Lead/Senior Security System Engineer - Network Cloud

• EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture. Here you will collaborate with multi\-national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting\-edge solutions, and have an opportunity to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.*

We are seeking a **Lead/Senior Security System Engineer** to design, implement, and operate secure, compliant network segmentation between regional environments and Global networks, using a standardised control stack of Check Point Security Gateways, Palo Alto Networks next\-generation firewalls, Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Cloudflare for DDoS mitigation, WAF, and application protection. This role blends architecture, hands\-on engineering, automation, and L3/L4 operational leadership to deliver policy\-driven connectivity under strict regulatory and operational requirements.

• *Responsibilities**

• Define trust zones, routing boundaries, and inter\-zone controls for regional and Global Network, covering north\-south and east\-west paths, micro\-segmentation for sensitive tiers, and explicit cross\-border allow\-lists
• Produce HLD/LLD, threat models, and control mappings aligned to internal standards and regional regulation to enable secure communication
• Design and operate dual\-vendor firewall perimeters, with clear control allocation, HA/cluster design, deterministic failover, NAT domain strategy, and SSL/TLS inspection governance tuned for jurisdiction
• Engineer ZIA for identity\-aware egress controls, SSL inspection with jurisdiction\-aware bypasses, inline CASB/DLP, and sanctioned SaaS governance
• Implement ZPA for per\-application zero\-trust access, with connector placement, posture checks, conditional access, and app segmentation replacing legacy VPN where feasible
• Design and deliver Site\-to\-Site VPN, Cloud Interconnect/Partner Interconnect equivalents, and dual\-tunnel HA per site with BGP for failover between on\-prem and hub VPC
• Deploy Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet\-facing services, with layered defence integration with on\-prem perimeters
• Engineer SD\-WAN/MPLS/SASE paths with policy\-based routing, strong encryption, and defined key custody/rotation by jurisdiction
• Translate regulatory and internal control requirements into enforceable technical controls for logging, data residency, TLS inspection scope, and lawful intercept considerations
• Normalise telemetry from security platforms into SIEM with regional data handling rules, and build detections for cross\-border anomalies, DDoS events, and policy drift
• Lead L3/L4 incidents, coordinate issue containment, and drive RCAs with corrective actions codified
• Manage firewall, Zscaler, and Cloudflare policy through automation tools and vendor APIs, with CI/CD implementation including policy linting, unit tests, and path simulation

• *Requirements**

• 6\-15 years of overall IT experience, with a strong background in network security architecture and engineering
• Expertise in Check Point Security Gateways, Palo Alto Networks next\-generation firewalls, and firewall cluster/HA design
• Proficiency in Zscaler Internet Access and Zscaler Private Access for zero\-trust and identity\-aware access control
• Knowledge of Cloudflare Magic Transit, Magic WAN, and WAF for DDoS mitigation and application protection
• Familiarity with cloud hybrid connectivity, including Site\-to\-Site VPN, Cloud Interconnect, and BGP routing
• Understanding of SD\-WAN, MPLS, and SASE architectures with policy\-based routing and strong encryption protocols
• Skills in Microsoft Sentinel and SIEM platforms for telemetry normalisation, detection engineering, and incident response
• Competency in automation and policy\-as\-code using Terraform, Ansible, and vendor REST APIs
• Qualifications in regulatory compliance and audit readiness, including control matrices and CIS Benchmarks

• *We offer**

• Opportunity to work on technical challenges that may impact across geographies
• Vast opportunities for self\-development: online university, knowledge sharing opportunities globally, learning opportunities through external certifications
• Opportunity to share your ideas on international platforms
• Sponsored Tech Talks \& Hackathons
• Unlimited access to LinkedIn learning solutions
• Possibility to relocate to any EPAM office for short and long\-term projects
• Focused individual development
• Benefit package:

+ Health benefits

+ Retirement benefits

+ Paid time off

+ Flexible benefits

• Forums to explore beyond work passion (CSR, photography, painting, sports, etc.)