L
Security Design Engineer
London
1 hour ago
Full-time
On-site
London
Security
Security Design Engineer (ServiceMesh) - 6 Month Contract - INSIDE IR35 - London, Sheffield, Manchester, Birmingham - No Sponsorship Available
Project Overview
We are looking for an experienced Network Security Architect / Security Design Architect to support a major security transformation programme within a complex enterprise environment for a Tier 1 Bank. The programme is focused on evolving network and application security controls to support modern, cloud-native architectures. The environment spans traditional enterprise networking and security alongside Kubernetes, microservices, service mesh, APIs, cloud platforms and modern software-development practices. The successful individual will need to bridge the gap between traditional network security and modern application/platform architecture, working closely with network, security, platform, infrastructure and software-engineering teams.
This is not intended to be a traditional firewall-only position, nor a pure Cloud Security, DevOps or Kubernetes engineering role. The requirement is for someone with a strong network-security foundation who understands how applications are designed, developed, deployed and secured in modern distributed environments.
Key Responsibilities
Network Security Architecture & Design
Design and review secure enterprise network architectures across on-premise, hybrid-cloud and cloud environments.
Define security architectures covering network segmentation, micro-segmentation, Zero Trust, secure connectivity and application traffic flows.
Produce and review architectural documentation including HLDs, LLDs, security patterns and design standards.
Assess existing network-security architectures and identify appropriate improvements or target-state designs.
Design security controls covering north-south and east-west traffic across enterprise and cloud-native environments.
Work with engineering teams to ensure network-security requirements translate into practical technical designs.Firewall & Network Security
Provide architecture and technical expertise across technologies and concepts such as:
Next-generation firewalls
Palo Alto
Check Point
Cisco Firepower / ASA
Fortinet
IDS/IPS
VPN/IPsec
Secure ingress and egress
Network segmentation
Micro-segmentation
Load balancing / application delivery
Secure proxying
Network policy and traffic inspectionZero Trust
Apply Zero Trust principles across network, application and platform architectures.
Design controls for segmentation and micro-segmentation across traditional infrastructure and cloud-native environments.
Support identity-aware access and least-privilege security models.
Understand the relationship between user identity, workload identity, network controls and service-to-service communication.Service Mesh
A key element of the project is securing modern distributed application environments.
The individual should have experience working around:
Containerised workloads
Microservices
Service-to-service communication
Service Mesh
Istio
Envoy
Ingress/egress gateways
Network policies
API gateways
Workload identity
TLS / mTLS
The key requirement for this role is solid Service Mesh experienceApplication Security & SDLC
The role requires someone who can work credibly with software-development and engineering teams.
Candidates should understand:
The Software Development Lifecycle (SDLC)
Secure-by-design principles
Application Security
API security
Microservices security
CI/CD pipelines
Threat modelling
SAST / DAST / SCA
Authentication and authorisation
PKI/certificate management
Secrets managementThe individual does not need to be a career Software Engineer, but must understand how software is developed and how network/security controls interact with modern applications. An earlier development, engineering or application-architecture background would therefore be useful.
Cloud Security
experience securing network and application architectures across one or more major cloud platforms:
AWS
Azure
GCPUseful experience would include:
VPC/VNet architecture
Cloud firewalls
Transit/network gateways
Direct Connect / ExpressRoute / Interconnect
Private connectivity
Cloud load balancing
Kubernetes services such as EKS, AKS or GKE
IAM/workload identity
Cloud-native network controlsEssential experience
The strongest CVs should demonstrate most of the following:
Strong enterprise Network Security background
Network Security Architecture / Network Security Engineering
Enterprise firewall architecture and engineering
Network segmentation / micro-segmentation
Zero Trust
Modern cloud networking/security
Kubernetes/container understanding
Microservices
Service Mesh / Istio or comparable technology
Understanding of SDLC and application security
Secure-by-design architecture
experience working directly with software, platform, infrastructure and security engineers
HLD/LLD/security-design documentation
Cloud experience across AWS, Azure and/or GCP
Location
London, UK
Trading as TEKsystems. Allegis Group Limited, Maxis 2, Western Road, Bracknell, RG12 1RT, United Kingdom. No. (phone number removed). Allegis Group Limited operates as an Employment Business and Employment Agency as set out in the Conduct of Employment Agencies and Employment Businesses Regulations 2003. TEKsystems is a company within the Allegis Group network of companies (collectively referred to as "Allegis Group"). Aerotek, Aston Carter, EASi, Talentis Solutions, TEKsystems, Stamford Consultants and The Stamford Group are Allegis Group brands. If you apply, your personal data will be processed as described in the Allegis Group Online Privacy Notice available at (url removed)>
To access our Online Privacy Notice, which explains what information we may collect, use, share, and store about you, and describes your rights and choices about this, please go to (url removed)>
We are part of a global network of companies and as a result, the personal data you provide will be shared within Allegis Group and transferred and processed outside the UK, Switzerland and European Economic Area subject to the protections described in the Allegis Group Online Privacy Notice. We store personal data in the UK, EEA, Switzerland and the USA. If you would like to exercise your privacy rights, please visit the "Contacting Us" section of our Online Privacy Notice at (url removed)/en-gb/privacy-notices for details on how to contact us. To protect your privacy and security, we may take steps to verify your identity, such as a password and user ID if there is an account associated with your request, or identifying information such as your address or date of birth, before proceeding with your request. If you are resident in the UK, EEA or Switzerland, we will process any access request you make in accordance with our commitments under the UK Data Protection Act, EU-U.S. Privacy Shield or the Swiss-U.S. Privacy Shield
Project Overview
We are looking for an experienced Network Security Architect / Security Design Architect to support a major security transformation programme within a complex enterprise environment for a Tier 1 Bank. The programme is focused on evolving network and application security controls to support modern, cloud-native architectures. The environment spans traditional enterprise networking and security alongside Kubernetes, microservices, service mesh, APIs, cloud platforms and modern software-development practices. The successful individual will need to bridge the gap between traditional network security and modern application/platform architecture, working closely with network, security, platform, infrastructure and software-engineering teams.
