Engineering

Devsecops Engineer

GVAPARTNERS·Lagos, Nigeria·Full Time·Contract
Engineeringentry-levelFull TimeContract
-Closes Nov 23, 2026

Growth in Value Alliance (GV Alliance) Partners is a business advisory and market intelligence services firm. Our objectives are to assist organizations to achieve their growth aspirations by providing market intelligence, strategy blueprint, IT solution delivery expertise and business operation improvement capabilities.

We are recruiting to fill the position below: Job Title: DevSecOps Engineer

Location: Lagos Employment Type: Full-time

Description

The term "DevSecOps" is a collaborative working method that links the security and operations teams. The main objective of this collaboration is to limit risks insofar as security is "integrated" into all stages of DevOps projects.

In addition, the term refers to the implementation of security as a fundamental part of all aspects of an organization and makes it the responsibility of all teams.

Security and operations teams are therefore unified to maximize security while limiting the impact on efficiency

Responsibilities

Provide hands-on rechnical expertise and support in general DevOps tasks.

Responsible for defining and implementing the tild, deployment and monitoring standards for this customer;

A part of Agile development teams to deliver an end-to-end automation of deployment, monitoring, and infrastructure management in a cloud environment;

Build and configure delivery environments supporting CD/CI tools using an Agile delivery methodology;

Create scripts and/or templates to automate and/or bootstrap infrastructure provisioning and management tasks;

Working closely with our development team to create an automated continuous integration (CI) and continuous delivery (CD) system;

Work together with vendors and other IT personnel for problem resolution;

Monitor and support all installed systems and infrastructure;

Develop custom scripts to increase system efficiency and lower the human intervention fime on any tasks;

Contribute to the design of information and operational support systems;

Organize the highest levels of systems and infrastructure availability, acting proactively;

Install, configure, test and maintain operating systems, application software and system management tools;

Oversee the company's security, backup, and redundancy strategies;

Evaluate application performance, identify potential bottlenecks, develop solutions, and implement them with the help of developers

Mentor junior infra engineers, evangelize good security habits and secure development practices;

Requirements

BS or MS Degree in Computer Science, Engineering or another related area;

Must be able to work in a specific environment: Jenkins, Docker, Java, Python, Ruby, Perl, Scripting YAML, SAST (Staric Application Security Testing), DAST (Dynamic Application Security Testing)

Ability to work in an open ream environment;

Experience deploying and monitoring web appliations in AWS;

Security first mindset;

Demonstrated experience with secure development, coding, engineering practices;

Experience with Infrastructure as Code and infrastructure resting strategies;

Experience with systems reliability, load balancing, monitoring, logging;

Experience with fully automating CI/CD pipelines end-to-end, from code commits to production;

Have effective verbal and non-verbal communication with peers and clients;

Develop, document, and implement CI/CD strategy for management of Infrastructure as Code laC baseline;

Solid experience in installing, configuring and troubleshooting UNIX/Linux based environments;

Excellent knowledge of networking technologies, particularly with OSI network layers and TCP/IP;

Strong scripting skills, including shell scripts, Perl, Ruby, Python, Go, Groovy, Helm, etc;

Good experience in administering and performance tuning of application stacks, such as Tomcat, JBoss, Apache, Ruby, NGINX, and others.

