Security Design Engineer

Security Design Engineer (ServiceMesh) - 6 Month Contract - INSIDE IR35 - London, Sheffield, Manchester, Birmingham - No Sponsorship Available

Project Overview

We are looking for an experienced Network Security Architect / Security Design Architect to support a major security transformation programme within a complex enterprise environment for a Tier 1 Bank. The programme is focused on evolving network and application security controls to support modern, cloud-native architectures. The environment spans traditional enterprise networking and security alongside Kubernetes, microservices, service mesh, APIs, cloud platforms and modern software-development practices. The successful individual will need to bridge the gap between traditional network security and modern application/platform architecture, working closely with network, security, platform, infrastructure and software-engineering teams.

This is not intended to be a traditional firewall-only position, nor a pure Cloud Security, DevOps or Kubernetes engineering role. The requirement is for someone with a strong network-security foundation who understands how applications are designed, developed, deployed and secured in modern distributed environments.

Key Responsibilities

Network Security Architecture & Design

Design and review secure enterprise network architectures across on-premise, hybrid-cloud and cloud environments.

• Define security architectures covering network segmentation, micro-segmentation, Zero Trust, secure connectivity and application traffic flows.
• Produce and review architectural documentation including HLDs, LLDs, security patterns and design standards.
• Assess existing network-security architectures and identify appropriate improvements or target-state designs.
• Design security controls covering north-south and east-west traffic across enterprise and cloud-native environments.
• Work with engineering teams to ensure network-security requirements translate into practical technical designs.

Firewall & Network Security

Provide architecture and technical expertise across technologies and concepts such as:

• Next-generation firewalls
• Palo Alto
• Check Point
• Cisco Firepower / ASA
• Fortinet
• IDS/IPS
• VPN/IPsec
• Secure ingress and egress
• Network segmentation
• Micro-segmentation
• Load balancing / application delivery
• Secure proxying
• Network policy and traffic inspection

Zero Trust

Apply Zero Trust principles across network, application and platform architectures.

• Design controls for segmentation and micro-segmentation across traditional infrastructure and cloud-native environments.
• Support identity-aware access and least-privilege security models.
• Understand the relationship between user identity, workload identity, network controls and service-to-service communication.

Service Mesh

A key element of the project is securing modern distributed application environments.

The individual should have experience working around:

• Containerised workloads
• Microservices
• Service-to-service communication
• Service Mesh
• Istio
• Envoy
• Ingress/egress gateways
• Network policies
• API gateways
• Workload identity
• TLS / mTLS
• The key requirement for this role is solid Service Mesh experience

Application Security & SDLC

The role requires someone who can work credibly with software-development and engineering teams.

Candidates should understand:

• The Software Development Lifecycle (SDLC)
• Secure-by-design principles
• Application Security
• API security
• Microservices security
• CI/CD pipelines
• Threat modelling
• SAST / DAST / SCA
• Authentication and authorisation
• PKI/certificate management
• Secrets management

The individual does not need to be a career Software Engineer, but must understand how software is developed and how network/security controls interact with modern applications. An earlier development, engineering or application-architecture background would therefore be useful.

Cloud Security

experience securing network and application architectures across one or more major cloud platforms:

• AWS
• Azure
• GCP

Useful experience would include:

• VPC/VNet architecture
• Cloud firewalls
• Transit/network gateways
• Direct Connect / ExpressRoute / Interconnect
• Private connectivity
• Cloud load balancing
• Kubernetes services such as EKS, AKS or GKE
• IAM/workload identity
• Cloud-native network controls

Essential experience

The strongest CVs should demonstrate most of the following:

• Strong enterprise Network Security background
• Network Security Architecture / Network Security Engineering
• Enterprise firewall architecture and engineering
• Network segmentation / micro-segmentation
• Zero Trust
• Modern cloud networking/security
• Kubernetes/container understanding
• Microservices
• Service Mesh / Istio or comparable technology
• Understanding of SDLC and application security
• Secure-by-design architecture
• experience working directly with software, platform, infrastructure and security engineers
• HLD/LLD/security-design documentation
• Cloud experience across AWS, Azure and/or GCP

Location

London, UK

Trading as TEKsystems. Allegis Group Limited, Maxis 2, Western Road, Bracknell, RG12 1RT, United Kingdom. No. (phone number removed). Allegis Group Limited operates as an Employment Business and Employment Agency as set out in the Conduct of Employment Agencies and Employment Businesses Regulations 2003. TEKsystems is a company within the Allegis Group network of companies (collectively referred to as "Allegis Group"). Aerotek, Aston Carter, EASi, Talentis Solutions, TEKsystems, Stamford Consultants and The Stamford Group are Allegis Group brands. If you apply, your personal data will be processed as described in the Allegis Group Online Privacy Notice available at (url removed)>

To access our Online Privacy Notice, which explains what information we may collect, use, share, and store about you, and describes your rights and choices about this, please go to (url removed)>

We are part of a global network of companies and as a result, the personal data you provide will be shared within Allegis Group and transferred and processed outside the UK, Switzerland and European Economic Area subject to the protections described in the Allegis Group Online Privacy Notice. We store personal data in the UK, EEA, Switzerland and the USA. If you would like to exercise your privacy rights, please visit the "Contacting Us" section of our Online Privacy Notice at (url removed)/en-gb/privacy-notices for details on how to contact us. To protect your privacy and security, we may take steps to verify your identity, such as a password and user ID if there is an account associated with your request, or identifying information such as your address or date of birth, before proceeding with your request. If you are resident in the UK, EEA or Switzerland, we will process any access request you make in accordance with our commitments under the UK Data Protection Act, EU-U.S. Privacy Shield or the Swiss-U.S. Privacy Shield.