Security Design Engineer

Security Design Engineer (ServiceMesh) - 6 Month Contract - INSIDE IR35 - London, Sheffield, Manchester, Birmingham - No Sponsorship Available

Project Overview

We are looking for an experienced Network Security Architect / Security Design Architect to support a major security transformation programme within a complex enterprise environment for a Tier 1 Bank. The programme is focused on evolving network and application security controls to support modern, cloud-native architectures. The environment spans traditional enterprise networking and security alongside Kubernetes, microservices, service mesh, APIs, cloud platforms and modern software-development practices. The successful individual will need to bridge the gap between traditional network security and modern application/platform architecture, working closely with network, security, platform, infrastructure and software-engineering teams.

This is not intended to be a traditional firewall-only position, nor a pure Cloud Security, DevOps or Kubernetes engineering role. The requirement is for someone with a strong network-security foundation who understands how applications are designed, developed, deployed and secured in modern distributed environments.

Key Responsibilities

Network Security Architecture & Design

Design and review secure enterprise network architectures across on-premise, hybrid-cloud and cloud environments.

Define security architectures covering network segmentation, micro-segmentation, Zero Trust, secure connectivity and application traffic flows.

Produce and review architectural documentation including HLDs, LLDs, security patterns and design standards.

Assess existing network-security architectures and identify appropriate improvements or target-state designs.

Design security controls covering north-south and east-west traffic across enterprise and cloud-native environments.

Work with engineering teams to ensure network-security requirements translate into practical technical designs.Firewall & Network Security

Provide architecture and technical expertise across technologies and concepts such as:

Next-generation firewalls

Palo Alto

Check Point

Cisco Firepower / ASA

Fortinet

IDS/IPS

VPN/IPsec

Secure ingress and egress

Network segmentation

Micro-segmentation

Load balancing / application delivery

Secure proxying

Network policy and traffic inspectionZero Trust

Apply Zero Trust principles across network, application and platform architectures.

Design controls for segmentation and micro-segmentation across traditional infrastructure and cloud-native environments.

Support identity-aware access and least-privilege security models.

Understand the relationship between user identity, workload identity, network controls and service-to-service communication.Service Mesh

A key element of the project is securing modern distributed application environments.

The individual should have experience working around:

Containerised workloads

Microservices

Service-to-service communication

Service Mesh

Istio

Envoy

Ingress/egress gateways

Network policies

API gateways

Workload identity

TLS / mTLS

The key requirement for this role is solid Service Mesh experienceApplication Security & SDLC

The role requires someone who can work credibly with software-development and engineering teams.

Candidates should understand:

The Software Development Lifecycle (SDLC)

Secure-by-design principles

Application Security

API security

Microservices security

CI/CD pipelines

Threat modelling

SAST / DAST / SCA

Authentication and authorisation

PKI/certificate management

Secrets managementThe individual does not need to be a career Software Engineer, but must understand how software is developed and how network/security controls interact with modern applications. An earlier development, engineering or application-architecture background would therefore be useful.

Cloud Security

experience securing network and application architectures across one or more major cloud platforms:

AWS

Azure

GCPUseful experience would include:

VPC/VNet architecture

Cloud firewalls

Transit/network gateways

Direct Connect / ExpressRoute / Interconnect

Private connectivity

Cloud load balancing

Kubernetes services such as EKS, AKS or GKE

IAM/workload identity

Cloud-native network controlsEssential experience

The strongest CVs should demonstrate most of the following:

Strong enterprise Network Security background

Network Security Architecture / Network Security Engineering

Enterprise firewall architecture and engineering

Network segmentation / micro-segmentation

Zero Trust

Modern cloud networking/security

Kubernetes/container understanding

Microservices

Service Mesh / Istio or comparable technology

Understanding of SDLC and application security

Secure-by-design architecture

experience working directly with software, platform, infrastructure and security engineers

HLD/LLD/security-design documentation

Cloud experience across AWS, Azure and/or GCP

Location

London, UK

Trading as TEKsystems. Allegis Group Limited, Maxis 2, Western Road, Bracknell, RG12 1RT, United Kingdom. No. (phone number removed). Allegis Group Limited operates as an Employment Business and Employment Agency as set out in the Conduct of Employment Agencies and Employment Businesses Regulations 2003. TEKsystems is a company within the Allegis Group network of companies (collectively referred to as "Allegis Group"). Aerotek, Aston Carter, EASi, Talentis Solutions, TEKsystems, Stamford Consultants and The Stamford Group are Allegis Group brands. If you apply, your personal data will be processed as described in the Allegis Group Online Privacy Notice available at (url removed)>

To access our Online Privacy Notice, which explains what information we may collect, use, share, and store about you, and describes your rights and choices about this, please go to (url removed)>

We are part of a global network of companies and as a result, the personal data you provide will be shared within Allegis Group and transferred and processed outside the UK, Switzerland and European Economic Area subject to the protections described in the Allegis Group Online Privacy Notice. We store personal data in the UK, EEA, Switzerland and the USA. If you would like to exercise your privacy rights, please visit the "Contacting Us" section of our Online Privacy Notice at (url removed)/en-gb/privacy-notices for details on how to contact us. To protect your privacy and security, we may take steps to verify your identity, such as a password and user ID if there is an account associated with your request, or identifying information such as your address or date of birth, before proceeding with your request. If you are resident in the UK, EEA or Switzerland, we will process any access request you make in accordance with our commitments under the UK Data Protection Act, EU-U.S. Privacy Shield or the Swiss-U.S. Privacy Shield