Midrand, South Africa | Hybrid | Salary: Negotiable + bonus + benefits | Senior Specialist (L3)
Primary Purpose of the Role
- Network security architecture and engineering
- Firewall and secure connectivity strategy
- Network threat detection and response
- Perimeter and internal network hardening
- Technical leadership and mentoring
We are seeking an experienced Senior Network Security Engineer to join the Security Operations and Engineering team. You will own the design, implementation and continuous improvement of secure network environments, act as the technical authority on network security, and guide the Intermediate Specialists who support day-to-day operations.
The ideal candidate has deep, hands-on experience with enterprise firewalls, VPN and Zero Trust architectures, IDS/IPS and network monitoring, and a strong grasp of network-based threat detection and mitigation. You can design solutions as well as run them, and you can lead complex incidents.
You will work closely with:
- Security Operations (SOC)
- Infrastructure teams
- Cloud and endpoint teams
- Client stakeholders and technical leadership
The role requires a proactive, ownership-driven mindset to:
- Define and strengthen network security posture
- Improve detection capabilities and reduce risk
- Lead incident response for network-related events
- Ensure stable, secure and scalable network services
Key Responsibilities
Network Security Architecture & Engineering
- Design, deploy and manage enterprise firewall platforms (Fortinet, Palo Alto, Cisco ASA/Firepower), including HA, upgrades and migrations
- Architect and maintain:
- Network segmentation and micro-segmentation models
- Access control policies and rulebase governance
- NAT, dynamic routing and secure rulesets
- IPSec and site-to-site connectivity at scale
- Own IDS/IPS strategy: deployment, tuning and continuous optimisation to improve fidelity and reduce false positives
- Review and approve network security designs, and provide security input on new projects and solutions
- Evaluate and recommend security tooling and vendors, and contribute to the network security roadmap
Threat Detection & Monitoring
- Partner with the SOC to design, test and improve detection logic and alert tuning
- Analyse network telemetry (flow data, firewall, IDS/IPS and DNS logs) to identify threats and anomalous behaviour
- Support proactive threat hunting using network data sources
- Drive recommendations that close detection gaps
Secure Connectivity & Access
- Design and maintain secure VPN solutions (site-to-site and remote access)
- Lead the implementation of Zero Trust principles, including ZTNA and SASE-aligned approaches where applicable
- Define and enforce secure remote access standards and policies
- Resolve complex connectivity, latency and performance issues with security implications
Network Infrastructure Security
- Define and enforce secure baseline configurations for switches, routers and wireless networks
- Govern firmware and patch compliance, and manage vulnerability remediation for network assets
- Enforce secure protocols (SSH, HTTPS, SNMPv3) and strong management-plane controls
- Design and secure cloud network environments (NSGs / Security Groups, routing controls, hybrid connectivity) across Azure and/or AWS
Automation & Continuous Improvement
- Automate configuration, compliance checks and routine tasks (e.g. Python, Ansible, Terraform, vendor APIs)
- Introduce standards, templates and repeatable build patterns to improve consistency and reduce operational risk
Incident Response & Escalation
- Act as L3 escalation point for complex network security incidents
- Lead triage, containment and recovery for network-related incidents and breaches
- Perform root cause analysis on incidents and firewall or network misconfigurations, and drive remediation and lessons learned
- Contribute to incident response playbooks and post-incident reviews
Leadership & Mentoring
- Mentor and coach L1/L2 engineers, review their work and support their development
- Provide technical guidance to the wider team and act as a subject matter expert for clients and internal stakeholders
- Translate technical risk into clear, business-relevant communication for non-technical audiences
Governance, Documentation & Operations
- Own network diagrams, firewall rule documentation, SOPs and playbooks, and ensure they stay current
- Lead and participate in change management, audits, reviews and rulebase clean-ups
- Ensure configurations align with security policies and compliance frameworks (CIS, NIST, ISO 27001)
Required Experience and Skills
- 5–8 years in network security engineering, including at least 2 years in a senior or lead technical capacity
- Proven, hands-on expertise with enterprise firewalls (Fortinet, Palo Alto, Cisco or similar), VPN technologies and IDS/IPS in complex, multi-site or multi-tenant environments
- Deep understanding of TCP/IP, DNS, dynamic routing (BGP/OSPF) and network protocols
- Demonstrated experience designing network security architectures and leading incident response
- Experience with scripting or automation for network and security tasks
- Relevant certifications (any of):
- Fortinet NSE 7 / NSE 8
- Palo Alto PCNSE
- Cisco CCNP Security / CCIE Security
- CISSP, CISM or equivalent
- CompTIA Security+ / Network+ (baseline)
Nice-to-Have
- Experience with Microsoft Sentinel or other SIEM platforms
- Strong cloud networking experience (Azure / AWS), including hybrid connectivity
- Exposure to web proxies, email security gateways, WAFs, ZTNA and SASE platforms
- Experience in an MSSP or multi-client environment
- Infrastructure-as-code experience
Personal Attributes
- Security-minded, detail-oriented and architecturally minded
- Strong analytical and problem-solving ability under pressure
- Excellent communicator across technical and non-technical audiences
- Self-driven, accountable and comfortable owning outcomes
- Enjoys mentoring and raising the standard of the team
- Able to work in hybrid/remote environments
What They Offer
- Market-related salary package
- Annual performance bonus
- Discovery Medical Aid contribution
- 4% company provident fund contribution
- 20 days annual leave
- Paid public holidays
- Family responsibility leave
- Structured career development, including pathways into architecture or technical leadership
- Exposure to enterprise-scale cyber security environments
- Opportunity to work with some of the industry's leading cyber security specialists
- A collaborative, people-first culture within an award-winning global MSSP