Apply Now

At a glance

Company

GVAPARTNERS

Location

Lagos, Nigeria

Employment

Full Time

Work style

Contract

Experience

entry-level

Valid until

November 23, 2026

Created

October 22, 2026

More opportunities

Similar roles you might like

Site Reliability Engineer

Heirs Insurance Ltd

Lagos, nigeria

full-time

About the job The Site Reliability Engineer is the hands-on operator and automation builder who keeps the platform running. Reporting to the SRE Lead, you will be responsible for the day-to-day health of the platform --- monitoring, alerting, incident response, and the continuous automation work that makes the platform easier to operate and harder to break. You will work closely with the DevSecOps engineers, cloud engineers, and security team to ensure that reliability is built into every layer of the platform, not bolted on afterwards. This is a demanding role on a high-stakes platform --- and a rare opportunity to do SRE work that genuinely matters at scale. What You'll Do NSOC Operations & Monitoring --- Work as part of the 24/7 Network & Security Operations Centre (NSOC) --- actively monitoring the platform's health across all services, cloud environments, and network layers. Triage incoming alerts, distinguish signal from noise, escalate genuine incidents promptly, and maintain the situational awareness that keeps the team ahead of problems before they become outages. Incident Response & Triage --- Serve as a first responder for platform incidents --- detecting, triaging, and containing issues in real time. Execute runbooks under pressure, coordinate with engineering teams during active incidents, and own your part of the resolution. After every significant incident, contribute to the blameless post-mortem process --- documenting what happened, what worked, and what needs to change. Observability Implementation & Maintenance --- Implement, maintain, and continuously improve the platform's observability stack --- including centralised logging, metrics collection (Prometheus, Datadog, or equivalent), distributed tracing (Jaeger, OpenTelemetry, or equivalent), and alerting rules. Instrument new services from day one, tune alerting thresholds to reduce noise without missing real issues, and build dashboards that give the team the operational visibility they need. Automation & Toil Reduction --- Identify repetitive operational tasks and build the automation that eliminates them. Write scripts, tools, and workflows in Bash, Python, or equivalent to reduce toil --- replacing manual processes with reliable, repeatable automation. Toil that exists today should not exist next quarter. This is an ongoing discipline, not a project with an end date. Reliability & Chaos Testing --- Support the SRE Lead in running the platform's reliability engineering programme --- executing load tests, stress tests, and chaos engineering experiments to validate the platform's resilience under real conditions. Document findings, flag vulnerabilities, and work with engineering teams to address weaknesses before they become production incidents. Runbook Development & Maintenance --- Write, test, and maintain operational runbooks for all known failure modes and recovery procedures. A runbook is only valuable if it works --- regularly test each runbook against real or simulated conditions, update it when the platform changes, and make sure every procedure is accurate and actionable. Runbooks are not documentation --- they are operational tools that must be ready to use at 2am. SLO Monitoring & Reporting --- Monitor SLO attainment and error budget consumption across all platform services on an ongoing basis. Proactively flag services approaching error budget limits to the SRE Lead and relevant engineering teams. Track and report DORA metrics --- deployment frequency, lead time, change failure rate, and MTTR --- as part of the team's ongoing performance visibility. Platform Health & Capacity Monitoring --- Continuously monitor resource utilisation, service performance, and infrastructure health across both cloud environments (AWS and Azure). Identify trends that suggest emerging capacity constraints or degrading performance, and surface these findings to the SRE Lead and Platform Manager before they become incidents. CI/CD Pipeline Health --- Monitor the health and performance of the platform's CI/CD pipelines in collaboration with the DevSecOps team. Identify pipeline failures, flaky tests, or degraded build performance and escalate promptly. Reliable pipelines are part of platform reliability --- treat them accordingly. Documentation & Knowledge Sharing --- Maintain accurate, up-to-date operational documentation --- procedures, architecture notes, incident timelines, and lessons learned. Share knowledge actively with your SRE colleagues and across the broader engineering team. A well-documented platform is a more reliable platform. What We're Looking For Must Have 2+ years of SRE, DevOps, or platform operations experience in a production environment --- with hands-on responsibility for monitoring, alerting, and incident response. Hands-on experience with observability tooling --- logging (ELK, Loki, Datadog, or equivalent), metrics (Prometheus, Datadog, or equivalent), and alerting. You have built dashboards and tuned alert rules, not just viewed them. Experience responding to production incidents --- triaging, containing, and resolving issues under pressure. You understand incident severity classification and escalation paths. Scripting skills in Bash and Python (or equivalent) --- for writing automation, operational tooling, and toil-reduction scripts. Solid understanding of cloud infrastructure on AWS and/or Azure --- compute, managed services, networking, and the platform-level health indicators you should be monitoring. Genuine care about reliability --- you understand why SLOs and error budgets matter, and you approach operational work with the discipline that high-availability financial services demand. Nice to Have Experience with distributed tracing --- Jaeger, OpenTelemetry, AWS X-Ray, or equivalent --- and using trace data to diagnose performance and reliability issues. Exposure to chaos engineering tools --- Chaos Monkey, Gremlin, or equivalent --- or experience running load and stress tests in production or pre-production environments. Familiarity with Kubernetes operational patterns --- pod health, cluster observability, resource constraints, and Kubernetes-native alerting and scaling behaviours. Experience in a regulated environment --- fintech, banking, or similar --- with an understanding of the uptime, audit, and compliance expectations financial services carry. AWS and/or Microsoft Azure certification --- SysOps, Cloud Practitioner, or equivalent entry-to-mid-level cloud certifications. Familiarity with DORA metrics and what they tell you about engineering team health and deployment risk.

