Network Security Engineer; Outside IR35

Network Security Engineer (NAC / LAN Migration) – Contract

Location: Northampton (1 day per week onsite)

Duration: 3 month rolling

We’re looking for an experienced Network Security Engineer to support a large-scale retail environment, working closely with the core Networks team on a major Network Access Control (NAC) programme alongside LAN migration activities across a complex, distributed estate.

This is a hands‑on delivery role suited to someone with deep Net Sec Ops  experience who is comfortable operating at scale and taking ownership of operational readiness.

• Leading the technical delivery and operational readiness of a multi‑phase NAC implementation across hundreds of retail and corporate sites
• Partnering with the Networks team to design, configure, test, and deploy:
• NAC policies and authentication flows
• Segmentation models and onboarding rules
• Supporting large‑scale LAN modernisation and migration
  , including site cutovers, switch refreshes, and security uplift
• Designing and validating operational processes such as:
• Access policy enforcement
• Device profiling and guest access
• Running end‑to‑end testing cycles (functional, failover, edge‑case, performance) to ensure stability and minimal business disruption
• Producing clear operational documentation, runbooks, topology diagrams, and troubleshooting guides
• Supporting security governance, risk assessments, and operational KPIs
• Acting as a Net Sec Ops  SME
  , advising on identity‑based networking and zero‑trust‑aligned access models

• A stable, well‑governed NAC deployment adopted consistently across all sites
• Smooth LAN migrations with minimal disruption and strong security uplift
• Improved visibility and security posture across the retail network estate

• Strong background in Net Sec Ops , Network Engineering, or Security Engineering within large enterprise environments
• Hands‑on NAC experience with platforms such as Fortinet, Aruba Clear Pass, Forescout
  , or similar
• Deep understanding of:
  802.1X, RADIUS, TACACS+
• Device profiling, posture assessment, certificate‑based authentication
• Solid LAN/WAN knowledge: switching, routing, VLANs, STP, DHCP, DNS, BGP/OSPF
• Familiarity with firewalls, segmentation, zero trust / identity‑aware networking, micro‑segmentation

If this is of interest, please apply or share your CV with