Security Design Engineer
Role details
Job location
Tech stack
Job description
The Design Engineer is responsible for Architecture of Network Security components as related to zero trust in a platform transformation programme. The Design Engineer must act as a bridge between traditional network security controls and modern identity-based security provided by a service mesh. This role must assess how existing network security controls interact with service mesh capabilities and produce E2E solution designs, standards, patterns and related artefacts. This is part of a larger platform initiative and requires extensive collaboration across the organisation. Responsibility for reviewing, designing and collaborating with numerous business units is also key to the position. This is a multi-faceted role involving numerous areas of expertise and stakeholders across the enterprise.
Design Engineers must be comfortable presenting and sharing solutions, standards, patterns at design authorities, and with senior leadership & stakeholders. Additionally, the Security Design Engineer will provide technical thought leadership and direction to their aligned projects and operate as a Subject Matter Expert, providing consultancy., + Modelling and documentation of communication flows
- Automation and workflow-driven protections
- Defence in depth along with related capabilities: TLS, PKI and identity-based controls
- Practical working technical knowledge of Service Mesh:
- experience with one or more vendors (eg. Istio, Kong)
- Sidecar and mTLS implementation
- Workload identities in conjunction with gateways
- Identity and Access Management using modern authNZ (eg. OIDC, JWT etc.)
- Logging & Monitoring for security, optimisation, delivery of intelligence and insights
- Management access and isolation including recording of changes
- Analysis of rules, gaps, traffic seen and proactively updating programmatically
- Anomalous traffic flows and inspection to identify
- Ensuring regulations and compliance can be attested to through visibility
- External capabilities and integrations that can provide Intel and visibility of security
- experience in large-scale global Financial Services and Regulatory requirements, audits
- Maintaining a data-driven, evidence-based approach to decision making, Extensive collaboration with primary stakeholders: Enterprise and Platform Architects, Solution Architects, Data Analysts & Engineers, Cyber colleagues (Capability Leads, Control owners)
Ensuring Standards and Patterns are drawn up in collaboration with stakeholders and approved through relevant governance
Documenting, raising and escalating technical debt, risks and issues along with identifying security gaps and challenges and documenting formally
Providing security assurance, advice and guidance to Engineering, Project Managers, senior stakeholders in delivering strategic outcomes for business needs
Requirements
- Application design from platform selection, to deployment with significant experience designing to meet scale, demand and in a secure fashion (eg. DevSecOps)
- Knowledge and practical experience of implementing modern application architecture practices, from CSP-native, to Hybrid designs, EDA along with microservices and serverless
- Deep practical and considerable experience in Cyber Security: Threats and modelling, Risks and assessments, Attack vectors, vulnerabilities, CEH and red/purple teaming
- Assess how existing network security controls apply within service mesh (eg. Firewalls, NIPS/NIDS, WAF, Proxies, DDoS, Segmentation)
- Significant practical experience and proven technical depth across network security:
- Firewall design and implementation, next-gen capabilities
- NIPS/NIDS design and implementation, automation, workflow and framework
- WAF design and deployment within internally and externally presented apps
- Forward Proxy design and implementation across numerous use-cases
- Reverse Proxy platform design and deployment protecting apps, APIs
- Denial of Service design and implementation from volumetric to application
- Network Segmentation design securing application components from threat susceptibility
- Network visibility and traffic monitoring, * Demonstrable proven experience authoring Standards, Patterns, Designs utilising industry standard methodologies and references (eg. NIST, SANS, ISO, ITU, ISF etc.)
- Documentation of above areas including but not limited to: Standards, Patterns, Strategies, Roadmaps and recommendation papers, positioned at senior leadership and engineers
- Broad background across information technology with the ability to communicate clearly with non-security technical SMEs at a comfortable level
Qualifications & Certifications:
Bachelors or Masters degree in Cybersecurity, Computer Science, Software Engineering, or related scientific or mathematic field
SABSA, TOGAF certification or related industry-recognised certifications
Software architecture qualifications (eg. CPSA), Application security (eg. CEH or similar)
CSP security certification (eg. AWS, Azure, GCP)
Platform & Technology:
Working practical knowledge of Legacy and modern networking infrastructure
experience with Akamai, F5, Azure, AWS, NginX, Checkpoint, Cisco and related platforms
BizzDesign, Archi, or generic UML visualisation experience for high-level designs
Working proficiency in Jira, Confluence for project & tasks management, documentation, Self-motivated with ability to present artefacts to design authorities and articulate deep technical concepts to a broad range of stakeholders in both large forums and smaller deep-dive sessions
Ownership and driving Standards, Patterns and Designs from authoring, collaboration with stakeholders through to final approval
Ensure all architecture artefacts undergo appropriate peer-review prior to seeking approval
Risk and Dependency Management:
Effectively manages and formally escalates both technical and project risks or issues
Ability to map design decisions to result in technical risks & issues and articulate the cause and rationale which leads to any negatively impacting change
Leadership & Teamwork
Communicates clearly, openly and creates visible presence in all calls to ensure security is centre to requirements (eg. Security by design)
Lead others by example, creating an environment that inspires security deliverables
Builds effective social networks both internally and externally with key stakeholders, communicating consistently and continuously Location
Manchester, UK