2 months ago

Senior Cloud Engineer

Heirs Insurance Ltd

Lagos, nigeria

full-time

The Role As a Senior Cloud Engineer, you will be a hands-on builder of the cloud infrastructure that powers Africa's most ambitious digital banking platform. You will design, provision, and operate a dual-cloud environment across AWS and Azure, ensuring it is always on, highly secure, infinitely scalable, and built entirely in code. You will work closely with architects, DevSecOps engineers, and application teams to deliver infrastructure that meets the highest standards of performance, resilience, and security. What You'll Do Dual-Cloud Infrastructure: Design, provision, and maintain production-grade cloud infrastructure across both AWS and Azure, ensuring both environments mirror each other in architecture, connect reliably to the institution's on-premises Core Banking systems, and operate with no single point of vendor dependency. Infrastructure as Code: Define every environment, dev, staging, and production, in version-controlled IaC. Terraform, Ansible, and Bash are the approved tools for infrastructure provisioning and automation. No manual cloud provisioning. All environments must be reproducible, auditable, and spun up on demand. High Availability & Resilience: Architect and maintain highly available configurations across all services, databases, middleware, and storage, targeting 99.99% platform uptime. Implement circuit breakers, retry logic, auto-scaling, and graceful fallbacks so users never feel a backend failure. Private Networking & Zero Trust: Own the platform's private network architecture, ensuring every cloud environment is isolated, segmented, and built on the principle that no internal service is ever publicly reachable. Design and maintain the full private networking stack across AWS and Azure: VNets, dedicated subnets, NSGs, private DNS, and private endpoints for all managed services. Enforce zero-trust principles across all internal communication, no implicit trust, every request authenticated and authorised. Public internet exposure is limited strictly to approved entry points: Cloudflare DDoS, then WAF, then API Gateway. Auto-Scaling & Cost Efficiency: Own the platform's approach to scalability and cloud cost efficiency, ensuring infrastructure responds dynamically to demand and never carries unnecessary cost. Configure services to scale to zero at idle and scale out at peak without manual intervention. Continuously monitor and optimise cloud resource consumption, ensuring no environment is over-provisioned and every element of platform spend is lean and justified. Managed Services & Platform Stack: Provision and operate the platform's managed cloud services, including PostgreSQL (Azure Database for PostgreSQL, Amazon RDS/Aurora), Apache Cassandra (Azure Managed Instance, Amazon Keyspaces), Redis, RabbitMQ/Azure Service Bus/Amazon SQS, and Kong API Gateway. Secrets & Key Management: Manage all secrets, certificates, and encryption keys through Azure Key Vault, AWS Secrets Manager, or equivalent secrets management platform. Enforce rotation schedules. Ensure no credential is ever hardcoded in application code, configuration files, or container images. Security & Compliance: Implement and maintain cloud security controls, including AES-256 encryption at rest, TLS 1.2+ in transit, DLP monitoring for abnormal data transfer and unauthorised export, and alerting on policy changes or attempts to disable logging. Contribute to PCI DSS and CBN compliance posture. Observability: Instrument cloud infrastructure with centralised logging, metrics, and alerting from day one. Ensure every layer of the infrastructure stack is fully visible, no blind spots in production. CI/CD Integration: Integrate cloud infrastructure provisioning into DevSecOps pipelines, ensuring infrastructure changes flow through the same automated, security-gated pipelines as application code. What We're Looking For Must Have 5+ years of hands-on cloud engineering experience at scale, with production deployments on both AWS and Azure, including compute, networking, storage, managed databases, and messaging services. Expert-level Infrastructure as Code skills, Terraform, Ansible, and Bash, with a strong understanding of state management, module design, and CI/CD-integrated provisioning workflows. Deep experience designing and operating private, secure cloud network architectures, VNets, NSGs, private endpoints, private DNS, VPNs, and zero-trust network segmentation. Strong understanding of cloud security fundamentals, encryption (AES-256, TLS 1.2+), key management (Azure Key Vault, AWS KMS), identity and access management, and least-privilege access controls. Hands-on experience with containerised workloads, Docker, Kubernetes or equivalent orchestration platforms on managed cloud services (AKS, EKS), and serverless container platforms including Azure Container Apps and AWS App Runner / ECS Fargate. Working knowledge of high-availability patterns, multi-region deployments, auto-scaling, load balancing, circuit breakers, and disaster recovery design. AWS Certified Solutions Architect, Professional (SAP-C02), required. Nice to Have Microsoft Certified: Azure Solutions Architect Expert (AZ-305), strongly preferred as the platform expands to dual-cloud. Experience with serverless compute platforms, Azure Functions and/or AWS Lambda, for event-driven, lightweight processing workloads. Experience with the platform's managed services stack: Azure Database for PostgreSQL, Amazon RDS/Aurora, Azure Managed Instance for Apache Cassandra, Amazon Keyspaces, Azure Service Bus, Amazon SQS, or Redis. Familiarity with Cloudflare (DDoS protection, WAF) and API gateway configuration (Kong or equivalent). Experience in fintech, banking, or regulated cloud environments, with working knowledge of PCI DSS, CBN guidelines, or equivalent data residency and compliance requirements. Cloud cost management experience using FinOps tooling or native cloud cost monitoring and optimisation features.

