Project Overview
We are looking for an experienced Network Security Architect/Security Design Architect to support a major security transformation programme within a complex enterprise environment for a Tier 1 Bank.
The programme is focused on evolving network and application security controls to support modern, cloud-native architectures.
The environment spans traditional enterprise networking and security alongside Kubernetes, microservices, service mesh, APIs, cloud platforms and modern software-development practices.
The successful individual will need to bridge the gap between traditional network security and modern application/platform architecture, working closely with network, security, platform, infrastructure and software-engineering teams.
This is not intended to be a traditional Firewall-only position, nor a pure Cloud Security, DevOps or Kubernetes engineering role.
The requirement is for someone with a strong network-security foundation who understands how applications are designed, developed, deployed and secured in modern distributed environments.
Network Security Architecture & Design
- Design and review secure enterprise network architectures across on-premise, hybrid-cloud and cloud environments.
- Define security architectures covering network segmentation, micro-segmentation, Zero Trust, secure connectivity and application traffic flows.
- Produce and review architectural documentation including HLDs, LLDs, security patterns and design standards.
- Assess existing network-security architectures and identify appropriate improvements or target-state designs.
- Design security controls covering north-south and east-west traffic across enterprise and cloud-native environments.
- Work with engineering teams to ensure network-security requirements translate into practical technical designs.
Firewall & Network Security
Provide architecture and technical expertise across technologies and concepts such as:
- Next-generation Firewalls
- Palo Alto
- Check Point
- Cisco Firepower/ASA
- Fortinet
- IDS/IPS
- VPN/IPsec
- Secure ingress and egress
- Network segmentation
- Micro-segmentation
- Load balancing/application delivery
- Secure proxying
- Network policy and traffic inspection
Zero Trust
- Apply Zero Trust principles across network, application and platform architectures.
- Design controls for segmentation and micro-segmentation across traditional infrastructure and cloud-native environments.
- Support identity-aware access and least-privilege security models.
- Understand the relationship between user identity, workload identity, network controls and service-to-service communication.
Service Mesh
A key element of the project is securing modern distributed application environments.
- Containerised workloads
- Microservices
- Service-to-service communication
- Service Mesh
- Istio
- Envoy
- Ingress/egress gateways
- Network policies
- API gateways
- Workload identity
- TLS/mTLS
- The key requirement for this role is solid Service Mesh experience
Application Security & SDLC
The role requires someone who can work credibly with software-development and engineering teams.
- The Software Development Lifecycle (SDLC)
- Secure-by-design principles
- Application Security
- API security
- Microservices security
- CI/CD pipelines
- Threat modelling
- SAST/DAST/SCA
- Authentication and authorisation
- PKI/certificate management
- Secrets management
Cloud Security
experience securing network and application architectures across one or more major cloud platforms:
- AWS
- Azure
- GCP
Useful experience would include:
- VPC/VNet architecture
- Cloud Firewalls
- Transit/network gateways
- Direct Connect/ExpressRoute/Interconnect
- Private connectivity
- Cloud load balancing
- Kubernetes services such as EKS, AKS or GKE
- IAM/workload identity
- Cloud-native network controls
Essential experience: The strongest CVs should demonstrate most of the following:
- Strong enterprise Network Security background
- Network Security Architecture/Network Security Engineering
- Enterprise Firewall architecture and engineering
- Network segmentation/micro-segmentation
- Zero Trust
- Modern cloud networking/security
- Kubernetes/container understanding
- Microservices
- Service Mesh/Istio or comparable technology
- Understanding of SDLC and application security
- Secure-by-design architecture
- experience working directly with software, platform, infrastructure and security engineers
- HLD/LLD/security-design documentation
- Cloud experience across AWS, Azure and/or GCP