Security Design Engineer - 6 Month Contract - INSIDE IR35 - Sheffield, Manchester, Birmingham - No Sponsorship Available
Job Description
The Design Engineer is responsible for Architecture of Network Security components as related to zero trust in a platform transformation programme. The Design Engineer must act as a bridge between traditional network security controls and modern identity-based security provided by a service mesh. This role must assess how existing network security controls interact with service mesh capabilities and produce E2E solution designs, standards, patterns and related artefacts. This is part of a larger platform initiative and requires extensive collaboration across the organisation. Responsibility for reviewing, designing and collaborating with numerous business units is also key to the position. This is a multi-faceted role involving numerous areas of expertise and stakeholders across the enterprise.
Design Engineers must be comfortable presenting and sharing solutions, standards, patterns at design authorities, and with senior leadership & stakeholders. Additionally, the Security Design Engineer will provide technical thought leadership and direction to their aligned projects and operate as a Subject Matter Expert, providing consultancy.
Principal Requirements
Expertise:
Application design from platform selection, to deployment with significant experience designing to meet scale, demand and in a secure fashion (eg. DevSecOps)
Knowledge and practical experience of implementing modern application architecture practices, from CSP-native, to Hybrid designs, EDA along with microservices and serverless
Deep practical and considerable experience in Cyber Security: Threats and modelling, Risks and assessments, Attack vectors, vulnerabilities, CEH and red/purple teaming
Assess how existing network security controls apply within service mesh (eg. Firewalls, NIPS/NIDS, WAF, Proxies, DDoS, Segmentation)
Significant practical experience and proven technical depth across network security:
Firewall design and implementation, next-gen capabilities
NIPS/NIDS design and implementation, automation, workflow and framework
WAF design and deployment within internally and externally presented apps
Forward Proxy design and implementation across numerous use-cases
Reverse Proxy platform design and deployment protecting apps, APIs
Denial of Service design and implementation from volumetric to application
Network Segmentation design securing application components from threat susceptibility
Network visibility and traffic monitoring
Large scale distributed systems
Modelling and documentation of communication flows
Automation and workflow-driven protections
Defence in depth along with related capabilities: TLS, PKI and identity-based controls
Practical working technical knowledge of Service Mesh:
experience with one or more vendors (eg. Istio, Kong)
Sidecar and mTLS implementation
Workload identities in conjunction with gateways
Identity and Access Management using modern authNZ (eg. OIDC, JWT etc.)
Logging & Monitoring for security, optimisation, delivery of intelligence and insights
Management access and isolation including recording of changes
Analysis of rules, gaps, traffic seen and proactively updating programmatically
Anomalous traffic flows and inspection to identify
Ensuring regulations and compliance can be attested to through visibility
External capabilities and integrations that can provide intel and visibility of security
experience in large-scale global Financial Services and Regulatory requirements, audits
Maintaining a data-driven, evidence-based approach to decision making
Demonstrable proven experience authoring Standards, Patterns, Designs utilising industry standard methodologies and references (eg. NIST, SANS, ISO, ITU, ISF etc.)
Documentation of above areas including but not limited to: Standards, Patterns, Strategies, Roadmaps and recommendation papers, positioned at senior leadership and engineers
Broad background across information technology with the ability to communicate clearly with non-security technical SMEs at a comfortable levelQualifications & Certifications:
• Bachelors or Masters degree in Cybersecurity, Computer Science, Software Engineering, or related scientific or mathematic field
• SABSA, TOGAF certification or related industry-recognised certifications
• Software architecture qualifications (eg. CPSA), Application security (eg. CEH or similar)
• CSP security certification (eg. AWS, Azure, GCP)
Platform & Technology:
• Working practical knowledge of legacy and modern networking infrastructure
• experience with Akamai, F5, Azure, AWS, NginX, Checkpoint, Cisco and related platforms
• BizzDesign, Archi, or generic UML visualisation experience for high-level designs
• Working proficiency in Jira, Confluence for project & tasks management, documentation
Principal Accountabilities and Responsibilities
Architecture & Design:
• Extensive collaboration with primary stakeholders: Enterprise and Platform Architects, Solution Architects, Data Analysts & Engineers, Cyber colleagues (Capability Leads, Control owners)
• Ensuring Standards and Patterns are drawn up in collaboration with stakeholders and approved through relevant governance
• Documenting, raising and escalating technical debt, risks and issues along with identifying security gaps and challenges and documenting formally
• Providing security assurance, advice and guidance to Engineering, Project Managers, senior stakeholders in delivering strategic outcomes for business needs
• Clear understanding of both the motivations of the business and technical security
Governance:
• Self-motivated with ability to present artefacts to design authorities and articulate deep technical concepts to a broad range of stakeholders in both large forums and smaller deep-dive sessions
• Ownership and driving Standards, Patterns and Designs from authoring, collaboration with stakeholders through to final approval
• Ensure all architecture artefacts undergo appropriate peer-review prior to seeking approval
Risk and Dependency Management:
• Effectively manages and formally escalates both technical and project risks or issues
• Ability to map design decisions to result in technical risks & issues and articulate the cause and rationale which leads to any negatively impacting change
Leadership & Teamwork
• Communicates clearly, openly and creates visible presence in all calls to ensure security is centre to requirements (eg. Security by design)
• Lead others by example, creating an environment that inspires security deliverables
• Builds effective social networks both internally and externally with key stakeholders, communicating consistently and continuously
Location
Manchester, UK
Trading as TEKsystems. Allegis Group Limited, Maxis 2, Western Road, Bracknell, RG12 1RT, United Kingdom. No. (phone number removed). Allegis Group Limited operates as an Employment Business and Employment Agency as set out in the Conduct of Employment Agencies and Employment Businesses Regulations 2003. TEKsystems is a company within the Allegis Group network of companies (collectively referred to as "Allegis Group"). Aerotek, Aston Carter, EASi, Talentis Solutions, TEKsystems, Stamford Consultants and The Stamford Group are Allegis Group brands. If you apply, your personal data will be processed as described in the Allegis Group Online Privacy Notice available at (url removed)>
To access our Online Privacy Notice, which explains what information we may collect, use, share, and store about you, and describes your rights and choices about this, please go to (url removed)>
We are part of a global network of companies and as a result, the personal data you provide will be shared within Allegis Group and transferred and processed outside the UK, Switzerland and European Economic Area subject to the protections described in the Allegis Group Online Privacy Notice. We store personal data in the UK, EEA, Switzerland and the USA. If you would like to exercise your privacy rights, please visit the "Contacting Us" section of our Online Privacy Notice at (url removed)/en-gb/privacy-notices for details on how to contact us. To protect your privacy and security, we may take steps to verify your identity, such as a password and user ID if there is an account associated with your request, or identifying information such as your address or date of birth, before proceeding with your request. If you are resident in the UK, EEA or Switzerland, we will process any access request you make in accordance with our commitments under the UK Data Protection Act, EU-U.S. Privacy Shield or the Swiss-U.S. Privacy Shield