3 months ago

Devsecops Evangelist

Heirs Holdings

Lagos, nigeria

full-time

The Role The DevSecOps Evangelist is the cultural and educational force behind this platform's engineering standards. Where the DevSecOps Engineers build and operate the pipelines, you make sure every engineer across every team understands, embraces, and actively applies the practices those pipelines enforce. You sit across all five delivery lanes Architect, Develop, Secure, Ship, and Support and your mandate is to make DevSecOps the instinct, not the instruction. This is a critical, cross-functional role for someone who is as technically credible as they are compelling. What You'll Do DevSecOps Culture & Strategy Own the platform's DevSecOps culture programme defining what engineering excellence looks like across security, quality, automation, and delivery speed, and building the strategy to embed it across every team. Work with the Platform Manager to align the culture programme with platform delivery goals and make DevSecOps the shared operating philosophy of the entire engineering organisation. Education & Enablement Design and deliver a continuous engineering enablement programme including workshops, onboarding sessions, lunch-and-learns, and hands-on labs that brings every engineer on the platform up to and beyond the DevSecOps standard. Partner closely with the DevSecOps Engineers to translate technical pipeline controls into accessible, actionable learning. No engineer should ever cite lack of knowledge as the reason a standard was missed. Standards Stewardship Own the platform's DevSecOps standards documentation maintaining it as a living, accessible, and authoritative reference for how engineering is done on this platform. Ensure documentation covers CI/CD pipeline usage, security gate requirements, IaC practices, container standards, secrets handling, and dev container setup. Make it clear, opinionated, and easy to follow. Pipeline & Tooling Adoption Drive active adoption of the platform's CI/CD tooling, security gates, AI-powered code review and testing agents, and developer environment standards across all engineering teams and contributors. Identify adoption gaps early, work with the DevSecOps Engineers to remove friction, and track adoption rates to ensure no team is operating outside the standard. Shift-Left Security Advocacy Champion the principle that security is everyone's responsibility and belongs at the beginning of every development conversation not the end. Run targeted security awareness initiatives across engineering teams. Work with the Platform Manager (Security) to translate security requirements into engineering habits, and ensure every contributor understands the security implications of the code they write. DORA Metrics & Maturity Tracking Track, baseline, and report on DevSecOps adoption and engineering maturity across the platform using DORA metrics (deployment frequency, lead time, change failure rate, MTTR) and qualitative signals from team engagement. Identify teams and practices that need targeted support and use data to demonstrate the impact of the culture programme over time. Community of Practice Build and run a DevSecOps community of practice across the engineering organisation creating the forums, rituals, and channels through which engineers share learnings, surface problems, celebrate wins, and continuously raise the standard together. Keep the community active, inclusive, and technically grounded. Innovation & Emerging Practices Continuously track the evolving DevSecOps landscape including AI-assisted development tools, emerging pipeline security standards, supply chain frameworks, and industry best practices. Identify and pilot innovations that could meaningfully raise the platform's engineering standards, and build the case for adoption where the evidence supports it. Cross-functional Influence Operate across all five delivery lanes Architect/Design, Develop, Secure, Ship, and Support building trust and credibility with every team on the platform. You are not a gatekeeper; you are a force multiplier. Your influence should make the teams around you faster, safer, and more confident in how they build. Executive Reporting Report regularly to the Platform Manager on the state of DevSecOps adoption, culture programme progress, maturity trends, and areas of concern. Provide clear, evidence-based narratives that allow leadership to understand where the platform's engineering culture is strong and where focused investment is needed. What We're Looking For Must Have 5+ years of experience in software engineering or DevSecOps, with a strong enough technical foundation to teach, guide, and credibly challenge engineers across architecture, cloud, pipelines, and security. Proven experience driving engineering culture change in a large, complex organisation shifting mindsets, embedding new practices, and sustaining adoption beyond initial rollout. Deep familiarity with CI/CD pipelines and DevSecOps tooling GitHub Actions, Azure DevOps Pipelines, GitLab CI, or Jenkins and the ability to explain them clearly to engineers at every level of experience. Strong working knowledge of shift-left security principles and the tooling that enforces them SAST, DAST, SCA, secrets detection, container scanning (Trivy), and dependency vulnerability management (Snyk). Excellent communication, facilitation, and teaching skills you can hold a room, run a workshop, write documentation that people actually read, and make complex technical concepts accessible without oversimplifying them. Hands-on experience with Infrastructure as Code (Terraform, Ansible, Bash), containerisation (Docker), and cloud-native development practices you must understand what you are evangelising. Nice to Have Experience with DORA metrics, DevOps maturity models, or engineering effectiveness frameworks and a track record of using data to demonstrate cultural and process improvement. Familiarity with AI-assisted development and testing tools including AI code review agents, AI-powered test generation, and their integration into CI/CD pipelines. Public presence in the DevSecOps or engineering community conference speaking, technical writing, open-source contributions, or community leadership. Experience in fintech, banking, or a regulated environment with an understanding of how compliance requirements shape engineering practice. AWS and/or Microsoft Azure certification any track relevant to cloud-native development or DevOps.

