Описание
Описания нет
Задачи
•Design, implement, and operate secure, compliant network segmentation between regional environments and Global networks
•Define trust zones, routing boundaries, and inter-zone controls for regional and Global Network, including north-south and east-west paths, micro-segmentation for sensitive tiers, and explicit cross-border allow-lists
•Produce HLD/LLD, threat models, and control mappings aligned with internal standards and regional regulation to enable secure communication between regional and Global customer sites
•Design and operate dual-vendor firewall perimeters, including control allocation, HA/cluster design, deterministic failover, NAT domain strategy, SSL/TLS inspection governance, and jurisdiction-tuned Threat Prevention/WildFire/URL filtering
•Engineer ZIA identity-aware egress controls, SSL inspection with jurisdiction-aware bypasses, inline CASB/DLP, and sanctioned SaaS governance
•Implement ZPA per-application zero-trust access, including connector placement, posture checks, conditional access, and app segmentation to replace legacy VPN where feasible
•Design and deliver Site-to-Site VPN (IPSec), Cloud Interconnect/Partner Interconnect equivalents, and BGP-based dual-tunnel HA per site for cloud hybrid connectivity
•Deploy Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet-facing services, and integrate them with on-prem perimeters for layered defence
•Engineer SD-WAN/MPLS/SASE paths with policy-based routing, strong encryption, and defined key custody/rotation by jurisdiction
•Translate regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations
•Normalise telemetry from firewall, Zscaler, and Cloudflare platforms into SIEM under regional data handling rules, and build detections for cross-border anomalies and policy drift
•Lead L3/L4 incidents, coordinate issue containment, and drive RCAs with corrective actions codified
•Manage firewall, Zscaler, and Cloudflare policies through Terraform/Ansible and vendor APIs, and implement CI/CD with policy linting, unit tests, and path simulation
Требования
•5+ лет опыта в архитектуре и эксплуатации сетевой безопасности, с фокусом на трансграничную или мультирегиональную связность
•Экспертиза в Check Point Security Gateways, Palo Alto Networks next-generation firewalls и управлении Panorama
•Владение Zscaler Internet Access (ZIA) и Zscaler Private Access (ZPA) для архитектуры zero-trust
•Навыки работы с Cloudflare Magic Transit/Magic WAN, WAF Management и стратегиями защиты от DDoS
•Знание гибридной облачной связности, включая Site-to-Site VPN, Cloud Interconnect и BGP-маршрутизацию
•Опыт работы с SD-WAN, MPLS и SASE архитектурами с политиками маршрутизации и протоколами сильного шифрования
•Понимание регуляторных и комплаенс-фреймворков, связанных с резидентностью данных, TLS-инспекцией и законным перехватом
•Знакомство с SIEM-платформами и нормализацией телеметрии для трансграничного мониторинга безопасности
•Компетенции в Terraform, Ansible и API вендоров для policy-as-code и интеграции CI/CD пайплайнов
•Способность руководить реагированием на инциденты уровня L3/L4 и проводить анализ первопричин с планированием корректирующих действий
Условия
Условий в вакансии нет
