Proxy Engineer (Network Security) Default Deny for Servers and Containers - hybrid

The customer is moving its server environments (development, pre-production, and production) to a default-deny internet policy and extending the same controls to containers. Default deny is a broad first step, so the work goes further: using server-side break-and-inspect proxying to gain full-path visibility and build more refined, path-aware policies. This effort is focused on visibility and policy precision rather than data loss prevention. You will work alongside the customer s proxy engineers in the UK and US, and partner with network, firewall, and application teams., * Enable and operate default-deny internet access for servers and containers across development, pre-production, and production environments

• Design and implement server-side break-and-inspect proxy policies to provide full-path visibility into outbound traffic
• Build path-aware policies that replace broad default-deny rules with more precise, least-privilege access
• Route untrusted CDN domains, such as content hosted on Fastly and Cloudflare, through the proxy so that traffic is inspected and controlled
• Analyze server and container outbound traffic to identify required destinations and validate policy changes before and after rollout
• Troubleshoot blocked or failing connections using Layer 4 through Layer 7 analysis, working with application and infrastructure owners to resolve issues
• Support the firewall rule cleanup effort and the target-state security design, helping align proxy and firewall controls
• Execute proxy policy and configuration changes under formal change-control processes, including testing and rollback planning
• Document policy designs, exceptions, and operational procedures, and coordinate handoffs with team members in other time zones

• Hands-on enterprise proxy experience (Blue Coat/Symantec, Skyhigh, or similar platforms)
• Strong routing knowledge and solid understanding of Layer 4 through Layer 7 traffic behavior
• Ability to learn how proxy policies are constructed and apply that knowledge to new designs (Skyhigh experience is not required)
• Experience working in a change-controlled enterprise environment
• Clear written communication and the ability to work with teams across time zones, * Layer 7 experience, such as application-aware inspection and policy
• Exposure to container or Kubernetes networking
• Firewall rule management experience (AlgoSec) and familiarity with SaaS, IaaS, and PaaS traffic patterns
• Financial services background