4 months ago

Senior Cloud Engineer

Heirs Holdings

Lagos, nigeria

full-time

The Role As a Senior Cloud Engineer, you will be a hands-on builder of the cloud infrastructure that powers Africa's most ambitious digital banking platform. You will design, provision, and operate a dual-cloud environment across AWS and Azure ensuring it is always on, highly secure, infinitely scalable, and built entirely in code. You will work closely with architects, DevSecOps engineers, and application teams to deliver infrastructure that meets the highest standards of performance, resilience, and security. What You'll Do Dual-Cloud Infrastructure Design, provision, and maintain production-grade cloud infrastructure across both AWS and Azure ensuring both environments mirror each other in architecture, connect reliably to the institution's on-premises Core Banking systems, and operate with no single point of vendor dependency. Infrastructure as Code Define every environment dev, staging, and production in version-controlled IaC. Terraform, Ansible, and Bash are the approved tools for infrastructure provisioning and automation. No manual cloud provisioning. All environments must be reproducible, auditable, and spun up on demand. High Availability & Resilience Architect and maintain highly available configurations across all services, databases, middleware, and storage targeting 99.99% platform uptime. Implement circuit breakers, retry logic, auto-scaling, and graceful fallbacks so users never feel a backend failure. Private Networking & Zero Trust Own the platform's private network architecture ensuring every cloud environment is isolated, segmented, and built on the principle that no internal service is ever publicly reachable. Design and maintain the full private networking stack across AWS and Azure: VNets, dedicated subnets, NSGs, private DNS, and private endpoints for all managed services. Enforce zero-trust principles across all internal communication no implicit trust, every request authenticated and authorised. Public internet exposure is limited strictly to approved entry points: Cloudflare DDoS WAF API Gateway. Auto-Scaling & Cost Efficiency Own the platform's approach to scalability and cloud cost efficiency ensuring infrastructure responds dynamically to demand and never carries unnecessary cost. Configure services to scale to zero at idle and scale out at peak without manual intervention. Continuously monitor and optimise cloud resource consumption ensuring no environment is over-provisioned and every element of platform spend is lean and justified. Managed Services & Platform Stack Provision and operate the platform's managed cloud services including PostgreSQL (Azure Database for PostgreSQL, Amazon RDS/Aurora), Apache Cassandra (Azure Managed Instance, Amazon Keyspaces), Redis, RabbitMQ/Azure Service Bus/Amazon SQS, and Kong API Gateway. Secrets & Key Management Manage all secrets, certificates, and encryption keys through Azure Key Vault, AWS Secrets Manager, or equivalent secrets management platform. Enforce rotation schedules. Ensure no credential is ever hardcoded in application code, configuration files, or container images. Security & Compliance Implement and maintain cloud security controls including AES-256 encryption at rest, TLS 1.2+ in transit, DLP monitoring for abnormal data transfer and unauthorised export, and alerting on policy changes or attempts to disable logging. Contribute to PCI DSS and CBN compliance posture. Observability Instrument cloud infrastructure with centralised logging, metrics, and alerting from day one. Ensure every layer of the infrastructure stack is fully visible no blind spots in production. CI/CD Integration Integrate cloud infrastructure provisioning into DevSecOps pipelines ensuring infrastructure changes flow through the same automated, security-gated pipelines as application code. What We're Looking For Must Have 5+ years of hands-on cloud engineering experience at scale, with production deployments on both AWS and Azure including compute, networking, storage, managed databases, and messaging services. Expert-level Infrastructure as Code skills Terraform, Ansible, and Bash, with a strong understanding of state management, module design, and CI/CD-integrated provisioning workflows. Deep experience designing and operating private, secure cloud network architectures VNets, NSGs, private endpoints, private DNS, VPNs, and zero-trust network segmentation. Strong understanding of cloud security fundamentals encryption (AES-256, TLS 1.2+), key management (Azure Key Vault, AWS KMS), identity and access management, and least-privilege access controls. Hands-on experience with containerised workloads Docker, Kubernetes or equivalent orchestration platforms on managed cloud services (AKS, EKS), and serverless container platforms including Azure Container Apps and AWS App Runner / ECS Fargate. Working knowledge of high-availability patterns multi-region deployments, auto-scaling, load balancing, circuit breakers, and disaster recovery design. AWS Certified Solutions Architect - Professional (SAP-C02) required. Nice to Have Microsoft Certified: Azure Solutions Architect Expert (AZ-305) strongly preferred as the platform expands to dual-cloud. Experience with serverless compute platforms Azure Functions and/or AWS Lambda for event-driven, lightweight processing workloads. Experience with the platform's managed services stack: Azure Database for PostgreSQL, Amazon RDS/Aurora, Azure Managed Instance for Apache Cassandra, Amazon Keyspaces, Azure Service Bus, Amazon SQS, or Redis. Familiarity with Cloudflare (DDoS protection, WAF) and API gateway configuration (Kong or equivalent). Experience in fintech, banking, or regulated cloud environments with working knowledge of PCI DSS, CBN guidelines, or equivalent data residency and compliance requirements. Cloud cost management experience using FinOps tooling or native cloud cost monitoring and optimisation features.

