Security Engineer – Network & Infrastructure Security

This is a fully remote position, open to applicants in Canada.

📋 Description

• Establish and uphold enterprise security standards, reference architectures, and configuration baselines for next-generation firewalls, intrusion prevention and detection systems, web filtering, TLS inspection, and secure web gateways; evaluate client network designs and implementations.

• Evaluate security requirements, offer technical recommendations, communicate risks, and guide security architecture and implementation choices with client stakeholders.

• Set and assess security standards for VPN and Zero Trust Network Access (ZTNA) solutions, including Palo Alto GlobalProtect.

• Create standards for PKI, certificate authority governance, cryptographic key management, and certificate lifecycle operations; identify opportunities for automation.

• Define security requirements for enterprise and cloud DNS architectures, comprising protective DNS filtering, DNSSEC, split-horizon DNS, and centralized logging.

• Develop and evaluate segmentation strategies and Zero Trust architectures across corporate networks, retail environments, PCI zones, IoT/OT environments, and third-party connections.

• Define and validate hardening standards for Windows and Linux servers, containers, hypervisors, and network appliances utilizing CIS Benchmarks and automated compliance tools.

• Investigate network security incidents, connectivity problems, and remote access failures; perform root-cause analysis and coordinate remediation efforts.

• Ensure network, DNS, proxy, endpoint, and identity telemetry is integrated into SIEM platforms; enhance visibility, detection, and investigation capabilities.

• Review firewall modifications, network designs, infrastructure requests, and security exceptions for risk and compliance; advocate for least-privilege access and security governance.

• Create scripts, tools, and workflows using Python, PowerShell, Bash, or similar technologies to automate security compliance assessments, firewall rule reviews, configuration validation, and posture reporting.

• Assess controls against CIS Benchmarks, NIST Cybersecurity Framework, and PCI DSS; document findings, recommend remediation, and communicate progress.

• Enhance enterprise security architecture, minimize infrastructure exposure, standardize controls, and embed secure-by-design principles into engineering processes.

⛳️ Requirements

• 4–6 years of experience in IT or cybersecurity, including a minimum of 3 years in network security or infrastructure security engineering, architecture, or advisory roles.

• Practical experience with enterprise firewall and secure access technologies such as Palo Alto, Fortinet, Cisco, or Zscaler.

• Strong foundation in networking fundamentals and protocols, including TCP/IP, routing and switching, VLANs, DNS, DHCP, NAT, VPN, and TLS, with the ability to perform packet-level analysis.

• Working knowledge of PKI, certificate lifecycle management, enterprise DNS security, and cryptographic key management.

• Hands-on experience with Windows and Linux server hardening, privileged access management, vulnerability remediation, and infrastructure security controls.

• Familiarity with endpoint detection and response (EDR) platforms, such as CrowdStrike, and SIEM technologies and query languages, like KQL or SPL.

• Knowledge of security frameworks and compliance standards, including CIS Benchmarks, NIST CSF, and PCI DSS.

• Experience in scripting or automation using Python, PowerShell, Bash, or similar languages to support security assurance, compliance validation, and reporting.

• Background in assessing security architecture, reviewing technical designs, documenting standards, and providing actionable security recommendations.

• Excellent communication and stakeholder management abilities, with the capacity to engage directly with clients, articulate technical risks, and influence engineering decisions.

• A consultative, collaborative approach to problem-solving, with the capability to balance security requirements, operational constraints, and business priorities.

• Ability to work independently, manage competing priorities, and propel security initiatives through assessment, recommendation, and remediation.

• Experience in securing cloud network infrastructure and logging services across AWS, Microsoft Azure, or Google Cloud Platform (GCP).

• Familiarity with automated certificate management solutions, such as ACME or Venafi, and protective DNS platforms, such as Infoblox or Cloudflare.

• Experience with Infrastructure as Code (IaC) tools, including Terraform or Ansible, and integrating security guardrails into CI/CD pipelines.

• Experience securing distributed enterprise environments, retail edge infrastructure, or IoT/OT networks.

• Working knowledge of compliance requirements such as PCI DSS and SOX.

• Familiarity with IT service management and change management platforms, such as Jira Service Management or ServiceNow.

• Relevant security certifications, including CompTIA Security+, Network+, PCNSE, CCNP Security, AWS or Azure Security certifications, or GIAC credentials.

🏝️ Benefits

• Comprehensive health and wellness programs.

• Opportunities for professional development and continuous learning.

• Flexible work hours and remote work options.

• A collaborative and inclusive work environment.

• Competitive salary and performance-based incentives.