Network Security Engineer – Deployment and Support

About the Job As 'Network Security Engineer – Deployment and Support' within our Digital Technology Service Quality team, you will build, deploy, and support the network security estate that protects Sanofi's enterprise — firewalls across Cisco ASA and FTD, Fortinet FortiGate, and Juniper SRX, Web Application Firewalls, DDoS protection, VPNs, and the Zscaler cloud security platform. You will deploy security infrastructure and policy as code using Terraform, Ansible, and Python wherever the platform allows, and apply the same engineering rigour where it does not. You will own what you deploy — from policy definition and automated pre-change validation through to day-two operations, rule lifecycle hygiene, and incident response — ensuring our network security posture remains accurate, auditable, and resilient. Ready to get started? Our Team Digital Technology – Service Quality is at the heart of Sanofi's digital transformation. We deliver secure, resilient, and scalable infrastructure services that power business-critical applications and enable thousands of users across the enterprise. Our network security engineering team sits at the boundary of every service we run — enforcing segmentation, controlling access, and giving our security operations colleagues the visibility they need. Our team combines modern cloud platforms, automation-first engineering, and service excellence to support Sanofi's mission of chasing the miracles of science. About Sanofi We're an R&D-driven, AI-powered biopharma company committed to improving people's lives and delivering compelling growth. Our deep understanding of the immune system – and innovative pipeline – enables us to invent medicines and vaccines that treat and protect millions of people around the world. Together, we chase the miracles of science to improve people's lives. Main Responsibilities Network Security Deployment – Infrastructure and Policy as Code • Deploy cloud network security infrastructure as code using Terraform, provisioning security groups and network security groups, cloud-native firewall and WAF policy, route tables, private connectivity, and inspection architectures across AWS and Azure, with reusable modules, remote state management, and plan review built into the change process • Deploy and maintain firewall and network security configuration as code using Ansible, building reusable roles and templates for Cisco ASA and FTD, Fortinet FortiOS, and Juniper SRX so that every change is repeatable, version-controlled, and auditable • Automate security provisioning and operational tasks in Python, consuming platform APIs — Junos Space for SRX estate management, Cisco APIC for ACI contract and microsegmentation policy, FortiGate and FortiAnalyzer APIs, Zscaler APIs, and F5, Array, and AVI load balancer and WAF APIs • Automate vendor web consoles and portals that expose no usable API using Selenium, so that licensing, reporting, and legacy management interfaces do not force manual work • Use Gemini CLI as an AI agent within the engineering workflow to accelerate policy review, triage large firewall log and packet-capture data sets, summarise rule-base findings, draft runbooks and knowledge articles, and scaffold Ansible and Python automation • Maintain Git as the source of truth for network security configuration, with golden configuration templates, peer-reviewed changes, and a full version-controlled audit trail of every policy change • Operate deployment pipelines for network security change, including automated pre-change validation, policy risk and compliance checks using AlgoSec, and automated post-deployment verification of traffic flow and policy hit behaviour • Implement configuration drift detection and automated remediation, so deployed security policy provably matches its declared intent • Codify security baselines and standards — hardening, zoning, naming, and device software targets — and gate deployments against them • Integrate the firewall rule request lifecycle with ServiceNow, so approved requests flow into validated, automated deployment rather than manual console work Network Security Deployment – Engineering Delivery • Build and deploy network security configuration items (CIs) — firewalls, VPN concentrators, WAF and load balancer platforms, and DDoS protection services — from initial requirement through to validated production handover • Deliver deployments to enterprise sites, manufacturing sites, and on-premises data centres, including physical installation, cabling, high-availability pairing, licensing, and firmware qualification where automation is not available • Deliver hardware refresh, end-of-life replacement, and software upgrade campaigns across Cisco ASA/FTD, FortiOS, and Junos SRX platforms • Execute controlled environment promotion (Dev to Pre-Prod to Production) with documented rollback and recovery plans for every change • Register all deployed network security CIs in the CMDB with correct class, attributes, relationships, ownership, location, and lifecycle status at point of deployment • Configure and maintain network discovery and SNMP so security CIs are correctly classified with accurate serial numbers, models, and discovery-source behaviour • Onboard every newly deployed CI into monitoring, alerting, log forwarding, configuration backup, patching, and vulnerability tooling before production sign-off • Produce and maintain as-built documentation, network security diagrams, runbooks, and knowledge articles for all deployed infrastructure Firewall and Policy Engineering • Deploy, configure, and support enterprise firewalls across Cisco ASA and FTD, Fortinet FortiGate running FortiOS, and Juniper SRX platforms • Design and implement firewall policy to least-privilege principles, using application-aware, user-aware, and identity-based rules rather than broad address-based permits • Own the