4 months ago

Senior Network & Security Engineer

Heirs Holdings

Lagos, nigeria

full-time

The Role As Senior Network & Security Engineer, you will design, build, and operate the network and security architecture that keeps this platform private, resilient, and impenetrable. You will own the platform's private cloud networking, zero-trust enforcement, perimeter security controls, and network-level threat monitoring working closely with the Platform Manager and Platform Manager (Security) to ensure that every layer of the network is hardened, observable, and compliant. On a banking platform built for continental scale, the network is the first line of defence and you own it. What You'll Do Network Architecture Design and own the platform's end-to-end network architecture defining the topology, segmentation model, and connectivity principles that govern how AWS, Azure, and on-premises environments interrelate and how traffic flows securely across all of them. Translate architectural decisions into a clean, scalable IP addressing strategy: plan and allocate CIDR blocks across both clouds with no overlapping ranges, room to grow, and dedicated subnets for containers, servers, storage, and management. Front and backend assets must be cleanly separated at the network layer. No internal service is ever publicly addressable. All architecture decisions must be documented, reviewed as the platform scales, and reflected in version-controlled infrastructure code. Network Engineering Own the hands-on engineering and operation of the platform's network infrastructure across cloud and on-premises environments including routing configuration, switching, firewall policy management, VPN setup, and on-premises edge device configuration (FortiGate, Cisco Nexus 9000). All network infrastructure must be written as clean, well-structured, and peer-reviewed code using Terraform, Ansible, and Bash covering VNets, subnets, NSGs, routing rules, firewall policies, and VPN gateways. All configurations must be version-controlled and stored in the central repository. No network change may ever be applied manually to any environment. Integrate network security checks into CI/CD pipelines and work with DevSecOps engineers to ensure no environment is ever provisioned with misconfigured or insecure network settings. Zero Trust Enforcement Implement and enforce zero-trust principles across the entire platform no implicit trust anywhere. Every request must be authenticated, authorised, and logged. Every network path must be explicitly permitted; everything else is denied by default. Continuously identify and close trust gaps across all environments. Perimeter & Firewall Security Own and operate the platform's security boundaries from the outermost perimeter to internal network segmentation. Externally: the only permitted internet entry point is Cloudflare DDoS protection WAF API Gateway; ensure DDoS rules, WAF policies, and API Gateway configurations are current, tested, and enforced as code. Internally: own all firewall and NSG rules across cloud and on-premises environments all policies must be defined exclusively via Infrastructure as Code, version-controlled, and subject to regular rule reviews to eliminate unnecessary access paths and enforce least-privilege networking. No manual firewall or NSG change is ever permitted. Cloud Network Security & Encryption Configure and maintain cloud-native network security controls across AWS and Azure including Security Groups, Network ACLs, AWS Network Firewall, and Azure Firewall. Ensure no cloud storage, database, or service is ever inadvertently exposed to the public internet. Enforce TLS 1.2+ across all services and connections in transit TLS 1.0 and 1.1 are prohibited. Own the certificate lifecycle provisioning, renewal, rotation, and revocation ensuring no expired or weak certificate ever reaches production. Hybrid & Site-to-Site Connectivity Design, implement, and maintain highly available, redundant connectivity between the platform's cloud environments and on-premises data centres using AWS Direct Connect, Azure ExpressRoute, and IPSec VPN Gateways as appropriate. Ensure failover paths are in place, tested, and documented so that loss of any single link does not interrupt connectivity to core banking systems. All site-to-site links must be encrypted, monitored, and governed as code. VPN & Admin Access Controls Design and operate the platform's JumpNet and VPN infrastructure the only permitted route for admin access to production environments. No exceptions. Enforce MFA on all VPN access and ensure all privileged sessions