ICT Security Engineer (Cisco SD-WAN Controllers, IPsec VPN, SIEM, Firewall Policy Engineering)

Responsibilities

• Manage enterprise firewall environments across Palo Alto, Fortinet FortiGate and Cisco ASA platforms, handling security configuration, traffic segmentation and controlled access between interconnected network environments.
• Implement and maintain Layer 3 and Layer 7 firewall policies, NAT translations and access control rules, ensuring appropriate traffic permissions across enterprise and branch networks.
• Analyse existing firewall rulebases, identify redundant or conflicting entries, and perform rule optimisation and configuration cleanup to strengthen network access controls.
• Configure and maintain Site-to-Site VPN, Remote Access VPN and IPsec tunnels, including troubleshooting encrypted connectivity between branch locations, enterprise networks and remote users.
• Investigate firewall-related connectivity and security incidents by correlating traffic logs, packet captures and network traces using Wireshark, TCPDump and native firewall diagnostic utilities.
• Monitor and investigate network security alerts through SIEM platforms, including Splunk, IBM QRadar and Microsoft Sentinel, supporting incident analysis and security event resolution.
• Execute firewall firmware upgrades, security patching, configuration reviews and rule changes, following controlled change procedures to minimise disruption to business-critical network services.
• Troubleshoot security and connectivity issues across firewall, VPN and WAN environments, identifying interactions between access policies, routing paths and encrypted network traffic.
• Support the integration of firewall controls with Cisco SD-WAN infrastructure, including controller-managed WAN edge environments and distributed enterprise site connectivity.
• Handle routing and network security interactions involving BGP, OSPF, VRF and MPLS PE-CE connectivity, particularly during WAN changes, migration activities and connectivity restoration.

Requirements

• Minimum 9 years of overall experience in enterprise network engineering, including atleast 4 years of hands-on experience in network security, firewall administration and security implementation across enterprise WAN environments.
• Hands-on configuration and administration experience in at least one of the following enterprise firewall platforms: Palo Alto, Fortinet FortiGate or Cisco ASA.
• Hands-on experience implementing Layer 3/Layer 7 firewall policies, NAT, ACLs, traffic filtering and firewall rulebase analysis and optimisation.
• Experience configuring and troubleshooting Site-to-Site VPN, Remote Access VPN and IPsec tunnels across multi-site enterprise networks.
• Practical experience in packet-level investigation and firewall traffic analysis using Wireshark, TCPDump and firewall logs.
• Experience monitoring and investigating security events through SIEM platforms such as Splunk, IBM QRadar or Microsoft Sentinel.
• Experience performing firewall firmware upgrades, security patch deployment, configuration maintenance and controlled firewall change implementations.
• Hands-on experience with Cisco SD-WAN infrastructure, including vManage, vSmart, vBond and cEdge/vEdge device provisioning and configuration.
• Implementation experience in BGP and OSPF routing, including VRF configuration, route maps and routing policy troubleshooting.
• Experience in MPLS PE-CE connectivity, WAN routing integration and troubleshooting network-level connectivity issues.
• Familiarity with Cisco ISR 4000, ASR 1000 or CSR1000v platforms and enterprise network management tools such as Cisco DNA Centre, Cisco PRIME or Cisco ISE.
• Cisco certifications in enterprise routing and switching or SD-WAN implementation, along with relevant firewall vendor certifications, will be preferred.
• Need to be available for on-call standby during the weekend.