Cloud Network Security Engineer

Key Responsibilities

Multi-Cloud Network Operations

• Design, configure, and manage VPCs (AWS), VNets (Azure), and VPCs (GCP) including subnets, route tables, and peering connections.
• Configure and troubleshoot AWS Transit Gateway, Azure Virtual WAN, and GCP Cloud Router for hub-and-spoke and mesh connectivity.
• Manage BGP and static routing across cloud environments and on-premises interconnects (AWS Direct Connect, Azure ExpressRoute, GCP Cloud Interconnect).
• Maintain DNS resolution strategies including AWS Route 53, Azure Private DNS, and GCP Cloud DNS integration with on-prem resolvers.
• Administer load balancers: AWS ALB/NLB, Azure Application Gateway / Load Balancer, and GCP Cloud Load Balancing.

Firewall & Network Security

• Deploy, configure, and manage cloud-native firewalls: AWS Network Firewall, Azure Firewall (Standard/Premium), and GCP Cloud Armor / Firewall Policies.
• Manage NGFWs in cloud environments including Palo Alto VM-Series, Fortinet FortiGate-VM, and Check Point Cloud Guard where applicable.
• Create and maintain security group (SG) and network ACL (NACL) policies in AWS; NSG and ASG rules in Azure; VPC firewall rules and hierarchical policies in GCP.
• Perform firewall policy reviews, rule optimization, and access path analysis to enforce least-privilege principles.
• Investigate and resolve firewall-related incidents, including blocked traffic, misconfigurations, and policy conflicts.
• Configure and manage WAF policies across AWS WAF, Azure WAF, and GCP Cloud Armor for application-layer protection.

Incident & Change Management

• Act as L2 escalation point for network and firewall incidents triaged by L1 support.
• Diagnose and resolve complex issues including packet loss, asymmetric routing, MTU mismatches, VPN instability, and latency spikes.
• Raise, assess, and implement change requests following ITIL-based change management processes (ServiceNow or equivalent ITSM tools).
• Maintain detailed RCA (Root Cause Analysis) documentation for major incidents.
• Participate in on-call rotations and provide timely resolution within defined SLA windows.

Connectivity & Hybrid Networking

• Manage site-to-site and client VPN solutions: AWS Client VPN / Site-to-Site VPN, Azure VPN Gateway / Point-to-Site, and GCP Cloud VPN (HA VPN).
• Implement and maintain SD-WAN overlays and cloud on-ramps where applicable.
• Manage private connectivity services and ensure redundancy via dual tunnels, BGP failover, and cross-AZ/zone resilience.
• Coordinate with ISPs, colocation providers, and WAN vendors for circuit provisioning and fault resolution.

Monitoring, Alerting & Automation

• Utilize native monitoring tools: AWS CloudWatch / VPC Flow Logs, Azure Monitor / NSG Flow Logs, and GCP Cloud Logging / Network Intelligence Center.
• Configure network-layer alerts and dashboards using tools such as Splunk, Grafana, or Dynatrace.
• Leverage infrastructure-as-code (IaC) for network provisioning using Terraform, AWS CloudFormation, or Azure Bicep.
• Develop automation scripts (Python/Bash/PowerShell) for firewall rule lifecycle management, report generation, and network audit tasks.
• Support AIOps-driven network automation initiatives including anomaly detection, auto-remediation workflows, and proactive health reporting.

Documentation & Compliance

• Maintain accurate and up-to-date network diagrams, IP address management (IPAM) records, and runbooks.
• Ensure cloud network configurations comply with CIS Benchmarks, NIST, ISO 27001, or client-specific security standards.
• Participate in internal and external security audits; provide evidence and remediation for network-related findings.
• Contribute to knowledge base articles and post-implementation reviews.

Required Skills & Qualifications

Experience

• 36 years of hands-on experience in network and/or network security engineering.
• Minimum 2+ years of demonstrated experience in at least two of the three major cloud platforms: AWS, Azure, or GCP.
• Proven experience managing firewalls in cloud environments (native and/or NGFW).