Security Design Engineer

Security Design Engineer (Service Mesh) - 6 Month Contract - INSIDE IR35 - London, Sheffield, Manchester, Birmingham - No Sponsorship Available

Project Overview

We are looking for an experienced Network Security Architect / Security Design Architect to support a major security transformation programme within a complex enterprise environment for a Tier 1 Bank. The programme is focused on evolving network and application security controls to support modern, cloud-native architectures. The environment spans traditional enterprise networking and security alongside Kubernetes, microservices, service mesh, APIs, cloud platforms and modern software-development practices.

The successful individual will need to bridge the gap between traditional network security and modern application/platform architecture, working closely with network, security, platform, infrastructure and software-engineering teams.

This is not intended to be a traditional firewall-only position, nor a pure Cloud Security, Dev Ops or Kubernetes engineering role. The requirement is for someone with a strong network-security foundation who understands how applications are designed, developed, deployed and secured in modern distributed environments.

Key Responsibilities

Network Security Architecture & Design

Design and review secure enterprise network architectures across on-premise, hybrid-cloud and cloud environments.

Define security architectures covering network segmentation, micro-segmentation, Zero Trust, secure connectivity and application traffic flows.
Produce and review architectural documentation including HLDs, LLDs, security patterns and design standards.
Assess existing network-security architectures and identify appropriate improvements or target-state designs.
Design security controls covering north-south and east-west traffic across enterprise and cloud-native environments.
Work with engineering teams to ensure network-security requirements translate into practical technical designs.

Firewall & Network Security

Provide architecture and technical expertise across technologies and concepts such as:

Next-generation firewalls
Palo Alto
Check Point
Cisco Firepower / ASA
Fortinet
IDS/IPS
VPN/IPsec
Secure ingress and egress
Network segmentation
Micro-segmentation
Load balancing / application delivery
Secure proxying
Network policy and traffic inspection

Zero Trust

Apply Zero Trust principles across network, application and platform architectures.

Design controls for segmentation and micro-segmentation across traditional infrastructure and cloud-native environments.
Support identity-aware access and least-privilege security models.
Understand the relationship between user identity, workload identity, network controls and service-to-service communication.

Service Mesh

A key element of the project is securing modern distributed application environments.

The individual should have experience working around:

Containerised workloads
Microservices
Service-to-service communication
Service Mesh
Istio
Envoy
Ingress/egress gateways
Network policies
API gateways
Workload identity
TLS / mTLS
The key requirement for this role is solid Service Mesh experience

Application Security & SDLC

The role requires someone who can work credibly with software-development and engineering teams.

Candidates should understand:

The Software Development Lifecycle (SDLC)
Secure-by-design principles
Application Security
API security
Microservices security
CI/CD pipelines
Threat modelling
SAST / DAST / SCA
Authentication and authorisation
PKI/certificate management
Secrets management

The individual does not need to be a career Software Engineer, but must understand how software is developed and how network/security controls interact with modern applications. An earlier development, engineering or application-architecture background would therefore be useful.

Cloud Security

experience securing network and application architectures across one or more major cloud platforms:

AWS
Azure
GCPUseful experience would include:

VPC/VNet architecture
Cloud firewalls
Transit/network gateways
Direct Connect / Express Route / Interconnect
Private connectivity
Cloud load balancing
Kubernetes services such as EKS, AKS or GKE
IAM/workload identity
Cloud-native network controls

Essential experience

The strongest CVs should demonstrate most of the following:

Strong enterprise Network Security background
Network Security Architecture / Network Security Engineering
Enterprise firewall architecture and engineering
Network segmentation / micro-segmentation
Zero Trust
Modern cloud…