Network Operations Engineer

Join Teciem, a global fintech company delivering cutting-edge Treasury & Capital Markets software solutions to financial institutions worldwide.

We're looking for a talented Site Reliability Engineer who is passionate about building resilient, scalable, and high-performing systems. If you thrive in a fast-paced environment and enjoy solving complex infrastructure challenges, we'd love to hear from you.

Role Summary

The Network Operations Engineer (NetOps) is responsible for the design, delivery, and day-2 operations of the network layer underpinning Kondor UP. This is a hands-on, infrastructure-focused role at the intersection of cloud networking, hybrid connectivity, and platform security - operating within a production-grade financial services environment.

The NetOps Engineer works closely with the InfraOps, SRE, and SecOps teams, and is a key contributor to the Network & IAM workstream.

Key Responsibilities

1. Network Architecture & VPC Design

• Design, provision, and maintain per-tenant VPCs (3-tier: public / private app / private data subnets) on AWS, ensuring full isolation between tenant accounts.
• Define and enforce CIDR allocation policies and subnet sizing across the multi-account AWS Organization.
• Manage VPC Endpoints (Gateway and Interface) to route AWS API traffic off the public internet.
• Contribute to architecture decisions (ADRs) on network topology, routing, and segmentation.

2. Hybrid Connectivity - Bank Client Onboarding

• Provision and operate AWS Direct Connect connections (primary) and Site-to-Site VPN tunnels (failover) per customer tenant.
• Coordinate with client bank network teams for BGP configuration, IP addressing, and bandwidth planning.
• Define and enforce routing policies (BGP, static routes) between client on-prem and AWS tenant environments.
• Own failover testing and validation for hybrid connectivity paths.

3. Network Security

• Configure and manage AWS Network Firewall (stateful/stateless rules, Suricata-based IDS/IPS).
• Manage AWS WAF policies (OWASP rule sets, API protection, bot mitigation, rate limiting).
• Design and maintain Security Groups and Network ACLs following least-privilege principles.
• Enforce Kubernetes NetworkPolicy rules via Kyverno for pod-to-pod and namespace traffic control.
• Support the SecOps team during security incidents involving network-layer indicators.

4. Service Mesh & Internal Connectivity

• Operate and troubleshoot Istio (service mesh) for mTLS enforcement, traffic routing, and east-west observability within EKS clusters.
• Manage AWS PrivateLink endpoints for cross-account service exposure (shared services → tenant accounts).
• Ensure network-level connectivity for platform services: Amazon MSK (Kafka), Amazon MQ (ActiveMQ), RDS SQL Server (Multi-AZ).

5. DNS Management

• Manage Amazon Route 53 - public hosted zones (customer-facing endpoints), private hosted zones (internal service resolution), and resolver rules for hybrid DNS.
• Implement and validate DNS failover policies aligned with RTO/RPO targets.

6. Infrastructure as Code

• Own Terraform modules for all network resources: VPCs, subnets, route tables, security groups, Network Firewall policies, WAF rules, Direct Connect/VPN, and DNS zones.
• Contribute to the AFT (Account Factory for Terraform) customisation templates for network baseline provisioning on new tenant account creation.
• Enforce IaC quality standards: peer-reviewed PRs, policy-as-code (Kyverno / OPA/Conftest), automated drift detection.

7. Observability & Incident Response

• Instrument network-layer observability: VPC Flow Logs, AWS Network Firewall alerts, Istio traffic metrics (golden signals), and Direct Connect performance dashboards.
• Define and monitor network SLIs (packet loss, latency, throughput per tenant path) contributing to the SRE error budget framework.
• Act as network SME during P1/P2 incidents and post-mortem investigations.
• Maintain network runbooks and escalation procedures in the operational knowledge base.

8. Capacity & Cost Management

• Model bandwidth requirements per tenant and across the shared connectivity backbone; proactively plan capacity headroom.
• Optimise network costs (NAT Gateway egress, Direct Connect port utilisation, data transfer) in alignment with the FinOps workstream.