This is not intended to be a traditional firewall-only position, nor a pure Cloud Security, DevOps or Kubernetes engineering role. The requirement is for someone with a strong network-security foundation who understands how applications are designed, developed, deployed and secured in modern distributed environments.
Key Responsibilities
Network Security Architecture & Design
Design and review secure enterprise network architectures across on-premise, hybrid-cloud and cloud environments.
Define security architectures covering network segmentation, micro-segmentation, Zero Trust, secure connectivity and application traffic flows.
Produce and review architectural documentation including HLDs, LLDs, security patterns and design standards.
Assess existing network-security architectures and identify appropriate improvements or target-state designs.
Design security controls covering north-south and east-west traffic across enterprise and cloud-native environments.
Work with engineering teams to ensure network-security requirements translate into practical technical designs.Firewall & Network Security
Provide architecture and technical expertise across technologies and concepts such as:
Next-generation firewalls
Palo Alto
Check Point
Cisco Firepower / ASA
Fortinet
IDS/IPS
VPN/IPsec
Secure ingress and egress
Network segmentation
Micro-segmentation
Load balancing / application delivery
Secure proxying
Network policy and traffic inspectionZero Trust
Apply Zero Trust principles across network, application and platform architectures.
Design controls for segmentation and micro-segmentation across traditional infrastructure and cloud-native environments.
Support identity-aware access and least-privilege security models.
Understand the relationship between user identity, workload identity, network controls and service-to-service communication.Service Mesh
A key element of the project is securing modern distributed application environments.
The individual should have experience working around:
Containerised workloads
Microservices
Service-to-service communication
Service Mesh
Istio
Envoy
Ingress/egress gateways
Network policies
API gateways
Workload identity
TLS / mTLS
The key requirement for this role is solid Service Mesh experienceApplication Security & SDLC
The role requires someone who can work credibly with software-development and engineering teams.
Candidates should understand:
The Software Development Lifecycle (SDLC)
Secure-by-design principles
Application Security
API security
Microservices security
CI/CD pipelines
Threat modelling
SAST / DAST / SCA
Authentication and authorisation
PKI/certificate management
Secrets managementThe individual does not need to be a career Software Engineer, but must understand how software is developed and how network/security controls interact with modern applications. An earlier development, engineering or application-architecture background would therefore be useful.
Cloud Security
experience securing network and application architectures across one or more major cloud platforms:
AWS
Azure
GCPUseful experience would include:
VPC/VNet architecture
Cloud firewalls
Transit/network gateways
Direct Connect / ExpressRoute / Interconnect
Private connectivity
Cloud load balancing
Kubernetes services such as EKS, AKS or GKE
IAM/workload identity
Cloud-native network controlsEssential experience
The strongest CVs should demonstrate most of the following:
Strong enterprise Network Security background
Network Security Architecture / Network Security Engineering
Enterprise firewall architecture and engineering
Network segmentation / micro-segmentation
Zero Trust
Modern cloud networking/security
Kubernetes/container understanding
Microservices
Service Mesh / Istio or comparable technology
Understanding of SDLC and application security
Secure-by-design architecture
experience working directly with software, platform, infrastructure and security engineers
HLD/LLD/security-design documentation
Cloud experience across AWS, Azure and/or GCP
Location
London, UK
Trading as TEKsystems. Allegis Group Limited, Maxis 2, Western Road, Bracknell, RG12 1RT, United Kingdom. No. (phone number removed). Allegis Group Limited operates as an Employment Business and Employment Agency as set out in the Conduct of Employment Agencies and Employment Businesses Regulations 2003. TEKsystems is a company within the Allegis Group network of companies (collectively referred to as "Allegis Group"). Aerotek, Aston Carter, EASi, Talentis Solutions, TEKsystems, Stamford Consultants and The Stamford Group are Allegis Group brands. If you apply, your personal data will be processed as described in the Allegis Group Online Privacy Notice available at (url removed)>
To access our Online Privacy Notice, which explains what information we may collect, use, share, and store about you, and describes your rights and choices about this, please go to (url removed)>
We are part of a global network of companies and as a result, the personal data you provide will be shared within Allegis Group and transferred and processed outside the UK, Switzerland and European Economic Area subject to the protections described in the Allegis Group Online Privacy Notice. We store personal data in the UK, EEA, Switzerland and the USA. If you would like to exercise your privacy rights, please visit the "Contacting Us" section of our Online Privacy Notice at (url removed)/en-gb/privacy-notices for details on how to contact us. To protect your privacy and security, we may take steps to verify your identity, such as a password and user ID if there is an account associated with your request, or identifying information such as your address or date of birth, before proceeding with your request. If you are resident in the UK, EEA or Switzerland, we will process any access request you make in accordance with our commitments under the UK Data Protection Act, EU-U.S. Privacy Shield or the Swiss-U.S. Privacy Shield