 troubleshooting policy/rule review network optimisation