are logged and monitored. Global Traffic Management Design and operate the platform's global traffic management layer ensuring user traffic is intelligently distributed across AWS and Azure based on latency, availability, and health. Implement and maintain AWS Route 53 / Global Accelerator and Azure Traffic Manager / Front Door to route users seamlessly between clouds, with automatic failover when either environment degrades. Ensure no single cloud environment is a single point of failure for end-user traffic. Threat Detection & Network Monitoring Design, implement, and operate the platform's centralised network monitoring and threat detection infrastructure providing real-time visibility into device health, link utilisation, traffic flows, and anomalies across both cloud and on-premises environments. Working closely with the Platform Manager and Platform Manager (Security), implement IDS/IPS, anomaly detection, and traffic analysis tooling. Ensure all network telemetry feeds into the SIEM with alerting tuned for abnormal traffic volumes, lateral movement, port scanning, unauthorised connections, and attempts to bypass network controls or disable logging. No network event goes undetected or unacted upon. Incident Response Act as the first responder for network-level security incidents including containment, isolation, forensic evidence preservation, and root cause analysis. Contribute to the platform's Incident Response Plan and ensure network runbooks are documented, tested, and current. Documentation & Asset Management Maintain accurate, up-to-date network design documentation at all times. Own a centralised, version-controlled inventory of all core network assets including device configurations, IP allocations, CIDR assignments, VLAN maps, and topology diagrams. All infrastructure code and key network documentation must live in a central, secure, version-controlled repository always current, always accessible, and ready for audit or incident response at any time. What We're Looking For Must Have 5+ years of hands-on network and security engineering experience in a cloud-native production environment with demonstrated ownership of private network architecture, zero-trust implementation, and perimeter security at scale. Expert-level knowledge of cloud networking on AWS and/or Azure VNets, subnets, NSGs, Security Groups, Network ACLs, private endpoints, private DNS, VPN Gateways, and Transit Gateways. Hands-on experience with perimeter security tooling Cloudflare (DDoS, WAF), API Gateway configuration (Kong or equivalent), and web application firewall rule management. Strong working knowledge of zero-trust architecture identity-aware proxies, microsegmentation, least-privilege network access, and continuous verification principles. Proven experience with network threat detection and monitoring IDS/IPS, SIEM integration, anomaly detection, and network forensics. Expert-level knowledge of routing and switching protocols BGP, OSPF, EIGRP, spanning tree, and VLAN trunking and firewall and security concepts at depth. This is non-negotiable given the complexity of the platform's hybrid connectivity, site-to-site tunnels, and on-premises edge device configuration requirements. Hands-on experience configuring and managing enterprise firewall and core switching platforms specifically Fortinet FortiGate and Cisco Nexus 9000 series. The platform's on-premises core network runs these devices and this engineer will be expected to configure and manage them directly. Solid Infrastructure as Code skills Terraform, Ansible, and Bash with a clear understanding that all network security controls must be version-controlled and never manually provisioned. Active CCNP Security or CCNP Enterprise certification or a recognised equivalent. Professional-level routing, switching, and security credentials are required given the hybrid connectivity and on-premises edge responsibilities of this role. Nice to Have Fortinet NSE 4 or NSE 5 certification relevant given the FortiGate firewall estate. AWS Certified Security - Specialty and/or Microsoft Certified: Azure Network Engineer Associate (AZ-700). Experience with container network security Kubernetes network policies, service mesh (Istio or equivalent), and east-west traffic control. Hands-on experience with network security in regulated financial services environments PCI DSS network segmentation requirements, CBN guidelines, or equivalent. Familiarity with SIEM platforms (Splunk, Microsoft Sentinel, or equivalent) and experience writing detection rules or correlation queries for network-based threats.

4 months ago