GNI994 Network Security Lead

Description

• Design and maintain network security architecture (perimeter, DMZ, partner/B2B, datacentre, OTadjacent), including segmentation and microsegmentation patterns aligned to Zero Trust principles.
• Define rule base strategy (AppID/identityaware policies, service groups, objects, tags) to minimise overprivilege and shadowed/duplicate rules.
• Plan, schedule, and execute timely patching and firmware updates for all firewall and network security appliances, in line with vendor and organisational SLAs.
• Provide daytoday mentorship to junior analysts (design reviews, change walkthroughs, quality gates) while partnering with architects, project teams, and OT stakeholders (e.g., Claroty, DarkTrace) to respect safety/availability constraints.
• Run the endtoend policy lifecycle: intake/impact analysis, risk assessment, change plans and rollbacks, peer review, CAB approvals, and postimplementation validation.
• Engineer secure northsouth and eastwest paths for Azure and other cloud environments (e.g., Azure Firewall, vNGFWs, NSGs/ASGs, Private Link, ExpressRoute).
• Coordinate and execute vulnerability scans (e.g., Qualys TVM) for firewall and network security infrastructure; track, remediate, and report on vulnerabilities in collaboration with asset owners.
• Standardise cloud landingzone security controls and ensure consistent policy across onprem and cloud.
• Continuously monitor firewall and network security health, resource utilisation (CPU, memory, throughput, session counts), and performance metrics; proactively address capacity or degradation issues.
• Ensure comprehensive logging to SIEM (e.g., Microsoft Sentinel) with highfidelity alerts and runbooks/SOAR where appropriate.
• Own NAT, routing interactions (static, dynamic/BGP), and HA/cluster designs ensuring resilience and deterministic failover.
• Plan and govern TLS/SSL decryption policies and privacy exceptions; align with legal and compliance requirements.
• Ensure regular, tested backups of firewall and network security device configurations; maintain documented restore procedures and participate in periodic recovery drills.
• Participate in audits; provide accurate evidence of control design and effectiveness.
• Lead firewall aspects of incident triage/containment (rapid policy updates, network isolation, temporary blocks), contribute to RCA, and convert lessons into durable policy/detections.
• Lead scheduled rule recertification and hygiene: remove unused, expired, or risky entries; consolidate objects; enforce naming conventions and tagging.
• Maintain golden configs and standard builds; drive PANOS / Check Point upgrade roadmaps, including lab validation and staged rollouts.
• Troubleshoot complex flows endtoend (PCAP/Wireshark, session tables, threat logs, QoS, path MTU, asymmetric routing).
• Scope and oversee penetration tests/redteam exercises targeting network controls; ensure highvalue findings and pragmatic fixes; manage retests to closure.
• Administer and optimise nextgen firewall platforms (e.g., Palo Alto, Check Point) and related proxies/IDPS/PKI/authentication controls.
• Maintain and test remote access VPN and sitetosite VPNs; govern posture checks and identity context.

Requirements

Incident Response Integration

• Strong grasp of routing/NAT/VPN, HA clustering, BGP/ECMP, DNS, certificates/PKI, and identityaware policy.
• Familiarity with automation/IaC (API, Ansible/Terraform) and policy hygiene tooling (e.g., Expedition) is a plus.
• Degree in Information Systems/IT or equivalent experience; 5+ years IT with 3+ years in network security/firewall engineering (design, build, run).
• Experience operating in Azure and hybrid topologies; understanding of cloud networking controls (Azure Firewall, NSGs/ASGs).
• Deep handson with Palo Alto (PANOS, Panorama, AppID, UserID, URL/Threat profiles, decryption) and/or Check Point (R8x, SmartConsole/Smart1, IPS, Identity Awareness).
• Solid troubleshooting (packet capture, log correlation, path analysis) and SIEM integration (e.g., Microsoft Sentinel).
• Collaboration and communication skills to explain complex network security topics to technical and nontechnical stakeholders; experience mentoring junior team members.

Benefits

Cloud & Hybrid Connectivity

**Cork or Dublin based** Permanent role ** Hybrid -2 days office **

Training + Development

Interview process

Visa Sponsorship

Security clearance