full firewall rule lifecycle — request, validation, implementation, recertification, and decommissioning — driving down rule count, shadowed and redundant rules, overly permissive any-any rules, and unused objects • Operate AlgoSec for policy analysis, change risk assessment, rule-base optimisation, compliance reporting, and evidencing rule recertification to auditors • Use FortiAnalyzer for centralised Fortinet logging, reporting, and forensic review of policy and threat events • Implement and tune threat prevention capabilities — IPS, anti-malware, URL filtering, and TLS inspection — balancing security efficacy against application impact • Manage firewall estate configuration centrally, using Junos Space for Juniper SRX and native management platforms for Cisco and Fortinet devices Segmentation, Zoning and Microsegmentation • Implement and maintain network zones, VLANs, VRF separation, and segmentation in line with security architecture and enterprise zoning standards • Deliver data centre microsegmentation using Cisco ACI contracts and endpoint group policy configured through Cisco APIC • Implement east-west controls across data centre, cloud, and OT or manufacturing environments, working to a zero-trust target architecture • Segregate and protect manufacturing, laboratory, and OT networks, respecting the availability and validation constraints of regulated production environments • Validate segmentation effectiveness through testing and traffic analysis rather than assuming policy intent equals enforced reality VPN, Secure Access and Cloud Security Platform • Deploy and support remote access services — SSL VPN and IPSec VPN, and identity-integrated access with multi-factor authentication — at enterprise scale • Deploy and support site-to-site IPSec connectivity, including tunnel design, encryption standards, rekeying, and failover behaviour • Deploy and support the Zscaler cloud security platform, including secure web gateway and private access policy, traffic forwarding and steering, SSL inspection, and user and location configuration • Support SD-WAN security posture across Palo Alto Prisma SD-WAN (CloudGenix) and FatPipe platforms, including secure overlay design and policy enforcement at the edge • Support secure connectivity for cloud workloads on AWS and Azure, including security groups and network security groups, cloud-native firewalling, private connectivity, and inspection architectures, provisioned and maintained through Terraform Web Application Firewall, Load Balancing and DDoS Protection • Deploy and support Web Application Firewall capability on F5, Array, and AVI platforms, including policy creation, tuning, and false-positive management • Deploy and support load balancing security configuration — virtual servers, pools, health monitors, SSL offload, and certificate lifecycle • Implement and support DDoS protection services at the internet edge, including mitigation policy, thresholds, and activation runbooks • Support application onboarding from a security perspective — traffic flow validation, rule requirements, name resolution, and certificate provisioning • Manage certificates, keys, and secrets used by network security platforms through enterprise PKI and key vault services, ensuring timely renewal and no untracked expiry Operational Support, Incident and Problem Management • Manage Move to Production processes for deployed CIs, ensuring proper handover to operational support teams and that all required GxP documentation is maintained • Provide L2/L3 operational support for all deployed network security CIs, working closely with managed-service partners • Participate in an on-call rotation, responding to network security incidents outside business hours • Diagnose and resolve incidents where security policy is a suspected cause — blocked applications, asymmetric routing through inspection points, IPSec and SSL VPN failures, certificate and TLS errors, and Zscaler forwarding faults — using Wireshark and NetScout for packet-level evidence • Drive down mean time to recovery (MTTR) through structured troubleshooting, runbooks, and automation • Act as technical escalation during Major Incidents, joining technical bridges and providing hands-on recovery and clear technical status updates • Support the Security Operations Centre and incident response teams during active security events, delivering rapid containment actions such as blocks, isolation, and emergency policy changes under controlled process • Contribute to Root Cause Analysis for recurring and high-impact issues, raising Problem records and driving corrective and preventive actions to closure • Maintain high-quality incident resolution notes and knowledge articles to support first-line resolution and data-quality targets Change and Release Execution • Raise, plan, and execute network security changes with complete risk assessment, implementation plans, test evidence, and rollback procedures • Represent network security changes at the Change Advisory Board (CAB), providing technical justification, impact analysis, and dependency detail drawn from CMDB service topology • Actively reduce change-induced incidents through peer review, automated validation, staged rollout, and disciplined post-implementation verification • Schedule and coordinate deployment windows with application, business, and vendor stakeholders to minimise disruption • Operate emergency change process for urgent security containment without compromising traceability or approval integrity Observability, Logging and AIOps • Onboard network security CIs into monitoring and observability platforms with meaningful metrics, logs, events, and synthetic checks • Ensure complete and reliable log forwarding from all security platforms to SIEM, using FortiAnalyzer and native platform logging, and validate parsing, field mapping, and coverage so detection content is not blind • Use NetScout for