Network Security Engineer (SASE and Secure Web Gateway)

About the Role

We are looking for a hands-on, analytical Senior Network Security Engineer to design, build, and continuously improve a cloud-delivered security edge for a major banking environment. You will lead the Secure Web Gateway (SWG), Secure Access Service Edge (SASE), and Zero Trust Network Access (ZTNA) initiatives, delivering secure, reliable, and uninterrupted network connectivity.

Responsibilities

• Secure Web Gateway (SWG): Create and manage the web security policy architecture, including URL filtering, cloud application control, cloud firewall, and file-type/sandbox policies. Develop SSL/TLS inspection approaches, define exemption frameworks, and implement traffic steering using PAC files, explicit proxies, and GRE/IPsec tunnels. Oversee the migration of legacy on-premises proxies to Cloud SWG.
• Zero Trust & SASE: Design and implement Zero Trust Network Access (ZTNA) to replace remote-access VPN solutions. Integrate ZTNA with corporate identity providers using SAML and SCIM, and deploy CASB, DLP, and data-protection capabilities for cloud and web traffic.
• Platform Operations & Automation: Maintain platform-independent security policy baselines, conduct technical vendor assessments, and automate configuration management through APIs with version control.
• Governance & Compliance: Produce engineering runbooks for Change Advisory Board reviews and assist with stringent regulatory audits (e.g., MAS TRM guidelines).

Requirements

• Degree in Computer Science, Information Technology, or a related field.
• 8 to 12 years of total experience in network or security engineering, including at least 4 years focused on designing and implementing enterprise SSE/SASE platforms (e.g., Zscaler, Netskope, Prisma Access, Cisco Secure Access) — hands-on engineering responsibilities, not end-user support.
• Proven track record delivering at least one complete migration from an on-premises proxy (e.g., Bluecoat/Symantec ProxySG, Cisco WSA, McAfee SWG) to a cloud SWG platform.
• Shown ability to design and deliver ZTNA solutions that replace legacy remote-access VPNs.
• Strong knowledge of HTTP/S, TLS, and PKI, proxy/PAC file behaviour, DNS, and authentication workflows (SAML, Kerberos).
• Experience integrating identity providers (Microsoft Entra ID or Okta using SAML/SCIM) and working knowledge of enterprise firewalls (Palo Alto, Check Point) in conjunction with GRE/IPsec tunnelling.
• Experience delivering services under the ITIL framework in a regulated environment; strong problem-solving skills and a collaborative, fast-learning mindset.

Good-to-Have Skills

• Hands-on experience designing and implementing Zscaler (ZIA/ZPA), Netskope, or Skyhigh Security SSE.
• Experience leading platform evaluations, proofs-of-concept (PoC), or platform-to-platform migration efforts.
• Expertise in digital experience monitoring, advanced DLP (EDM/IDM), and browser isolation.
• Scripting and automation experience using Python or Terraform for SASE configurations, plus SIEM integration (Splunk).
• Endpoint management experience for agent deployments (Intune, SCCM, Jamf).
• Prior work experience in the Financial Services sector.
• Professional certifications such as CISSP, CCSP, and vendor-specific credentials (e.g., Netskope NCCSI/NSK200/300, Palo Alto Networks SSE Engineer, Zscaler ZDTA/ZDTE).