Required Skills & Experience

8+ years of relevant experience

Cloud Networking - AWS (mandatory)

• Deep, hands-on experience with AWS VPC (subnets, routing, peering, endpoint services, CIDR management).
• Proven AWS Direct Connect deployment and operations: Virtual Interfaces (Private VIF / Transit VIF), hosted connections, BGP, failover with VPN.
• AWS Network Firewall and AWS WAF - rule authoring, policy lifecycle, alert tuning.
• Amazon Route 53 - advanced DNS management (private zones, resolver endpoints, health checks, failover policies).
• AWS Control Tower / multi-account organisation networking patterns (hub-and-spoke, landing zone).

Network Fundamentals

• Strong foundational knowledge: TCP/IP, BGP, OSPF, VLANs, MPLS concepts, subnetting, routing.
• Experience with SD-WAN or hybrid WAN architectures is a plus.
• Familiarity with network security concepts: stateful inspection, IDS/IPS, zero-trust network access (ZTNA).

Kubernetes & Service Mesh

• Working knowledge of Kubernetes networking (CNI, kube-proxy, CoreDNS, NetworkPolicy).
• Practical experience with Istio (VirtualService, DestinationRule, PeerAuthentication, mTLS).
• Familiarity with Kyverno or OPA for policy-as-code enforcement of network controls.

Infrastructure as Code

• Proficiency in Terraform (modules, workspaces, remote state, provider ecosystem for AWS networking).
• Experience with GitOps workflows (PR-based changes, ArgoCD or equivalent).
• Version control practices: branching strategies, code review, conventional commits.

Observability

• Experience with VPC Flow Logs, CloudWatch, and network-layer telemetry pipelines.
• Familiarity with Prometheus / Grafana for infrastructure and service mesh dashboards.
• Ability to write and maintain runbooks and post-mortems.

Compliance & Security Context (desirable)

• Awareness of financial services network requirements: SWIFT CSP, PCI-DSS, ISO 27001, DORA (EU).
• Understanding of data residency constraints and network-level controls for regulated environments.

Nice to Have

• Knowledge of FIX protocol or market connectivity (LSEG/Reuters, Bloomberg) network patterns.
• Familiarity with AWS PrivateLink and multi-account cross-service exposure patterns.
• Experience with Chaos Engineering for network-layer resilience testing (partition injection, latency simulation).
• AWS certifications: Advanced Networking Specialty, Solutions Architect Professional.

Team Context & Reporting

The NetOps Engineer reports to the Cloud / Service Delivery Manager and operates within the Network & IAM workstream.

Primary interfaces: - InfraOps - joint ownership of EKS cluster networking, IaC modules, platform baseline. - SRE - network SLI/SLO definition, error budget contribution, incident network-layer triage. - SecOps - co-owns network security posture (WAF, Firewall, NetworkPolicy); feeds into SIEM pipeline. - DevOps - supports connectivity requirements for CI/CD pipelines, ECR pull-through, VPC Endpoints. - Client Bank Network Teams - external stakeholder for Direct Connect / VPN onboarding.

Why Join Kondor UP

• Impact at scale: You design and operate the network backbone of a production SaaS platform serving tier-1 financial institutions - every routing decision you make has direct SLA consequences.
• Modern stack: AWS-native, Terraform-first, GitOps, Istio, Kyverno - no legacy on-prem tooling debt.
• Financial domain depth: Rare opportunity to combine advanced cloud networking with exposure to treasury operations, market connectivity (LSEG, Bloomberg, SWIFT), and regulated financial infrastructure.
• Engineering culture: Blameless post-mortems, SLO-driven operations, toil-elimination as a first-class concern.

Education

Engineering degree (Computer Science, Information Technology, Mathematics, or equivalent) or equivalent experience

Work model

• Hybrid - Bangalore (Teciem India office) + remote
• Participation in a 24/5 on-call rotation is a core requirement of this role

Why Teciem

✔ Fast-growing global fintech organization

✔ Exposure to leading financial institutions worldwide

✔ Opportunity to work on innovative Treasury & Capital Markets solutions

✔ Collaborative and international work environment

✔ Flexible hybrid working model

✔ Excellent learning and career development opportunities