Network Security Engineer – Deployment and Support

Job description

About the Job As 'Network Security Engineer – Deployment and Support' within our Digital Technology Service Quality team, you will build, deploy, and support the network security estate that protects Sanofi's enterprise — firewalls across Cisco ASA and FTD, Fortinet FortiGate, and Juniper SRX, Web Application Firewalls, DDoS protection, VPNs, and the Zscaler cloud security platform. You will deploy security infrastructure and policy as code using Terraform, Ansible, and Python wherever the platform allows, and apply the same engineering rigour where it does not. You will own what you deploy — from policy definition and automated pre-change validation through to day-two operations, rule lifecycle hygiene, and incident response — ensuring our network security posture remains accurate, auditable, and resilient. Ready to get started? Our Team Digital Technology – Service Quality is at the heart of Sanofi's digital transformation. We deliver secure, resilient, and scalable infrastructure services that power business-critical applications and enable thousands of users across the enterprise. Our network security engineering team sits at the boundary of every service we run — enforcing segmentation, controlling access, and giving our security operations colleagues the visibility they need. Our team combines modern cloud platforms, automation-first engineering, and service excellence to support Sanofi's mission of chasing the miracles of science. About Sanofi We're an R&D-driven, AI-powered biopharma company committed to improving people's lives and delivering compelling growth. Our deep understanding of the immune system – and innovative pipeline – enables us to invent medicines and vaccines that treat and protect millions of people around the world. Together, we chase the miracles of science to improve people's lives. Main Responsibilities Network Security Deployment – Infrastructure and Policy as Code • Deploy cloud network security infrastructure as code using Terraform, provisioning security groups and network security groups, cloud-native firewall and WAF policy, route tables, private connectivity, and inspection architectures across AWS and Azure, with reusable modules, remote state management, and plan review built into the change process • Deploy and maintain firewall and network security configuration as code using Ansible, building reusable roles and templates for Cisco ASA and FTD, Fortinet FortiOS, and Juniper SRX so that every change is repeatable, version-controlled, and auditable • Automate security provisioning and operational tasks in Python, consuming platform APIs — Junos Space for SRX estate management, Cisco APIC for ACI contract and microsegmentation policy, FortiGate and FortiAnalyzer APIs, Zscaler APIs, and F5, Array, and AVI load balancer and WAF APIs • Automate vendor web consoles and portals that expose no usable API using Selenium, so that licensing, reporting, and legacy management interfaces do not force manual work • Use Gemini CLI as an AI agent within the engineering workflow to accelerate policy review, triage large firewall log and packet-capture data sets, summarise rule-base findings, draft runbooks and knowledge articles, and scaffold Ansible and Python automation • Maintain Git as the source of truth for network security configuration, with golden configuration templates, peer-reviewed changes, and a full version-controlled audit trail of every policy change • Operate deployment pipelines for network security change, including automated pre-change validation, policy risk and compliance checks using AlgoSec, and automated post-deployment verification of traffic flow and policy hit behaviour • Implement configuration drift detection and automated remediation, so deployed security policy provably matches its declared intent • Codify security baselines and standards — hardening, zoning, naming, and device software targets — and gate deployments against them • Integrate the firewall rule request lifecycle with ServiceNow, so approved requests flow into validated, automated deployment rather than manual console work Network Security Deployment – Engineering Delivery • Build and deploy network security configuration items (CIs) — firewalls, VPN concentrators, WAF and load balancer platforms, and DDoS protection services — from initial requirement through to validated production handover • Deliver deployments to enterprise sites, manufacturing sites, and on-premises data centres, including physical installation, cabling, high-availability pairing, licensing, and firmware qualification where automation is not available • Deliver hardware refresh, end-of-life replacement, and software upgrade campaigns across Cisco ASA/FTD, FortiOS, and Junos SRX platforms • Execute controlled environment promotion (Dev to Pre-Prod to Production) with documented rollback and recovery plans for every change • Register all deployed network security CIs in the CMDB with correct class, attributes, relationships, ownership, location, and lifecycle status at point of deployment • Configure and maintain network discovery and SNMP so security CIs are correctly classified with accurate serial numbers, models, and discovery-source behaviour • Onboard every newly deployed CI into monitoring, alerting, log forwarding, configuration backup, patching, and vulnerability tooling before production sign-off • Produce and maintain as-built documentation, network security diagrams, runbooks, and knowledge articles for all deployed infrastructure Firewall and Policy Engineering • Deploy, configure, and support enterprise firewalls across Cisco ASA and FTD, Fortinet FortiGate running FortiOS, and Juniper SRX platforms • Design and implement firewall policy to least-privilege principles, using application-aware, user-aware, and identity-based rules rather than broad address-based permits • Own the full firewall rule lifecycle — request, validation, implementation, recertification, and decommissioning — driving down rule count, shadowed and redundant rules, overly permissive any-any rules, and unused objects • Operate AlgoSec for policy analysis, change risk assessment, rule-base optimisation, compliance reporting, and evidencing rule recertification to auditors • Use FortiAnalyzer for centralised Fortinet logging, reporting, and forensic review of policy and threat events • Implement and tune threat prevention capabilities — IPS, anti-malware, URL filtering, and TLS inspection — balancing security efficacy against application impact • Manage firewall estate configuration centrally, using Junos Space for Juniper SRX and native management platforms for Cisco and Fortinet devices Segmentation, Zoning and Microsegmentation • Implement and maintain network zones, VLANs, VRF separation, and segmentation in line with security architecture and enterprise zoning standards • Deliver data centre microsegmentation using Cisco ACI contracts and endpoint group policy configured through Cisco APIC • Implement east-west controls across data centre, cloud, and OT or manufacturing environments, working to a zero-trust target architecture • Segregate and protect manufacturing, laboratory, and OT networks, respecting the availability and validation constraints of regulated production environments • Validate segmentation effectiveness through testing and traffic analysis rather than assuming policy intent equals enforced reality VPN, Secure Access and Cloud Security Platform • Deploy and support remote access services — SSL VPN and IPSec VPN, and identity-integrated access with multi-factor authentication — at enterprise scale • Deploy and support site-to-site IPSec connectivity, including tunnel design, encryption standards, rekeying, and failover behaviour • Deploy and support the Zscaler cloud security platform, including secure web gateway and private access policy, traffic forwarding and steering, SSL inspec