service-level and packet-level visibility across inspection points, proving whether a security control is implicated in a performance problem • Define alert thresholds and reduce alert noise so alerts are actionable and correctly routed • Build operational dashboards providing clear visibility of network security health, policy compliance, tunnel and gateway availability, and deployment quality • Support AIOps adoption — anomaly detection, event correlation, service-impact analysis, and predictive insight — including AI-assisted triage of security telemetry using Gemini CLI and Python tooling Security, Compliance and Resilience • Deploy and operate all network security infrastructure in line with enterprise security architecture, hardening baselines, and least-privilege access principles • Meet patch compliance and vulnerability remediation SLAs across all supported CIs, including Cisco ASA/FTD, FortiOS, and Junos software currency, with evidenced closure • Remediate findings from penetration tests, security assessments, segmentation validation, and internal audit within agreed timeframes • Configure and support high availability and failover for all security enforcement points, ensuring no single control becomes a single point of failure • Maintain configuration backup and rapid device recovery capability, and test restoration rather than assuming it • Maintain audit-ready evidence of policy, configuration, and change history for regulated and GxP-relevant environments Collaboration, Vendor Coordination and Continuous Improvement • Partner with Enterprise Architecture, Cyber Security, Cloud Engineering, Network Engineering, and Application and Product teams to ensure operational readiness of new platforms and technologies • Translate security architecture and policy standards into deployable, supportable configuration, pushing back constructively where a standard is not operable • Coordinate technical delivery governance with managed-service partners and vendors, validating the quality of delivered work against standards and SLAs, and ensuring meaningful, timely measurement of vendor support using KPIs Key Performance Indicators Deployment • Deployment success rate and lead time, from request to validated production • Automation coverage — proportion of security infrastructure and configuration deployed via Terraform, Ansible, Python, and API automation rather than manual console change • Firewall rule request turnaround time, and proportion fulfilled through the automated pipeline • First-time-right deployment rate; rework and rollback frequency • Configuration drift rate and time to remediate detected drift • CI data quality at handover — completeness, correctness, non-orphan, and non-stale on newly deployed CIs • Monitoring, log-forwarding, configuration backup, and patching onboarding coverage achieved at production sign-off Support • MTTR for supported network security CIs; incident backlog and ageing • Change success rate and change-induced incident rate • Recurring incident rate and Problem closure effectiveness • Software currency across Cisco ASA/FTD, FortiOS, and Junos; patch compliance and vulnerability remediation within SLA • Policy hygiene — reduction in overly permissive, shadowed, redundant, and unused rules; rule recertification completed on schedule, evidenced through AlgoSec • Segmentation and zoning compliance, with audit and penetration-test findings closed within agreed timeframes • SIEM log coverage and integrity across all security platforms • Availability of security enforcement points, including VPN, WAF, and inspection services • DDoS mitigation readiness and activation effectiveness • CMDB data-quality KPIs for owned CI classes, including discovery coverage and staleness • Automation and self-healing adoption; measured manual-effort reduction • Resolution note quality and knowledge-article contribution About You Experience • Substantial hands-on experience deploying and supporting enterprise network security infrastructure in large-scale, global, multi-vendor environments • Demonstrable depth in firewall and segmentation engineering, with working knowledge across VPN, cloud security platforms, WAF, and DDoS protection • Practical experience automating network security deployment and configuration with Terraform, Ansible, Python, and vendor APIs • Experience in a regulated industry — pharmaceutical, life sciences, or comparable — is an advantage Technical Skills – Firewalls and Policy • Hands-on experience with at least two of Cisco ASA/FTD, Fortinet FortiGate (FortiOS), and Juniper SRX • Centralised firewall estate management, including Junos Space for Juniper SRX and native Cisco and Fortinet management platforms • Application-aware and identity-based policy design to least-privilege principles • AlgoSec for policy analysis, change risk assessment, rule-base optimisation, and compliance reporting • FortiAnalyzer for centralised logging, reporting, and forensic review • Threat prevention configuration and tuning — IPS, anti-malware, URL filtering, and TLS inspection Technical Skills – Segmentation and SDN Security • Network segmentation, zoning, VRF separation, and microsegmentation design and implementation • Cisco ACI security policy — contracts, endpoint groups, and tenant separation configured through Cisco APIC • VXLAN overlays and their security implications in data centre fabric design • Zero-trust network access concepts and practical deployment experience • OT, manufacturing, or laboratory network segregation is an advantage Technical Skills – VPN, Secure Access and Cloud Security • IPSec and SSL VPN — site-to-site and remote access at enterprise scale, including encryption standards and failover • Zscaler — secure web gateway and private access policy, traffic forwarding and steering, and SSL inspection • SD-WAN security on Palo Alto Prisma SD-WAN (CloudGenix) and FatPipe platforms • Network security on AWS and Azure — security groups and network security groups, cloud-native firewalling, private connectivity, and inspection architectures • Terraform for provisioning cloud network security resources — module design, remote state, plan and apply workflow, and drift detection • Cloud tagging and governance standards Technical Skills – WAF, Load Balancing and DDoS • Web Application Firewall policy design and tuning on F5, Array, or AVI platforms • Load balancing security configuration — virtual servers, pools, monitors, SSL offload, and persistence • DDoS protection services, mitigation policy, and activation runbooks • PKI, certificates, TLS, and cipher standards as applied to network security platforms Technical Skills – Networking Foundations • Strong TCP/IP, routing and switching, VLANs, NAT, and asymmetric-routing troubleshooting • BGP and OSPF sufficient to understand and troubleshoot path selection through security enforcement points • VRF and VXLAN as they apply to segmentation and multi-tenancy • DNS, DHCP, and IP address management as they relate to security policy and filtering • LAN, WAN, WLAN, data centre, and cloud network architecture on AWS and Azure • Aruba wireless security integration, including authentication and guest access, is an advantage Automation, Tooling and AI • Terraform — infrastructure-as-code provisioning of AWS and Azure network security resources, including module design, remote state, and plan review as a change gate • Ansible — reusable roles, templates, and inventory management for multi-vendor security configuration • Python — scripting, API consumption, and automated pre- and post-change validation • Selenium — automation of vendor web consoles and portals that expose no usable API • Gemini CLI as an AI agent for policy review, log and capture triage, documentation drafting, and automation scaffolding • Platform APIs — Junos Space, Cisco APIC, FortiGate and FortiAnalyzer, Zscaler, and F5, Array, and AVI • Version control and change pipelines — Git-based workflow for security configuration • Operating systems — Cisco IOS and NX-OS, FortiOS, and working command-line competence on Linux and Windows Troubleshooting and Diagnostics • Wireshark — packet capture and protocol-level analysis, including SPAN and mirror captures • NetScout — packet-level and service-level performance monitoring and fault isolation across inspection points • Firewall and platform log analysis, including FortiAnalyzer and SIEM-based investigation • Structured fault isolation across physical, data link, network, and application layers ITSM, CMDB and Observability • ServiceNow — Incident, Problem, Change, Request, and CMDB/CSDM; Discovery and Service Mapping experience strongly preferred • Strong working knowledge of ITIL/ITSM practices, particularly Incident, Problem, and Change Management • Monitoring and observability platforms covering metrics, logs, alert design, and SIEM log onboarding • Exposure to AIOps and intelligent-operations use cases Behavioural Competencies • Strong ownership mindset — accountable for what you deploy, through to production stability and audit evidence • Security-first judgement, balanced with a pragmatic understanding that availability of business-critical services also protects patients • Calm, structured, and effective under pressure during major incidents and active security events • Rigorous and detail-oriented, with genuine discipline around change control and documentation • Strong analytical and problem-solving skills, able to diagnose across the boundary between network, security, and application layers • Clear communicator, able to explain technical risk in business terms and to say no to an unsafe request with a workable alternative • Collaborative and customer-focused, comfortable working across teams, vendors, and time zones • Automation-first instinct and a continuous-improvement mindset Preferred Certifications • Firewall and network security — Fortinet NSE 4 to 7, Cisco CCNP Security or CCIE Security, Juniper JNCIS-SEC or JNCIP-SEC • Cloud security and networking — AWS Security or Advanced Networking Specialty, Microsoft AZ-700 or SC-100 • Cloud security platform — Zscaler certification (ZDTA or equivalent) • Data centre and SDN — Cisco ACI specialisation or CCNP Data Center • Application and access security — F5 certification, including WAF or application security modules • Automation — HashiCorp Terraform Associate, Red Hat Ansible Automation, Cisco DevNet Associate • Broader security — CISSP or CCSP an advantage • ITSM — ITIL 4 Foundation or Managing Professional; ServiceNow CSA, CAD, or Discovery/CMDB certification • Agile — Certified Scrum or Agile certification Languages • English required; additional languages an advantage Pursue Progress. Discover Extraordinary. Better is out there. Better medications, better outcomes, better science. But progress doesn't happen without people — people from different backgrounds, in different locations, doing different roles, all united by one thing: a desire to make miracles happen. So, let's be those people. At Sanofi, we provide equal opportunities to all regardless of race, colour, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, or gender identity. Watch our ALL IN video and check out our Diversity Equity and Inclusion actions at sanofi.com! Pursue progress , discover extraordinary Better is out there. Better medications, better outcomes, better science. But progress doesn’t happen without people – people from different backgrounds, in different locations, doing different roles, all united by one thing: a desire to make miracles happen. So, let’s be those people. At Sanofi, we provide equal opportunities to all regardless of race, colour, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, ability or gender identity. Watch our ALL IN video and check out our Diversity Equity and Inclusion actions at sanofi.com !